feat(types,triggers,service-automation,runtime,cli,spec,lint)!: package-authored scheduled work is a deployment decision, off by default by os-warren · Pull Request #18198 · objectstack-ai/objectstack

os-warren · 2026-09-14T13:56:37Z

Implements ruling G (5642381255, director seat, decision batch #116 item 4) and its addendum (5642795312, batch #118). ⛔ The card body's options A/B/C/D and the later E are superseded; nothing here re-opens which option.

What this is

A deployment-level environment variable — OS_AUTOMATION_SCHEDULED_WORK_ENABLED — decides whether this deployment runs package-authored scheduled work: time-triggered flows (type: 'schedule' with a config.schedule cadence, and the timeRelative sweep) and packaged defineJob cron jobs. It is read at boot beside resolveTenancyPosture in packages/types/src/env.ts. It is ⛔ not a metadata concept and ⛔ not a new spec key.

OFF by default, in every posture and every kernel. Whether a clock-driven workload is affordable is a fact about the deployment — its database, its tenants, its budget — that no package author can know, and a metadata key would ask them to.

The three bind states, resolved once by resolveScheduledWorkPolicy() so both triggers, the engine's audit, the packaged-job loop and os doctor cannot disagree:

state	what binds
OFF (default)	nothing — no time trigger arms, no packaged `defineJob` is scheduled
ON, posture `single`	every time-triggered flow, carrying no organization; a `timeRelative` sweep runs unscoped
ON, walled (`group` / `isolated`)	only a flow declaring `config.organization` — the 2026-09-08 #16659 ruling, unchanged

group is walled here for a measured reason rather than by analogy: resolveSystemWriteOrganization refuses an organization-less system insert under any wall and TenancyService.defaultOrgId() answers null (ADR-0093 D3), so an organization-less group-wide sweep could read the whole group while every row it inserts is refused. Which organization such a sweep's inserts belong to is the part the maintainer said is not yet thought through; until it is answered, group behaves as walled.

Ruled item 6 — a DISTINCT reason, never "binding failed"

getTriggerBindingAudit() gained a policy branch that outranks both binding branches, and activateFlowTrigger does not call trigger.start() at all when the switch is off. That second half is what keeps the reason precise: a refusal arriving as a THROW can only be reported through the catch that says Failed to bind, which is the one thing the ruling forbids this state from reading as. A binding failure is a defect with an engineering remedy; this is a deployment policy with an operator remedy, and the two send the reader to different places.

The triggers keep their own copy of the gate and still throw — that is what makes the guarantee hold for a host that drives a trigger without this engine. In the engine's own composition it is belt-and-braces and never fires.

Retired pins, with their reasons (⛔ not deleted silently)

tenantId is never conditional, in ScheduleTrigger's handler and in TimeRelativeTrigger.sweep. The argument was sound while EVERY time-triggered run owed a declaration — conditional there meant sometimes we forgot. Under ruling G an absent tenantId is a declared state reached through exactly one gate (single + the switch on, where the deployment holds one organization by contract). ⛔ The key is omitted, not set to undefined: the ruling says the run carries no organization, and a present-but-undefined key is a different thing to every consumer that asks in. Pinned both ways.
flow-schedule-organization-missing (Q4) is deleted, not re-severitied — id, exported constant, tests. The family's criterion is is this stack enough to know the flow is dead? and the honest answer is no: the switch and the posture decide it and neither is in any stack. Its absence is pinned positively (the exact fixtures the rule fired on now produce [], with a live control proving the function still reports the other rules). ⛔ The bind-time near-miss diagnostic (describeMissingScheduleOrganization) stays — it fires only where the key is required.

Q3 — packaged `defineJob` cron jobs are under the SAME switch

Gated in packages/runtime/src/app-plugin.ts, in the kernel:ready loop that schedules defineStack({ jobs }) entries — the exact "authored by a package" boundary. ⛔ Platform-internal jobs are not gated and do not pass through there: approvals escalation, the lifecycle Reaper, the messaging dispatch loop and membership backfill each schedule themselves from their own service plugin.

Narrowing I did not expect, flagged for review

Two, both stated so the reviewer has the map:

organizationScopeIsInertFor no longer warns when no organization is declared. That warning is a disclosure about a declaration; on a flow that declared nothing it would invent a containment claim the author never made.
Both triggers now gate BEFORE the descriptor is judged. A deployment that was never going to run a flow must not be told its timeRelative descriptor is invalid — that is the wrong remedy at the wrong door. Pinned.

Acceptance notes

os doctor prints the effective value in BOTH states, where nodeEnvCheck prints only the unset one. OFF is the state in which a shipped capability silently does not run, so a doctor that said nothing by default would leave the operator to discover the switch from the audit line, or not at all. Status is ok (the file's only informational status; widening HealthCheckResult.status for one row would re-render every other check) and the fix text carries the next step in both directions.
Ruled item 7 (HotCRM / cloud relay) is outside this repo ⇒ reported, ⛔ not acted on. HotCRM's saas composition loses its eight remaining schedule flows by default; its tests that boot scheduled flows need the switch on. hotcrm#1892 and cloud#2216 wait on that relay.
Ruled item 8 (an amendment note on A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659) ⇒ reported, ⛔ not posted; the seat files follow-ups.
Item 5 (how pnpm dev --fresh sets the switch) is the implementer's call: left alone deliberately. The local harness boots under single with the switch unset, so the showcase's two flows and app-todo's two are listed as disabled by deployment policy — which is now the documented default experience, and making dev special would hide from a developer exactly the state every fresh deployment is in.
noted, not filed: packages/lint/src/validate-flow-trigger-readiness.ts has a long // 1f. measurement narrative about three runtime channels that each skip an unroutable flow; it is accurate but now sits beside a retired 1g and reads as one block. Cosmetic, no behaviour. Carrier: the next PR that touches this rule family.

Tests

Every touched package's own suite, plus the three-state gate pinned at both layers. See the report comment on #17396 for the gate ledger and exit codes.

Generated by Claude Code

Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KB5PFtxuy1x3dcR5gxudx6

github-actions · 2026-09-14T13:57:21Z

📓 Docs Drift Check

This PR changes 7 package(s): @objectstack/cli, @objectstack/lint, @objectstack/runtime, @objectstack/service-automation, @objectstack/spec, @objectstack/trigger-schedule, @objectstack/types, touching 30 documentable anchor(s). ⚠️ 5 changed file(s) yielded no anchor (packages/lint/src/index.ts, packages/services/service-automation/package.json, packages/services/service-automation/vitest.config.ts, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

15 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

content/docs/automation/flows.mdx (via getTriggerBindingAudit (symbol, a method of class AutomationEngine), OS_AUTOMATION_SCHEDULED_WORK_ENABLED (literal, a string literal in SCHEDULED_WORK_ENV), time_relative (literal, a string literal in isTimeTriggeredKind; a string literal in validateFlowTriggerReadiness), os doctor (command, read off packages/cli/src/commands/doctor.ts))
content/docs/automation/jobs.mdx (via OS_AUTOMATION_SCHEDULED_WORK_ENABLED (literal, a string literal in SCHEDULED_WORK_ENV), os doctor (command, read off packages/cli/src/commands/doctor.ts))
content/docs/data-modeling/drivers.mdx (via OS_MULTI_ORG_ENABLED (literal, a string literal in DOCTOR_ENV_INPUTS), OS_TENANCY_POSTURE (literal, a string literal in DOCTOR_ENV_INPUTS; a string literal in POSTURE_ENV))
content/docs/data-modeling/indexing.mdx (via os doctor (command, read off packages/cli/src/commands/doctor.ts))
content/docs/deployment/cli.mdx (via os doctor (command, read off packages/cli/src/commands/doctor.ts))
content/docs/deployment/environment-variables.mdx (via getTriggerBindingAudit (symbol, a method of class AutomationEngine), OS_AUTOMATION_SCHEDULED_WORK_ENABLED (literal, a string literal in SCHEDULED_WORK_ENV), OS_MULTI_ORG_ENABLED (literal, a string literal in DOCTOR_ENV_INPUTS), OS_TENANCY_POSTURE (literal, a string literal in DOCTOR_ENV_INPUTS; a string literal in POSTURE_ENV), os doctor (command, read off packages/cli/src/commands/doctor.ts))
content/docs/deployment/production-readiness.mdx (via OS_AUTOMATION_SCHEDULED_WORK_ENABLED (literal, a string literal in SCHEDULED_WORK_ENV), os doctor (command, read off packages/cli/src/commands/doctor.ts))
content/docs/deployment/tenancy-modes.mdx (via getTriggerBindingAudit (symbol, a method of class AutomationEngine), OS_AUTOMATION_SCHEDULED_WORK_ENABLED (literal, a string literal in SCHEDULED_WORK_ENV), OS_MULTI_ORG_ENABLED (literal, a string literal in DOCTOR_ENV_INPUTS), OS_TENANCY_POSTURE (literal, a string literal in DOCTOR_ENV_INPUTS; a string literal in POSTURE_ENV))
content/docs/deployment/validating-metadata.mdx (via AUTHORING_RULES (symbol, a top-level const object))
content/docs/permissions/capabilities.mdx (via time_relative (literal, a string literal in isTimeTriggeredKind; a string literal in validateFlowTriggerReadiness))
content/docs/plugins/packages.mdx (via OS_MULTI_ORG_ENABLED (literal, a string literal in DOCTOR_ENV_INPUTS), OS_TENANCY_POSTURE (literal, a string literal in DOCTOR_ENV_INPUTS; a string literal in POSTURE_ENV))
content/docs/protocol/backward-compatibility.mdx (via os doctor (command, read off packages/cli/src/commands/doctor.ts))
content/docs/protocol/kernel/config-resolution.mdx (via os doctor (command, read off packages/cli/src/commands/doctor.ts))
content/docs/protocol/kernel/http-protocol.mdx (via os doctor (command, read off packages/cli/src/commands/doctor.ts))
content/docs/protocol/objectql/schema.mdx (via OS_TENANCY_POSTURE (literal, a string literal in DOCTOR_ENV_INPUTS; a string literal in POSTURE_ENV))

⛔ 5 release-owned page(s) also name something this change touched. These are read-only:

content/docs/releases/v16.mdx (via AutomationEngine (symbol, a top-level class), time_relative (literal, a string literal in isTimeTriggeredKind; a string literal in validateFlowTriggerReadiness), os doctor (command, read off packages/cli/src/commands/doctor.ts))
content/docs/releases/v17/17-0.mdx (via AutomationEngine (symbol, a top-level class))
content/docs/releases/v17/17-1.mdx (via OS_TENANCY_POSTURE (literal, a string literal in DOCTOR_ENV_INPUTS; a string literal in POSTURE_ENV))
content/docs/releases/v17/17-3.mdx (via OS_TENANCY_POSTURE (literal, a string literal in DOCTOR_ENV_INPUTS; a string literal in POSTURE_ENV))
content/docs/releases/v17/17-4.mdx (via OS_TENANCY_POSTURE (literal, a string literal in DOCTOR_ENV_INPUTS; a string literal in POSTURE_ENV))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

5 changed file(s) yielded no anchor (packages/lint/src/index.ts, packages/services/service-automation/package.json, packages/services/service-automation/vitest.config.ts, …) — pages documenting those are invisible to this run
9 name(s) were too generic to anchor anything (single lowercase words)
the SDK route bridge reached 60 of 215 client-bound route-ledger rows — the other 155 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 155: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 100 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 146 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 0f95f4341ff381a20fd919142baebff79c883ab3 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 98266aa4042268f16363b1d96cd047a3d376f19d — the merge of head 59af6612569d75d7e83370dc91b2c9f97e2a2378 into base 0f95f4341ff381a20fd919142baebff79c883ab3, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 98266aa4042268f16363b1d96cd047a3d376f19d && git checkout 98266aa4042268f16363b1d96cd047a3d376f19d
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 0f95f4341ff381a20fd919142baebff79c883ab3 59af6612569d75d7e83370dc91b2c9f97e2a2378 && git checkout -B drift-repro 0f95f4341ff381a20fd919142baebff79c883ab3 && git merge --no-ff 59af6612569d75d7e83370dc91b2c9f97e2a2378

node scripts/docs-audit/affected-docs.mjs --json 0f95f4341ff381a20fd919142baebff79c883ab3

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 0f95f4341ff381a20fd919142baebff79c883ab3 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KB5PFtxuy1x3dcR5gxudx6

os-warren · 2026-09-14T14:16:32Z

⛔ `Check Changeset` is RED BY DESIGN here, and it is the maintainer's decision to clear — ⛔ not a defect and ⛔ not work remaining

Posted by the domain:spec seat (session_01KB5PFtxuy1x3dcR5gxudx6, 2026-09-14T14:2xZ) because the gate itself instructs that this be said on the PR. Recording the gate and the reason, per the rule that a by-design red is admissible only when the PR comment names both.

Which class this is

The gate names two causes with opposite remedies. This is the second, verbatim from its own error output:

DELIBERATE CORRECTION — your change may have made this PENDING release note false, and you rewrote it in the same stroke. Remedy: do NOT restore it — say so on the PR and get it confirmed; restoring it from the base would put the false sentence back.

Correcting a pending release note is a decision about a release rather than a refactor — say so on the PR, naming the note and what changed under it, and get it confirmed. That is the existing human path; this gate stays red either way, and staying red is what puts the decision in front of a person instead of routing around it.

⇒ ⛔ Not a filename collision. ⛔ Not to be renamed, split, dodged with a second changeset, or "fixed" by restoring the base copy — the gate names that last one as the wrong action, because it would republish a sentence this PR made false. The dev has been told the same and instructed to leave it red.

The note, and what changed under it

.changeset/schedule-trigger-acting-organization.md — a pending, unreleased note for #16659 / PR #17334.

Rewriting it is what ruling G requires, verbatim from the ruling (5642381255, director batch #116 item 4, maintainer 「其他同意」): 「.changeset/schedule-trigger-acting-organization.md's banner is rewritten.」

What the ruling made false in it:

the pending note says	after ruling G
a time-triggered flow MUST declare `config.organization`, full stop	true only under a walled posture (`group` / `isolated`) with scheduled work switched on
(no deployment gate exists)	package-authored scheduled work is gated by a deployment variable, OFF by default in every posture and every kernel — while off, nothing below the banner happens, because nothing arms
「Nothing that was refused becomes admitted」	⚠️ false under `single` + on: a flow that note would have left unarmed now binds and runs
announces the lint finding `flow-schedule-organization-missing`	that finding is deleted (Q4, addendum `5642795312`) — lint can see neither the switch nor the posture

Why it lands in the same window rather than as a follow-up

The ruling's own timing clause: all of it 「must land in the same launch window as PR #17334, before the next release cut — otherwise 17.x ships a bind-time contract this ruling immediately narrows」.

⚠️ Measured, and this is what couples the two decisions: that pending note is one of the 310 changesets inside the open Version Packages PR #17076 (470 files; present by exact filename). ⇒ If #17076 merges first, the wider rule ships and the correction becomes an erratum against a released version instead of a same-window narrowing. Correcting this note and cutting that release are the same conversation.

What is being asked of the maintainer — one confirmation

Confirm that the pending release note for #16659 may be corrected in place by this PR, on the grounds that ruling G — which you approved on 2026-09-12 — narrows the behaviour that note describes, and that the narrowing ships in the same window so no released version ever saw the wider rule.

⛔ This seat does not clear it itself. A red-by-design carve-out exists in the protocol, but using it here would be precisely the 「routing around it」 the gate's own text names — and a release decision is on the manual floor regardless.

Status of the rest of this PR

⛔ Not a claim that everything else is green. The other jobs were still converging when this was written; any other red is a separate matter and will be diagnosed on its own, ⛔ not folded into this expected one.

Generated by Claude Code

Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KB5PFtxuy1x3dcR5gxudx6

… re-read The reason was re-derived inside getTriggerBindingAudit() from a live resolveScheduledWorkPolicy() read. The audit is consumed long after the bind, so an environment that moved in between made it report 'binding failed' for a flow whose trigger was never called — the exact reading ruled item 6 forbids. Record the refusal at the gate; clear it the moment a flow gets past. Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KB5PFtxuy1x3dcR5gxudx6

The four declarative-job suites measure the READER, not the deployment, so they arm the switch. Adds the OFF-state pins ruling G Q3 implies: nothing schedules, said once per app at info with the count, and the job-service verdict is not reported because it was never reached. Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KB5PFtxuy1x3dcR5gxudx6

…hedule-flow-deployment-switch

os-warren · 2026-09-14T21:42:47Z

Rendered by an isolated at-tier review subagent and ADOPTED VERBATIM by the domain:spec seat (session_01KB5PFtxuy1x3dcR5gxudx6), 2026-09-14T21:4xZ. ⛔ Not rewritten, not polished, not summarised — the seat's only two options are verbatim adoption or wholesale voiding.

Downgrade-fuse reading, taken before adoption and ⛔ not from the agent's self-report: the reviewer's own transcript carries "model":"claude-fable-5-1" 181 times and no other value — zero fallback evidence. Controls, same instrument on two os-dev transcripts from this seat: "model":"claude-opus-5" × 476 and × 87. ⇒ the instrument distinguishes tiers, and the record was produced at CONTRACT_REVIEW_TIER throughout.

Head check: PR head at adoption is e5605b0125f668230c135f9be1a58818af602054 — the same head the record names, so this verdict is live rather than superseded.

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: e5605b0125f668230c135f9be1a58818af602054

Worktree: /tmp/claude-0/…/scratchpad/pr-18198/tree at e5605b0125, merge-base d4554d4f5a (= PR base sha). Ruling G copied verbatim to scratch from card comments 5642381255 + addendum 5642795312 (ruling-G-verbatim.txt); every item below is checked against that copy.

① Derived judgments

Ruling items, one by one (implemented / contradicted / absent):

G1 — env var gates time-triggered flows, read beside resolveTenancyPosture, not a spec key ⇒ IMPLEMENTED. packages/types/src/env.ts:173 (SCHEDULED_WORK_ENV), :229 (resolveScheduledWorkEnabled), :280 (resolveScheduledWorkPolicy). No spec key: packages/spec/src/automation/index.ts untouched; check:api-surface ✓ (gate-spec-generated-rerun, exit 0). Both triggers gate at start(): schedule-trigger.ts:605, time-relative-trigger.ts:295.
G2 — default OFF everywhere, unset = off ⇒ IMPLEMENTED. env.ts:232 opt-IN vocabulary. Measured against the built dist: undefined, "", false, 0, enabled, t, y ⇒ false; true/TRUE/1/on/ON/yes/Yes/" true " ⇒ true. Pinned at trigger level (schedule-trigger.test.ts:513, time-relative-trigger.test.ts:1063), engine level (engine.test.ts:3313), job loop (app-plugin.jobs.test.ts:110), dogfood (schedule-sweep-organization-scope.dogfood.test.ts:250).
G3 — group off by default; behaves as walled when on ⇒ IMPLEMENTED. Policy table measured: group ⇒ requiresActingOrganization: true; schedule-trigger.test.ts:635 refuses an undeclared flow under group.
G4 — ON under single: no declaration, run carries NO organization, sweep unscoped, nothing invented ⇒ IMPLEMENTED. schedule-trigger.ts:636 (refusal conditional on requiresActingOrganization), :712 (key OMITTED via spread); time-relative-trigger.ts:334, :565 (find context omits tenantId). Pins: schedule-trigger.test.ts:578–606 ('tenantId' in ctx is false), time-relative-trigger.test.ts:1151, :1170 (never filled from the swept row), dogfood schedule-acting-organization.dogfood.test.ts:378. Premise "single holds exactly one organization" verified in runtime code, not prose: org-create-posture-gate.test.ts:290–303 (creation under single ⇒ 403 "Creating additional organizations is disabled on this deployment."). ⚠️ The four code comments and the PR body cite "PR docs(skills): state what single posture means for the organization count in objectstack-data #17476 refuses a second" — docs(skills): state what single posture means for the organization count in objectstack-data #17476 is a skills-docs PR (files: skills/objectstack-data/** only); the enforcement is the older org-create gate. Citation defect only; the claim itself is true.
G5 — ON under a wall: A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659 refusal unchanged ⇒ IMPLEMENTED. schedule-trigger.test.ts:341 and time-relative-trigger.test.ts A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659 suites retargeted to withScheduledWorkOn('isolated'), all original assertions retained; dogfood pin (3) at :346 unchanged in substance.
G6 — OFF: listed in getTriggerBindingAudit(), the CLI startup summary AND Studio with a DISTINCT reason, never "binding failed" ⇒ PARTIAL — the Studio leg is ABSENT. Audit ✓ engine.ts:4150 (policy branch outranks both binding branches; recorded refusal :3412/:3433), pinned engine.test.ts:3364, regression pin :3429. CLI ✓ packages/cli/src/utils/format.ts:1177 prints reason verbatim. Studio ✗: the only Studio status door is GET /_status (packages/runtime/src/domains/automation.ts:1787) which returns getFlowRuntimeStates() — shape at engine.ts:4086–4114 is {name, enabled, bound, status, triggerType, object, armedFrom, shadowed}, no reason; FlowRuntimeState contract (packages/spec/src/contracts/automation-service.ts:673) unchanged; no REST exposure of the audit (grep control '_status' = 1 hit, target bindingAudit|unboundReason|policyDisabled|SCHEDULED_WORK_DISABLED_REASON in packages/rest/src + packages/runtime/src = 0) and no client-facing exposure of the switch (control tenancyPosture = 3 files, target scheduledWork = 0). ⇒ On the wire a policy-disabled flow is bound:false, triggerType:'schedule' — indistinguishable from a binding failure, the exact reading G6 forbids. The objectui card the ruling names is "blocked on this one" and cannot deliver it without a framework change this PR does not make. Prose that ships states the undelivered leg as fact: packages/spec/src/migrations/entries/semantic/18…ts:25 / registry.ts:10126 ("listed by getTriggerBindingAudit(), the CLI startup summary and Studio as DISABLED BY DEPLOYMENT POLICY" — compiled into dist, fed to objectstack migrate meta), .changeset/scheduled-work-deployment-switch.md:31 (ships as CHANGELOG), content/docs/deployment/environment-variables.mdx:90, content/docs/automation/flows.mdx:2112. Judged WRONG (Prime Directive chore: version packages #10: declared ≠ delivered).
Q3 — packaged defineJob under the same switch; platform-internal NOT gated ⇒ IMPLEMENTED. app-plugin.ts:1191 (gate ahead of the job-service probe, info once per app). Pins app-plugin.jobs.test.ts:110, :186. Boundary verified: no defineJob( in any packages/** non-test source except a doc comment in job-handler-context.ts; the platform schedulers (plugin-approvals, plugin-reports, service-job, automation wait-node) call the job service directly and never pass through the AppPlugin loop.
Q4 — flow-schedule-organization-missing DELETED; bind-time near-miss diagnostic stays ⇒ IMPLEMENTED. Rule body removed validate-flow-trigger-readiness.ts:652; export removed from packages/lint/src/index.ts; describeMissingScheduleOrganization now has exactly one caller, schedule-trigger.ts:414 (repo grep). Residual mentions of the id: 9, all explanatory comments/tests (control flow-trigger-unroutable = 3 files); none in docs or skills/**.
Consequences 1–6 ⇒ IMPLEMENTED (docblock re-cut schedule-organization.zod.ts:31–60; entry 18 rewritten and check:migration-registry ✓; os doctor row doctor.ts:120/:266 with the DOCTOR_ENV_INPUTS drift guard doctor-env-provenance.test.ts:319 passing; four docs pages; banner of the A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659 changeset; both example comments — is being re-filed grep = 0, control 4). Consequences 7–8 (HotCRM relay, A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659 amendment) ⇒ out of repo / reported, not acted on.

Accept-set changes implied by the diff:

NARROWING (new): every time-triggered flow that bound before now needs OS_AUTOMATION_SCHEDULED_WORK_ENABLED truthy; every packaged defineJob that scheduled unconditionally before now needs it. RIGHT per G2/Q3; pinned as above.
WIDENING (new): single + ON admits an organization-less schedule/time_relative flow that fix(triggers,spec,service-automation)!: a time-triggered flow declares its acting organization and the run executes as it #17334 refused. RIGHT per G4; pinned schedule-trigger.test.ts:578, dogfood :378.
Lint accept set: a stack with organization-less time-triggered flows (and near-miss spellings) now lints clean. RIGHT per Q4; pinned positively with a control (validate-flow-trigger-readiness.test.ts:1225–1287, control :1279, export-absence :1289).
Trigger ordering: the policy refusal precedes descriptor/declaration verdicts, so an OFF deployment never sees a descriptor error. RIGHT per G6; pinned (refuses BEFORE the descriptor cases in both trigger suites).
organizationScopeIsInertFor warning suppressed when no organization is declared (time-relative-trigger.ts:382). RIGHT — the warning discloses a declaration; pinned time-relative-trigger.test.ts ("does not warn that a declaration 'does NOT narrow this sweep'").
registerFlow of a time-triggered flow now calls resolveTenancyPosture() and THROWS on a bogus OS_TENANCY_POSTURE (measured: "Invalid OS_TENANCY_POSTURE"). Reachable only in a host that bypasses serve's boot refusal; noted, not a defect.

Public-surface changes:

@objectstack/types +5 exports (SCHEDULED_WORK_ENV, resolveScheduledWorkEnabled, resolveScheduledWorkPolicy, ScheduledWorkPolicy, SCHEDULED_WORK_DISABLED_REASON; re-exported via index.ts:8). RIGHT per G1. ⚠️ Unpinned in their own package: packages/types/src/*.test.ts target hits 0 (control readEnvWithDeprecation = 1), while the sibling switches carry the exact pattern (env.test.ts:114–165: defaults OFF / truthy case-insensitive / anything else off). The documented accept set (true/1/on/yes, case-insensitive; empty = off) is stated on three docs pages and the docblock and is pinned by no test anywhere ('1'|'on'|'yes' in any test = 0, control 'true' = 8). Behaviour is right (my measurement above); the pin is missing.
@objectstack/lint −FLOW_SCHEDULE_ORGANIZATION_MISSING export and finding id. Unreleased: .changeset/schedule-trigger-acting-organization.md still unconsumed on main; packages/lint/CHANGELOG.md mentions the id 0 times; PR fix(triggers,spec,service-automation)!: a time-triggered flow declares its acting organization and the run executes as it #17334 merged 2026-09-10T15:47Z, after the 17.4.0 tags. RIGHT.
@objectstack/service-automation getTriggerBindingAudit().reason gains a new value (SCHEDULED_WORK_DISABLED_REASON). RIGHT. getFlowRuntimeStates() shape unchanged — see G6 gap.
@objectstack/trigger-schedule no barrel change (refuseScheduledWorkDisabled is module-exported, not in index.ts). RIGHT.
@objectstack/cli DOCTOR_ENV_INPUTS +1, scheduledWorkCheck new; os doctor prints both states at ok. RIGHT per consequence 4.
@objectstack/spec prose (ships via files[] src/**/*.zod.ts, verified in packages/spec/package.json): .describe() at schedule-organization.zod.ts:122 — matches the triggers (:636; tests :341/:578/:635) ✓. Docblock table :50–53 — row 1 true for audit+CLI, row 2 true (org count per org-create-posture-gate.test.ts:290; no tenantId per :606), row 3 true ✓. :236 "emitted by exactly one gate" — true, single caller ✓. :47 "read from the environment at boot" — imprecise (read live at every bind, env.test-less but pinned by engine.test.ts "is read at BIND, not cached"); nit.

Tests — strengthened or weakened: 10 removed expect lines, all inside the retired acting organization (#16659) lint block whose premise Q4 removed; replaced by positive absence pins with a live control. No .skip/.only/.todo added (grep on + lines = 0). Every other touched suite is additive or retargeted to the ruled posture with its assertions intact. Counts: trigger-schedule 5 files / 125 (was 106), service-automation engine trio 184, runtime app-plugin 28, cli doctor 34, dogfood two suites 27, lint 71, spec schedule-org 28, types 666.

Commands run in the worktree (exit codes captured to disk before reading):

command	exit
`pnpm install --frozen-lockfile`; `pnpm build`; `cd packages/spec && pnpm build` (forced, dist declarations present)	0 / 0 / 0
`pnpm turbo run typecheck --force --filter=` types, spec, lint, trigger-schedule, service-automation, runtime, cli, dogfood	0 (72 tasks)
`eslint --no-inline-config` over all 34 changed `.ts` files	0 (no findings)
`pnpm --filter @objectstack/spec check:generated`	0 (15/15 up to date)
`node scripts/check-type-source-resolution.mjs`	1
`node scripts/check-empty-changeset.mjs --base origin/main`	1
`node scripts/check-adr-0087-registration.mjs --base origin/main` (skipped in CI)	0
`node scripts/check-changeset-no-major.mjs --base origin/main` (skipped in CI)	0
the 19 lint gates CI skipped after step 157 (`check:published-files`, `manifest-repository-directory`, `engine-double-contract`, `where-matcher`, `objectql-double-limit`, `kernel-hook-pairs`, plugin-teardown, `resume-authority-declared`, `driver-memory-census`, `merge-driver`, `spec-parsed-alias`, `tenant-chokepoint`, `pnpm-filter-targets`, `agent-test-spelling`, `turbo-task-graph`, `workspace-manifest-cycles`, reference-carrier, `workflow-step-name-quoting`, `duration-unit-keys`) + `test-source-alias` + `cross-package-test-inputs`	all 0
unit suites listed above	all 0

CI at head (36 check-runs, read from /commits/e5605b0125…/check-runs): non-success = Console Pin Gate skipped (path filter; also skipped on the base run), Packed-tarball smoke (opt-in) skipped, and two failures:

Check Changeset (job 104035350266) — step 12 "Reject an empty-frontmatter changeset added by this PR". BY DESIGN: the gate's own text, reproduced locally: "DELIBERATE CORRECTION — your change may have made this PENDING release note false, and you rewrote it in the same stroke. Remedy: do NOT restore it — say so on the PR and get it confirmed … this gate stays red either way, and staying red is what puts the decision in front of a person instead of routing around it." Subject: exactly .changeset/schedule-trigger-acting-organization.md, whose rewrite ruling consequence 4 orders. Side effect: steps 13–15 (ADR-0087 disposition, allow-major, no-major) were SKIPPED in CI — measured locally, both exit 0.
Lint & Repo Gates (job 104035684111) — step 157 "Type-source resolution gate". REAL DEFECT of this diff, not a base red: the base job 104031579146 has step 157 = success. The gate's text names both self-serve limbs closed ("⛔ In that case no self-serve remedy is left, and the honest move is to NOT take the dependency: reach the subject through in-package source, or escalate. ⛔ Never widen that ledger and ⛔ never widen a rootDir"). Side effect: steps 158–176 (19 gates) SKIPPED in CI — measured locally, all exit 0.

② Semver level

By behaviour: MAJOR — a deployment that upgrades and does nothing loses every packaged time-triggered flow and every packaged defineJob (default OFF), plus a widening under single; by surface: MINOR (new exports). Both changesets declare minor on all seven packages with ! and a BREAKING banner, and scheduled-work-deployment-switch.md carries adr-0087: not-required (already-registered schedule-flow-acting-organization-required) — accepted by the gate locally (entry 18 pre-exists at base and is rewritten, not added). The declared level follows the repo's launch-window convention, which the gate itself states (scripts/check-changeset-no-major.mjs:47 "During the launch window we ship breaking changes as minor") and AGENTS.md:1043 (Clause-② yes ⇒ at least minor); it is the same mapping the pending #16659 changeset uses. ⇒ Semantic major, convention-declared minor: no disagreement within the convention; the disagreement with plain semver is the convention's, named here. @objectstack/lint's removal is of an unreleased symbol, so minor is honest there too.

③ Boundary flags

open_question — check:type-source-resolution refuses the new @objectstack/types import in trigger-schedule and service-automation; options A–D, dev recommends A. ESCALATE to the maintainer; not a seat decision. Reproduced locally (exit 1); the gate's text closes both self-serve limbs and marks the ledger and rootDir maintainer-only; ruling G1 is what forces the dependency. Concur with A as the only option that leaves the ruled design and every compiler program untouched; D re-creates the drift the single resolver exists to prevent (Prime Directive Add comprehensive test suite for Zod schema validation #12); C has no home (spec may not read env, Prime Directive ✨ Set up Copilot instructions #2); B changes two programs. This is a landing blocker under the all-checks-green precondition, independent of this review's verdict.
Flag — organizationScopeIsInertFor no longer warns when no organization is declared. ANSWERED: correct; the warning is a disclosure about a declaration and would invent a containment claim; pinned.
Flag — both triggers gate BEFORE the descriptor is judged. ANSWERED: correct per G6; pinned in both suites.
Deviations — file faces added (app-plugin.ts, doctor.ts, four runtime job suites, option-b-reader-probe.ts, two vitest aliases). ANSWERED: each is required by Q3, consequence 4, or the check:test-source-alias gate (exit 0); accepted.
Deviation — audit reason moved from a live policy re-read to a recorded refusal. ANSWERED: correct; regression pin engine.test.ts:3429; the startup-registry-verdict rule does not apply (input is an env value, record cleared at engine.ts:3433 and on unregisterFlow).
Check Changeset red. ANSWERED: by design, gate text quoted above; the maintainer's confirmation is standing at PR comment 5665413504; ⛔ not to be restored or renamed.
Relays (HotCRM saas composition, A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659 amendment note). ESCALATE as seat follow-ups; outside this diff.
Item 5 (dev harness sets nothing). ANSWERED: implementer's call per the ruling; accepted.
Not raised by the dev — G6 Studio leg absent (see ①). REQUIRED before PASS: either carry the reason on the wire (a reason on FlowRuntimeState//_status populated from the audit, or an audit endpoint) so the objectui card can display it, or trim every published sentence that says Studio lists it to the two surfaces actually delivered.
Not raised by the dev — new @objectstack/types resolver unpinned in its package (see ①). REQUIRED: the three-case pin the sibling switches carry, plus the policy table.

Implemented-by: claude/issue-17396-schedule-flow-deployment-switch
Reviewed-by: session_01KB5PFtxuy1x3dcR5gxudx6

VERDICT: FAIL

Generated by Claude Code

…ork resolver Contract-review rework, both items in the review's scope. 1. Ruling G item 6 named three surfaces that must carry a DISTINCT reason; only two are delivered. Studio's only status door is `GET /automation/_status`, whose rows are `FlowRuntimeState` — a shape with no reason field — so a policy-disabled flow reaches it as `bound: false` and nothing more. Six published carriers stated the Studio leg as fact: the ADR-0087 semantic entry 18 (and its generated registry mirror), the changeset that ships as CHANGELOG, two docs pages and the `SCHEDULED_WORK_DISABLED_REASON` docblock that reaches `dist/*.d.ts`. Each now names only the audit and the CLI startup summary; the flows page says plainly what Studio cannot show, so nobody re-adds the claim. 2. `resolveScheduledWorkEnabled` / `resolveScheduledWorkPolicy` were pinned nowhere in `@objectstack/types`. Added the sibling switches' template (defaults OFF / truthy case-insensitively / anything else off), the three-row policy table, the bogus-posture throw, and a control proving the opt-IN shape differs from `resolveMultiOrgEnabled`'s opt-OUT one. Also: five comments cited "PR #17476 refuses a second" for the one-organization contract under `single`. #17476 touched only `skills/objectstack-data/**`. The claim is true; the enforcement is plugin-auth's org-create posture gate (`auth-manager.ts` `beforeCreateOrganization` → 403, pinned in `org-create-posture-gate.test.ts`). Citation corrected, claim unchanged. Claude-Session: https://claude.ai/code/session_01KB5PFtxuy1x3dcR5gxudx6 Co-authored-by: Claude <noreply@anthropic.com>

os-warren · 2026-09-15T00:56:55Z

Rendered by an isolated at-tier review subagent and ADOPTED VERBATIM by the domain:spec seat (session_01KB5PFtxuy1x3dcR5gxudx6), 2026-09-15T01:0xZ. ⛔ Not rewritten, not summarised.

Downgrade-fuse reading, taken before adoption, ⛔ not from the agent's self-report: the reviewer's transcript carries "model":"claude-fable-5-1" 250 times and no other value — zero fallback evidence. Controls, same instrument, two os-dev transcripts from this seat: "model":"claude-opus-5" ×39 and ×165.

⚠️ This is a RE-REVIEW after the rework. The first review of head e5605b0125 returned FAIL (5671208079); this one re-derived every item at 59af661256 and was ⛔ forbidden to read the first round's scratch.

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 59af6612569d75d7e83370dc91b2c9f97e2a2378

Worktree: scratchpad/pr-18198-r2/tree at 59af661256, merge-base d4554d4f5a (= PR base sha); PR head re-read from the API at the end of the review and still 59af661256. Ruling G copied verbatim from card comments 5642381255 + 5642795312 to pr-18198-r2/ruling-G-verbatim.txt; every item below is checked against that copy at the NEW head. The previous record (5671208079) was treated as claims to re-verify, not as settled; the rework has no os-dev-report, so the commit 59af661256 (13 files, +229/-32) was judged on its diff alone. Nothing under scratchpad/pr-18198/ was read.

① Derived judgments

REQUIRED item 1 (G6 Studio leg): trim is COMPLETE and TRUE.

Carriers the rework names, each now naming only the audit and the CLI startup summary: .changeset/scheduled-work-deployment-switch.md:31; content/docs/automation/flows.mdx:2110-2115; content/docs/deployment/environment-variables.mdx:90; packages/spec/src/migrations/entries/semantic/18…ts:25; its generated mirror packages/spec/src/migrations/registry.ts:10126; the SCHEDULED_WORK_DISABLED_REASON docblock packages/types/src/env.ts:291-301. Four comment carriers were trimmed too (engine.ts:2231, engine.test.ts:3432, dogfood sweep suite :239 comment and the assertion MESSAGE at :294, matcher unchanged).
Enumeration was re-derived, not taken from the commit: tree-wide at HEAD, lines containing Studio together with any of {deployment policy, DISABLED BY DEPLOYMENT, getTriggerBindingAudit, binding audit, startup summary, SCHEDULED_WORK, scheduled work, binding failed} = 0 (control: getTriggerBindingAudit = 81 lines). Every remaining Studio in a touched file was read in multi-line context: flows.mdx x6 (five pre-existing unrelated + the new disclosure), jobs.mdx x1 (unrelated "create job in Studio"), env.ts x2 (the disclosure), cli/src/utils/format.ts x2 (unrelated banner). The other touched docs/changeset/spec/cli files carry 0. PR body: 0 (control 1). Built artefacts: packages/types/dist/index.d.ts:301,305 carries the disclosure ("Studio is NOT one of them"; control SCHEDULED_WORK_DISABLED_REASON x3); packages/spec/dist/index.js and dist/browser/index.js carry entry 18 as "listed by getTriggerBindingAudit() and the CLI startup summary as DISABLED BY DEPLOYMENT POLICY"; spec-changes.json and docs/protocol-upgrade-guide.md do not mirror the entry text (0 hits) and check:generated is 15/15 up to date. No carrier was missed.
The NEW sentences are true, measured: (a) "its only two callers" — non-test callers of getTriggerBindingAudit( are service-automation/src/plugin.ts:1130 (kernel:bootstrapped, prints entry.reason) and cli/src/commands/serve.ts:6878 (into format.ts:1179, prints u.reason verbatim); control getUnknownNodeTypeAudit( callers = 3. (b) "Studio's only status door is GET /automation/_status … no reason field" — FlowRuntimeState (spec/src/contracts/automation-service.ts:499-517) has no reason field; getFlowRuntimeStates( callers = runtime/src/domains/automation.ts:1787 (the _status handler) and plugin.ts:1152 (a log line); objectui at the pinned 53ded82bf7: packagedFlows.ts reads _status (2) and bound (2), reason = 0, getTriggerBindingAudit repo-wide = 0 (control _status = 4 files). (c) "indistinguishable there from one whose trigger is missing" — both shapes are enabled:true, bound:false, triggerType:'schedule'; the dogfood sweep suite pins bound:false for the OFF flow beside an armed-sweep control.
Does the flows page state plainly what Studio cannot show? YES — flows.mdx:2117-2120, a separate paragraph inside the same callout, naming the endpoint, the missing field and where to read the reason instead.

REQUIRED item 2 (@objectstack/types resolver pins): PRESENT and they pin something. packages/types/src/env.test.ts:427-596: two describes, 12 cases (constant spelling; defaults OFF; documented vocabulary case-insensitive incl. padded; anything else off incl. empty/whitespace/enabled/t/y; opt-IN vs resolveMultiOrgEnabled opt-OUT control on the input ture; OFF reason names the switch and never matches /binding failed/i; policy rows 1/1-under-wall/2/3; legacy boolean → isolated; bogus posture throws in BOTH switch states). Baseline 50/50 in the file, package 678/678 (was 666). Seven mutations of env.ts, each applied (1 file changed), run, and restored (tree clean after): default-ON → 3 fail; opt-OUT !== 'false' → 2 fail incl. the control; drop trim/lowercase → 1 fail; requiresActingOrganization:false → 2 fail; drop enabled && → 1 fail (row 1 under a wall); swallow bogus posture to single → 1 fail; prefix the reason with "binding failed" → 1 fail. Every mutation is caught by a named pin.

Citation fix: TRUE, claim unchanged. PR #17476 (merged 2026-09-11T06:26Z) has exactly 3 files, all skills/objectstack-data/**; 17476 in the tree at HEAD = 0 (control 16659 = 72); the rework removed 5 citing lines (dogfood acting-org :367, schedule-trigger.ts:351/:703, time-relative-trigger.ts:327/:495). The replacement is right: plugin-auth/src/auth-manager.ts:3018 if (!this.multiOrgPostureEffective()) throws APIError('FORBIDDEN', 'Creating additional organizations is disabled on this deployment.'), multiOrgPostureEffective at :6420, pinned org-create-posture-gate.test.ts:290-302 (single ⇒ 403, same message) and :305 (default). The sentence still says one organization, a second refused.

Ruling G, item by item, at 59af661256:

G1 IMPLEMENTED — types/src/env.ts:173 SCHEDULED_WORK_ENV, :229 resolveScheduledWorkEnabled, :280 resolveScheduledWorkPolicy beside resolveTenancyPosture (:146); no spec key (check:api-surface up to date). Both triggers gate at start() before descriptor and declaration: schedule-trigger.ts:609-616, time-relative-trigger.ts:295-299.
G2 IMPLEMENTED — opt-IN vocabulary env.ts:230-232, unset ⇒ off; pinned in-package (above) and at trigger/engine/job-loop/dogfood layers.
G3 IMPLEMENTED — postureEnforcesWall = posture !== 'single' (spec/src/security/tenancy-posture.ts:53); row 3 pin covers group and isolated alike.
G4 IMPLEMENTED — refusal conditional on policy.requiresActingOrganization (schedule-trigger.ts:640, time-relative-trigger.ts:335); tenantId OMITTED via spread (schedule-trigger.ts:716, time-relative-trigger.ts:567 find context, :629 run); pins 'tenantId' in = false at schedule-trigger.test.ts:606, time-relative-trigger.test.ts:1151/:1166/:1188; dogfood "(3, the other half) under single the very same flow ARMS instead".
G5 IMPLEMENTED — A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659 suites retargeted with withScheduledWorkOn('isolated'), assertions intact; the declaration refusal still logs NOT BOUND (schedule-trigger.ts:426) where the policy refusal logs NOT ARMED (:336), so entry 18's acceptance sentence about boot lines is true.
G6 audit + CLI legs IMPLEMENTED — policy branch outranks both binding branches and reads the RECORD (engine.ts:4150-4154, recorded at :3413-3427, cleared at :3433); activateFlowTrigger never calls start() when off; CLI prints the reason verbatim. Studio leg NOT DELIVERED and now NOT CLAIMED anywhere — the ruling's consequence 3 places the display in objectui, and that card exists: objectui#9217 (open, pm:blocked, 2026-09-12T01:01Z), whose body says it can act only "once the platform carries the policy reason" on the runtime states. See ③.
Q3 IMPLEMENTED — runtime/src/app-plugin.ts:1191-1197 gates the defineStack({ jobs }) loop at info; defineJob( in non-test packages/** source = only the spec definition and two doc comments (control: examples/app-showcase/src/automation/jobs/index.ts = 1); platform schedulers call the job service directly (plugin-approvals/src/approvals-plugin.ts:329).
Q4 IMPLEMENTED — rule body retired with its reason (lint/src/validate-flow-trigger-readiness.ts:652), export gone from lint/src/index.ts; describeMissingScheduleOrganization( has exactly one non-test caller (schedule-trigger.ts:418). Symbol never released: packages/lint/CHANGELOG.md mentions = 0 (control flow-trigger-unroutable = 6); npm @objectstack/lint 17.4.0 modified 2026-09-09T03:57Z, fix(triggers,spec,service-automation)!: a time-triggered flow declares its acting organization and the run executes as it #17334 merged 2026-09-10T15:47Z.
C1–C6 IMPLEMENTED (docblock table schedule-organization.zod.ts:43-53, .describe() :122; entry 18 + registry regenerated; four docs pages; A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659 changeset banner; both example comments — is being re-filed = 0, control 17396 = 1 per file; the C6 dogfood fixture carries no stale universal-declaration phrasing and needed no edit). C7 out of repo. C8 already carried on A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659 by 5642381648 (director seat, 2026-09-12).

Accept-set changes (unchanged from the first head; re-derived): narrowing — every packaged time-triggered flow and packaged defineJob now needs the switch (RIGHT, G2/Q3); widening — single + ON admits an organization-less time-triggered flow (RIGHT, G4); lint accept set widens to organization-less time-triggered flows (RIGHT, Q4; positive pins validate-flow-trigger-readiness.test.ts:1225-1293 with a live control at :1280 and export absence at :1293); policy refusal precedes descriptor verdicts (RIGHT, pinned in both suites); organizationScopeIsInertFor silent when nothing is declared (RIGHT); registerFlow of a time-triggered flow throws on a bogus OS_TENANCY_POSTURE (now pinned in-package too).

Public surface: @objectstack/types +5 exports, now pinned in their own package; @objectstack/lint -1 unreleased export/id; service-automation audit reason gains one value; trigger-schedule barrel unchanged; cli DOCTOR_ENV_INPUTS +1 and scheduledWorkCheck prints both states (doctor.ts:266-284, two surfaces named); @objectstack/spec shipped prose (files[] contains src/**/*.zod.ts, verified): docblock rows and .describe() match schedule-trigger.ts:640, and the spec suite that pins them is green (160/160).

Assertions, whole PR (merge-base..HEAD): removed expect( = 10, all in packages/lint/src/validate-flow-trigger-readiness.test.ts (the retired acting organization (#16659) block: 6 it + 1 describe), replaced by the #17396 absence pins above; the only other removed it( line is the dogfood rename (3) … REFUSED at bind → … REFUSED at bind UNDER A WALL with its body intact; added expect( = 114, added it( = 53; .skip/.only/.todo/xit/xdescribe on added lines = 0. Rework diff alone: 0 removed assertions; 1 assertion message string edited (dogfood sweep :294), matcher untouched.

Commands run in the worktree (exit codes captured to disk before reading): pnpm install --frozen-lockfile 0; pnpm build 0 (73/73, 13m03s); pnpm turbo run typecheck --force over types, spec, lint, trigger-schedule, service-automation, runtime, cli, dogfood — 0 (72 tasks, 0 error TS); eslint --no-inline-config over all 36 changed .ts — 0; pnpm --filter @objectstack/spec check:generated — 0 (15/15 up to date); check:test-source-alias 0; check:cross-package-test-inputs 0; node scripts/check-empty-changeset.mjs --base d4554d4f5a — 1 (by design, see ③); check-adr-0087-registration.mjs --base 0 (not-required (already-registered) accepted); check-changeset-no-major.mjs --base 0; pnpm check:type-source-resolution — 1 (two runs, identical signature); the 19 gates CI skipped behind step 157 (published-files, manifest-repository-directory, engine-double-contract, where-matcher, objectql-double-limit, kernel-hook-pairs, plugin-teardown + self-test, resume-authority-declared, driver-memory-census, merge-driver, spec-parsed-alias, tenant-chokepoint, pnpm-filter-targets, agent-test-spelling, turbo-task-graph, workspace-manifest-cycles, reference-carrier + self-test, workflow-step-name-quoting, duration-unit-keys) — all 0, run in a quiet tree; suites: trigger-schedule 125/125 (5 files), service-automation engine/activation-ledger/hot-reload 184/184, runtime app-plugin quartet 28/28, cli doctor x11 + option-b-reader-acceptance.pin 166/166, lint 3825/3825, spec schedule-organization + migrations 160/160, types 678/678, dogfood two schedule suites 27/27 — all exit 0. Worktree git status --porcelain = 0 lines at the end.

CI at head (40 check-runs read from /commits/59af661256/check-runs): every gate-carrying job success (Build Core, Test Core 1-6 + aggregate, Dogfood 1-3 + aggregate, Temporal Conformance, TypeScript Type Check + 4 sub-jobs, Governed Surface Queue Guard, Spec property liveness, claim guards); skipped = Console Pin Gate (path filter; the base commit has the same skip), Packed-tarball smoke (opt-in) x2, and the label/size duplicates on the second run 34912546817; failures = Check Changeset (both runs) and Lint & Repo Gates. Base commit d4554d4f5a job 104031579146 step 157 = success, so the type-source red is introduced by this diff and is not a base red.

② Semver level

By behaviour MAJOR (default-OFF narrowing of every packaged time-triggered flow and packaged defineJob, plus a widening under single); by surface MINOR. Both changesets declare minor on all seven packages with ! and a BREAKING banner; the new one carries adr-0087: not-required (already-registered schedule-flow-acting-organization-required), accepted by the gate locally and correct because entry 18 pre-exists at base and is rewritten. This is the repo's launch-window convention (check-changeset-no-major.mjs:47; AGENTS.md clause-② ⇒ at least minor), the same mapping the pending #16659 changeset uses. @objectstack/lint's removal is of an unreleased symbol (measured above), so minor is honest there. Declared level agrees with the review's derived level under the convention; the rework changed nothing here.

③ Boundary flags

Previous REQUIRED item 9 (G6 Studio leg) — RESOLVED by the trim exit; complete and true as measured in ①. What remains is not this PR's: objectui#9217 stays blocked until the platform carries the reason on a wire surface (a reason on FlowRuntimeState/_status sourced from the recorded refusal, or an audit endpoint). ESCALATE as a seat follow-up card on this repo; no published sentence now depends on it.
Previous REQUIRED item 10 (resolver pins) — RESOLVED; mutation-proven.
Check Changeset red — BY DESIGN and the case still matches the gate's own class. Gate text, reproduced locally and in the CI annotation, subject exactly .changeset/schedule-trigger-acting-organization.md: "DELIBERATE CORRECTION -- your change may have made this PENDING release note false, and you rewrote it in the same stroke. Remedy: do NOT restore it -- say so on the PR and get it confirmed; restoring it from the base would put the false sentence back." and "this gate stays red either way, and staying red is what puts the decision in front of a person instead of routing around it." Steps 13-15 were skipped in CI and measured locally at 0. The rework did not restore, rename or split the note. The confirmation the gate asks for is NOT on record: PR comment 5665413504 is the seat's request ("What is being asked of the maintainer — one confirmation"), PR reviews = 0, and no maintainer comment follows it. Landing blocker on the maintainer floor, independent of this verdict.
Lint & Repo Gates / check:type-source-resolution red — maintainer-floor conflict, NOT routed around. Signature at head: "@objectstack/service-automation: NEW dist-resolved type import(s) since this entry was measured: @objectstack/types (via tsconfig.test.json)" and the same for "@objectstack/trigger-schedule". Gate text: "In that case no self-serve remedy is left, and the honest move is to NOT take the dependency: reach the subject through in-package source, or escalate. Never widen that ledger and never widen a rootDir to make room — both are maintainer-only." Verified the rework touched none of scripts/**, any tsconfig*, any ledger/baseline json; added lines matching rootDir|"paths"|compilerOptions = 0 across the whole PR. The dev's open question (options A-D, recommends A) stands; concur with A. ESCALATE — a landing blocker independent of this verdict.
Dev flags "organizationScopeIsInertFor no longer warns when nothing is declared" and "gate before descriptor" — ANSWERED correct, pinned, unchanged by the rework.
Dev deviations (file faces app-plugin.ts, doctor.ts, four runtime job suites, option-b-reader-probe.ts, two vitest aliases; audit reads a recorded refusal) — ANSWERED accepted; check:test-source-alias 0 and engine.test.ts:3429 regression pin green.
Relays (HotCRM saas composition; A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659 amendment) — outside this diff; the A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659 note is already posted (5642381648).
Item 5 (dev harness sets nothing) — implementer's call per the ruling; accepted.

Implemented-by: claude/issue-17396-schedule-flow-deployment-switch
Reviewed-by: session_01KB5PFtxuy1x3dcR5gxudx6

VERDICT: PASS

Generated by Claude Code

os-warren · 2026-09-15T00:57:56Z

Provenance —— 达档条款②复核 PASS,双载体已清。⛔ 但本 PR 仍然不能落地,原因与该判词无关

domain:spec 执行席,session_01KB5PFtxuy1x3dcR5gxudx6,2026-09-15T00:5xZ。

项	值
复核记录	`5673030422`(逐字采纳,⛔ 未改写)
所判 head	`59af6612569d75d7e83370dc91b2c9f97e2a2378`
保险丝	转录 `"model":"claude-fable-5-1"` 250 次且无第二值;对照两个 `os-dev` 得 `claude-opus-5` ×39 / ×165
独立性对	`Implemented-by: claude/issue-17396-…` · `Reviewed-by: session_01KB5PFtxuy1x3dcR5gxudx6` ⇒ 非自审
双载体	已于 00:57Z 两侧清除并回读;`check-clause2-carriers --pair 18198` exit 0(「a review of record names this head」)

⚠️ 更正一条本席自己采信并散布过的错误读数

上一份 FAIL 记录 5671208079 —— 由本席逐字采纳 —— 在它的 ③.6 里写着:

the maintainer's confirmation is standing at PR comment 5665413504

这是假的。 本次复核点了出来,本席已独立核实:

GET /repos/objectstack-ai/objectstack/issues/comments/5665413504
  user.login : os-warren          ← 本席自己
  created_at : 2026-09-14T14:16:32Z
  首行       : "⛔ `Check Changeset` is RED BY DESIGN here,
                and it is the maintainer's decision to clear"

⇒ 5665413504 是本席向维护者提出的请求,⛔ 不是维护者的确认。PR reviews = 0,其后没有任何维护者评论。闸门要的那次确认至今不在案。

⚠️ 一份达档记录把「请求」读成了「确认」,而本席逐字采纳时没有核这一条。采纳是逐字的,核验不能是。这条更正记在这里,并同笔记进卡 #17396。

落地前检三条 —— ① 过,② 过,③ 不过

检	结果
① 席内达档条款②复核 PASS 在案	✅ `5673030422`
② 双载体已清,`--pair` 机读	✅ exit 0
③ PR 全部 check 全绿(⛔ 非 required 子集)	🔴 两红

⇒ ⛔ 不转 ready、⛔ 不入队、⛔ 不挂 auto-merge。 PASS 是契约判词,不是放行。

两红都在维护者地板上,且彼此独立:

check:type-source-resolution —— 复核实测签名:@objectstack/service-automation 与 @objectstack/trigger-schedule 各有 NEW dist-resolved type import(s) … @objectstack/types (via tsconfig.test.json)。base 提交 d4554d4f5a 的同一步 success ⇒ 是本 diff 引入的,⛔ 不是 base 红。闸门原文:「no self-serve remedy is left … Never widen that ledger and never widen a rootDir — both are maintainer-only」。复核已核实返工没有绕过(全 PR 新增行里 rootDir|"paths"|compilerOptions 零命中,未碰任何 scripts/**、tsconfig*、台账 json)。需要维护者按 A 把 KNOWN_DIST_RESOLVED_TYPE_IMPORTS 加上 @objectstack/types。
Check Changeset —— 按设计红,类别仍然吻合(闸门原文已在记录里逐字引用)。需要维护者确认那条待发布 note 可就地修正 —— 即上面那条至今不在案的确认。

⚠️ 两红各自截断了它们的 job。复核在本地把 CI 跳过的那些跑了:Check Changeset 的 steps 13-15 全 0;Lint 的 steps 158-176(19 个门禁)全 0,静默树中运行。⇒ 「两红,其余未测」这一半已经补上了。

一条无人认领的后续,已另立卡

G6 的 Studio 腿诚实地没有交付,而且现在任何会发布的句子都不再声称它交付了(复核逐个载体核过,树上零残留)。

但 objectui#9217(open,pm:blocked)正等着平台把 reason 送上线才能动 —— 而本仓没有任何卡指向那件事。⇒ 已立后续卡承接(FlowRuntimeState / _status 上一个由记录式拒绝填充的 reason,或一个审计路由),否则 #9217 无限期阻着。

Generated by Claude Code

os-warren · 2026-09-16T04:22:46Z

`Check Changeset` is red on the DELIBERATE CORRECTION limb, and this comment is the disclosure the gate asks for

Posted by the domain:spec execution seat, session_01KB5PFtxuy1x3dcR5gxudx6, 2026-09-16T04:2xZ. ⛔ The seat does not confirm a release decision for itself — this names the note and what changed under it, and asks the maintainer to confirm.

Which limb, measured — ⛔ not judged from the diff shape

The gate's refusal names two classes with opposite remedies. The readings say this is the second:

reading	value
merge base	`d4554d4f5ae`
`.changeset/schedule-trigger-acting-organization.md` on the merge base	present
…on `origin/main` today	present
added by	`ecdfc94118` — 「fix(triggers,spec,service-automation)!: a time-triggered flow declares its acting organization and the run executes as it (#17334)」, a different PR
this branch's edit to it	a deliberate prose rewrite, not an overwrite-by-filename-collision

⇒ DELIBERATE CORRECTION. ⛔ The COLLISION remedy (git checkout <merge-base> -- <file>) is the one thing not to do here: restoring it would republish sentences this PR makes false.

The note, and what changed under it

.changeset/schedule-trigger-acting-organization.md is #17334's pending, unreleased note for #16659. This PR narrows what it announces, so the branch rewrites it in three places:

Title — 「a time-triggered flow declares its acting organization」 → 「…declares its acting organization behind a tenancy wall … (A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659, narrowed by [Decision] 平台自带的四个定时示例流一个都声明不了组织 —— 而新规则要求它们必须声明 #17396)」.
A new ⚠️ banner in front of every statement, because two deployment facts now precede them and neither is metadata: package-authored scheduled work is gated by OS_AUTOMATION_SCHEDULED_WORK_ENABLED and is OFF by default in every tenancy posture and every kernel (while off, nothing below happens because nothing arms); and with it on, the declaration requirement applies under a walled posture (group / isolated) only — under single an armed time-triggered flow declares nothing and resolves the deployment's one organization exactly as before A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659.
The @objectstack/lint bullet — 「teaches validate-flow-trigger-readiness the requirement … severity warning」 → 「nothing, after [Decision] 平台自带的四个定时示例流一个都声明不了组织 —— 而新规则要求它们必须声明 #17396」, because flow-schedule-organization-missing is deleted in the same window and was never published. The stated reason is the rule family's own criterion — is this stack enough to know the flow is dead? — answered no: the deployment switch and the tenancy posture decide it and neither is in any stack.

The branch also amends the note's BREAKING paragraph to record that #17396 moves one sentence in the widening direction: under single with the switch on, a flow that #17334's changeset would have left unarmed now binds and runs.

⇒ Both changes land in the same launch window, so no released version ever saw the wider rule.

What is being asked

Confirm that correcting #17334's pending release note in place — rather than shipping it as written and correcting the CHANGELOG after release — is the right call. That is a release decision, which is why the gate stays red until a person says so rather than letting a diff shape route around it.

⛔ Nothing else about this PR waits on that answer: the other red (Lint & Repo Gates → check:type-source-resolution, @objectstack/service-automation via tsconfig.test.json and @objectstack/trigger-schedule, both on new dist-resolved @objectstack/types imports) is this PR's own and is being worked now.

Generated by Claude Code

claude added 6 commits September 14, 2026 12:36

wip(17396): deployment switch for package-authored scheduled work

0104279

Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KB5PFtxuy1x3dcR5gxudx6

wip(17396): spec entry 18, Q3 job gate, os doctor row

9d73075

Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KB5PFtxuy1x3dcR5gxudx6

wip(17396): retire flow-schedule-organization-missing, pin its absence

13a08fb

Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KB5PFtxuy1x3dcR5gxudx6

wip(17396): three-state bind gate pinned in trigger-schedule

5678b56

Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KB5PFtxuy1x3dcR5gxudx6

wip(17396): docs, examples, changesets, dogfood posture split

67dbef6

Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KB5PFtxuy1x3dcR5gxudx6

fix(17396): ADR-0087 disposition is already-registered, not registered

e26ac00

Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KB5PFtxuy1x3dcR5gxudx6

github-actions Bot added the size/xl label Sep 14, 2026

os-warren added the needs:contract-review label Sep 14, 2026 — with Claude

github-actions Bot added dependencies Pull requests that update a dependency file documentation Improvements or additions to documentation tests tooling labels Sep 14, 2026

fix(17396): alias @objectstack/types to source in both test packages

9e65cbe

Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KB5PFtxuy1x3dcR5gxudx6

claude added 4 commits September 14, 2026 14:23

fix(17396): option-B reader probe arms the scheduled-work switch

c80021e

Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KB5PFtxuy1x3dcR5gxudx6

Merge remote-tracking branch 'origin/main' into claude/issue-17396-sc…

e5605b0

…hedule-flow-deployment-switch

os-warren removed the needs:contract-review label Sep 14, 2026

os-warren mentioned this pull request Sep 14, 2026

AnalyticsDateRangeSchema's array arm admits shapes every consumer now refuses, and the one shared refusal sentence is false for them #17598

Closed

os-warren mentioned this pull request Sep 15, 2026

spec: three more Object.prototype fall-through lookups (normalizeFilterOperator, resolveDiscoveryEnvironment, pluralToSingular), found by an index-expression-keyed survey and measured #17818

Closed

os-warren added the needs:contract-review label Sep 15, 2026 — with Claude

os-warren removed the needs:contract-review label Sep 15, 2026

claude Bot mentioned this pull request Sep 15, 2026

fix(pm): bind H31's carrier pair through the closing keyword #18243

Merged

Navigation Menu

Uh oh!

feat(types,triggers,service-automation,runtime,cli,spec,lint)!: package-authored scheduled work is a deployment decision, off by default - #18198

feat(types,triggers,service-automation,runtime,cli,spec,lint)!: package-authored scheduled work is a deployment decision, off by default#18198
os-warren wants to merge 12 commits into
mainfrom
claude/issue-17396-schedule-flow-deployment-switch

os-warren commented Sep 14, 2026

Uh oh!

github-actions Bot commented Sep 14, 2026 •

edited

Loading

Uh oh!

os-warren commented Sep 14, 2026

Uh oh!

os-warren commented Sep 14, 2026

Uh oh!

os-warren commented Sep 15, 2026

Uh oh!

os-warren commented Sep 15, 2026

Uh oh!

os-warren commented Sep 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

os-warren commented Sep 14, 2026

What this is

Ruled item 6 — a DISTINCT reason, never "binding failed"

Retired pins, with their reasons (⛔ not deleted silently)

Q3 — packaged defineJob cron jobs are under the SAME switch

Narrowing I did not expect, flagged for review

Acceptance notes

Tests

Uh oh!

github-actions Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📓 Docs Drift Check

Uh oh!

os-warren commented Sep 14, 2026

⛔ Check Changeset is RED BY DESIGN here, and it is the maintainer's decision to clear — ⛔ not a defect and ⛔ not work remaining

Which class this is

The note, and what changed under it

Why it lands in the same window rather than as a follow-up

What is being asked of the maintainer — one confirmation

Status of the rest of this PR

Uh oh!

os-warren commented Sep 14, 2026

Contract review

① Derived judgments

② Semver level

③ Boundary flags

Uh oh!

os-warren commented Sep 15, 2026

Contract review

① Derived judgments

② Semver level

③ Boundary flags

Uh oh!

os-warren commented Sep 15, 2026

Provenance —— 达档条款②复核 PASS,双载体已清。⛔ 但本 PR 仍然不能落地,原因与该判词无关

⚠️ 更正一条本席自己采信并散布过的错误读数

落地前检三条 —— ① 过,② 过,③ 不过

一条无人认领的后续,已另立卡

Uh oh!

os-warren commented Sep 16, 2026

Check Changeset is red on the DELIBERATE CORRECTION limb, and this comment is the disclosure the gate asks for

Which limb, measured — ⛔ not judged from the diff shape

The note, and what changed under it

What is being asked

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Q3 — packaged `defineJob` cron jobs are under the SAME switch

github-actions Bot commented Sep 14, 2026 •

edited

Loading

⛔ `Check Changeset` is RED BY DESIGN here, and it is the maintainer's decision to clear — ⛔ not a defect and ⛔ not work remaining

`Check Changeset` is red on the DELIBERATE CORRECTION limb, and this comment is the disclosure the gate asks for