test(lint),docs(cli): the lint tier fixture declares the pair; os init / os g text says either missing token stops the config loading

The lint tier fixture's schedule flow owed only `triggers` before
`defineStack` refused `triggers` without `automation`; it now declares the
pair. The config comment `os init` writes, the flow header `os g flow`
writes, and their docblocks no longer say a stack without `automation`
loads the flow and never runs it: without either token the config is
refused. Text only; no emitted code changes.

Claude-Session: https://claude.ai/code/session_01Rjy9MeetSfq34PKn81CRiN
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/cli/src/commands/generate.ts

@@ -348,12 +348,13 @@ export default ${toCamelCase(name)}Action;
      *
      * It declares what it needs to run (#20215): {@link FLOW_SCAFFOLD_REQUIRES}.
      * `defineStack` refuses a record-change flow in a stack whose `requires`
-     * lacks `triggers`, and a stack that has `triggers` but not `automation`
-     * loads it and never runs it — measured on `os serve`: "1 flow(s) declared
-     * but the automation engine is not enabled — they will never run", each
-     * trigger plugin "NOT installed". So both tokens are declared here, `os
-     * init` declares the union, `os g flow` names any the stack is missing, and
-     * the emitted file says so in its own header.
+     * lacks `triggers` or `automation` (#20332): the trigger installs into the
+     * automation service, so a stack with `triggers` alone used to load the flow
+     * and never run it — measured on `os serve`: "1 flow(s) declared but the
+     * automation engine is not enabled — they will never run", each trigger
+     * plugin "NOT installed" — and is now refused instead. So both tokens are
+     * declared here, `os init` declares the union, `os g flow` names any the
+     * stack is missing, and the emitted file says so in its own header.
      */
     namesObject: true,
     itemName: (name: string) => `${toSnakeCase(name)}_flow`,
@@ -365,8 +366,8 @@ export default ${toCamelCase(name)}Action;
  *
  * Starts when a record changes, so the stack that carries it must declare
  * requires: [${FLOW_SCAFFOLD_REQUIRES.map((t) => `'${t}'`).join(', ')}]. The 'triggers' capability
- * fires the flow and 'automation' runs it: without 'triggers' the config does
- * not load, and without 'automation' the server loads the flow and never runs it.
+ * fires the flow and 'automation' runs it: without either one the config does
+ * not load.
  */
 const ${toCamelCase(name)}Flow: Automation.Flow = {
   name: '${toSnakeCase(name)}_flow',

packages/cli/src/commands/init.ts

@@ -605,9 +605,10 @@ export const SCAFFOLD_WIRED_BARRELS: readonly { type: string; dir: string; stack
 /**
  * The union of the capability tokens the scaffolds need to run — today the
  * `flow` scaffold's pair. Declared by every template that wires the `flows`
- * barrel: without `triggers` a record-change flow makes `defineStack` refuse
- * the config, so the first `os g flow` would break the project, and without
- * `automation` the server loads the flow and never runs it.
+ * barrel: without `triggers` or without `automation` a record-change flow
+ * makes `defineStack` refuse the config (#20332: the trigger installs into the
+ * automation service, so neither token alone installs it), and the first
+ * `os g flow` would break the project.
  */
 export const SCAFFOLD_WIRED_REQUIRES: readonly string[] = [
   ...new Set(GENERATOR_SCAFFOLD_TARGETS.flatMap((t) => t.requires)),
@@ -647,9 +648,8 @@ function renderWiredStackKeys(): string {
   return [
     `  // What the files \`objectstack generate\` writes need in order to run. A`,
     `  // flow that starts on a record change is fired by 'triggers' and run by`,
-    `  // 'automation': without 'triggers' this config stops loading once it holds`,
-    `  // such a flow, and without 'automation' the server loads the flow and never`,
-    `  // runs it. Both can go if this project will never hold a flow.`,
+    `  // 'automation': without either one this config stops loading once it`,
+    `  // holds such a flow. Both can go if this project will never hold a flow.`,
     `  requires: [${requires}],`,
     '',
     `  // Every directory \`objectstack generate\` writes into is wired here: its`,

packages/lint/src/authoring-rule-input-tier.test.ts

@@ -88,9 +88,10 @@ describe('the mechanism: for a defineStack config the `normalized` tier is POST-
   const flowStack = {
     manifest,
     // A `schedule` flow auto-launches, and `defineStack` refuses one whose stack
-    // does not declare the trigger capability (#14153) — the flow here is only
-    // the vehicle for a parse-time default, so declare the token it owes.
-    requires: ['triggers'],
+    // does not declare the pair that installs its trigger (#14153, #20332) —
+    // the flow here is only the vehicle for a parse-time default, so declare
+    // the tokens it owes.
+    requires: ['automation', 'triggers'],
     flows: [
       {
         name: 'tier_flow',