feat(spec)!: reserve the retired callout node types http_request, http_call and webhook; flow-node-http-callout-rename leaves the load path (F5-http of #23543)

[objectstack-fleet]

Part of #23543
Clause-②: yes (narrowing)

This PR lands family F5-http of ruling 6182001882 (item 6), the last family, as the code half. The ADR-0018 dated note is its own Tier H PR, claude/issue-23543-f5-http-adr-0018-note, branched from main. #23543 stays open for that note; the seat closes it once both have landed.

What

Ruling F5-http A: "http_request, http_call and webhook are reserved inside the open node namespace: the authoring doors refuse them with the rename to http; … the entry retires; … eventType: 'webhook' on a wait node is untouched."

• One table, three readers. FLOW_RESERVED_NODE_TYPES and reservedFlowNodeTypeRefusal (packages/spec/src/automation/flow-reserved-node-types.ts, exported from @objectstack/spec/automation) are read by the flow parse, the engine's registration refusal and the conversion itself.
• The parse refuses each name at the node's type, with the prescription naming http and @objectstack/spec 18. A top-level node meets a pattern per name on FlowNodeSchema.type, the DriverType (F1) shape, so the generated JSON Schema carries it too (json-schema/automation/FlowNode.json properties.type.allOf holds the three patterns). A node inside a loop / parallel / try_catch region meets one FlowSchema superRefine arm over collectFlowGraphs, which skips the top-level graph, so each site is reported exactly once. The open namespace is otherwise unchanged: http, a plugin type, a name that merely contains a reserved one (http_request_v2, my_webhook) and a wait node's waitEventConfig.eventType: 'webhook' all parse (pinned).
• The register side refuses too. AutomationEngine.registerNodeExecutor throws when the executor's type or its descriptor's type is reserved, and registers nothing; registerNodeAlias goes through it. Measured before the change: nothing stopped a plugin registering an executor under one of the names, and the engine is the one executor registry (every builtin and plugin-approvals register through it). No node could ever reach such an executor, because an authored node is refused at parse and a stored one is rewritten to http first, so the reservation is only true with this door closed (dispatch hypothesis 1, axis ③).
• The conversion flow-node-http-callout-rename is retiredFromLoadPath: true, retiredAfter: '17.7.0' (F1 to F4's stamp, still the newest stable under the 18.0.0-next.2 label). Its docblock's "stays on the load path" verdict is rewritten as a retirement record. Fixture unchanged.
• The conflict guard is removed (hypothesis 2). Its only purpose was a live third-party executor under a retired name; with registration refused, reservedNodeTypes can never contain one, so the guard had no case left. The rewrite is now unconditional. The generic ADR-0078 conflict channel (ConversionContext.reservedNodeTypes / reportConflict, onConflict, the save door's 409) is left in place; see Acceptance notes.
• Registration: the D3 entry flow-node-http-callout-types-reserved (no conversionIds: protocol 11 is below MIGRATION_SUPPORT_FLOOR; no relevantWhen, so always listed, the F5-jsx shape), the removal-version JOIN row (three refusals, one per name), the verdict-list pin (the kept list is now empty and the entry is listed among the retired), and a BREAKING minor changeset for @objectstack/spec and @objectstack/service-automation with FROM → TO, marked registered flow-node-http-callout-types-reserved. No RETIRED_KEYS_BY_MAJOR entry (a value retirement, no key) and no STEP18_RATIONALE fragment (no step-18 conversion), both the F5-jsx precedent. No os migrate meta sentence in the prescription: the removal-version pin's rule would demand --from 10, which the CLI refuses.

The D3 text, tested against the tool

On a temp project with one flow carrying all three names, at this branch's build:

• os validate, os build and os lint exit 1 / 2 / 1, each printing the three refusals at flows.0.nodes.1.type / .2.type / .3.type (the config calls defineStack).
• os migrate meta --from 17 exits 0, applies no edit, prints the three refusals under "Migrated stack does not yet pass schema validation — 3 refusals left after the chain", and lists the D3 entry. --write says "the chain made no mechanical change here, so no file was written" and the source is byte-identical afterwards (cmp).

The entry's reason says exactly that, plus the save door's 422 for a new flow (measured below). It spells the tool objectstack migrate meta without a --from value, so retired-key-migrate-sentence.test.ts (which judges every backticked os migrate meta --from N under packages/spec/src against the house sentence) has nothing to judge there.

Stored rows (hypothesis 5)

A stored flow with an old node type still loads as http, pinned at three seams: stored.test.ts (applyConversionsToStoredItem('flow', …) rewrites all three, unconditionally, a caller's reservedNodeTypes naming webhook included), flow-load-conversion.test.ts (engine rehydration, registerFlow), and nested-region-parity.test.ts (a webhook node in a loop body still runs as http, unchanged). metadata-core's artifact door still replays the retired rename inside its window (new case).

The suites that drove this entry as a live subject (hypothesis 4)

After this PR no real entry is live on the load path (measured: ALL_CONVERSIONS.filter(c => !c.retiredFromLoadPath) was exactly this one entry on main). Decided per suite; no suite deleted, no assertion weakened.

suite	what it drove	decision and reason
spec conversions.test.ts	rename cases, the guard, the live-window case, three normalizeStackInput sink cases	Rename cases run the data-at-rest posture (includeRetired), as the CRUD and F3 cases already do. The guard pair now pins the unconditional rewrite. The live-window case and the three sink cases need a live entry, so they moved, assertion for assertion, to the new apply-live-window.test.ts, which appends a test-only probe with vi.mock (F2's approach). In their place: a defineStack refusal pin and an authoring-funnel-vs-stored-door pin for the retired name.
spec region-walk.test.ts	the walker, through webhook	Every pass runs includeRetired: the walker's subject is regions, and the stored seams are where a region-nested old node still has to come out canonical.
spec stack.test.ts	defineStack's conversion-notice sink and warn-once	The block moved whole to stack-conversion-notices.test.ts with a vi.mock probe, so stack.test.ts does not mock the registry for its other 1,400 lines. Its two type errors moved with it (cast at the fixture, not ledgered); the test-typecheck-debt.json row for stack.test.ts shrank by those two.
spec stack-conversions-record.test.ts	the ordering case's second conversion	A second vi.mock probe beside the page probe F4 added.
metadata-core artifact-forward-conversion.test.ts	FIRING CONTROL 1	The probe is appended for that one case to ALL_CONVERSIONS from @objectstack/spec, the instance the door reads, and removed in finally; a premise line asserts no real entry is live. The door itself is the real one. Plus a new case: the retired rename still fires at this door.
cli stack-conversion-record-door.test.ts, validate-json-strict-exit.e2e.test.ts, build-json-failure-conversions.e2e.test.ts, validate-json-failure-conversions.e2e.test.ts, lint-conversion-notices.e2e.test.ts	the door's conversion record, --strict, failure exits	A spawned CLI is out of vi.mock's reach, so the child loads a test-only preload with --import (test/fixtures/live-conversion-probe.mjs, the unbuilt-spec-dist.hook.mjs precedent). It appends the same kind of probe to ALL_CONVERSIONS in both builds of @objectstack/spec the child can load (measured: the ESM and CJS tables are two arrays, and a defineStack config can load through either). Every real entry stays as published. The record door also gains one case without the probe: os validate --json refuses http_request by name and records no conversion.
spec scripts/build-schemas-check-mode.test.ts	the entry's surface flow.node.type as a leaf collider	No change: retirement does not change the entry's surface or remove it. 88 / 88 green.

The seat's call on F4's open question 2 refused "a test-only entry into the published registry". None is added: every probe lives in a test file or a test fixture outside every package's files[].

The metadata save door (hypothesis 6)

Not touched by this PR (protocol.ts is outside this family). PR #23902 (cf071687f1, ruling 6212082860 letter B) landed on main and is merged into this branch: the save door no longer replays retired conversions on a NEW flow. Measured at f459d50c at the real PUT /api/v1/meta/flow/:name door (the real-stack harness of packages/rest/src/meta-flow-save-retired-spelling.test.ts, run as a throwaway file and deleted), saving a new flow whose one node is typed with each name:

name	with an automation service (a real AutomationEngine)	without one
http_request	422 INVALID_METADATA at nodes.1.type, this family's prescription; nothing stored	the same
http_call	the same	the same
webhook	the same	the same
http (control)	200, stored as http	200, stored as http

The changeset and the D3 entry name the save door among the refusing doors. A stored row that already carries an old name keeps the full chain (ruling 6212082860, pinned by PR #23902).

Readers and examples (hypothesis 7)

No example, skill, hand-written doc or published fixture in this repository authors one of the three names as a node type (git grep over content/, skills/, examples/, apps/). The one test fixture that listed one as a registry entry, runtime's http-dispatcher.test.ts GET /actions mock, now lists http. Two docblocks this change made false were corrected: stored.ts (why flows are not converted by the metadata-protocol seams) and engine.ts (registerNodeAlias and the rehydration comment). eventType: 'webhook' is untouched everywhere.

objectui (hypothesis 8)

carrier: the seat's objectui card at landing. Read sites of the three names at objectui main f78efdd1e3, identical in file set at the pin daeb77fc84: preview samples apps/console/src/preview-samples.ts:237,244 (two http_request nodes); inspector alias packages/app-shell/src/views/metadata-admin/inspectors/flow-node-config.ts:1307 (http: 'http_request') and its http_request config group :771; canvas cases previews/flow-canvas-parts.tsx:88-89,261,265,326,330,424; simulator previews/FlowSimulatorPanel.tsx:57 and previews/simulator/flow-simulator.ts:86; plus components/src/renderers/basic/metadata-viewer.tsx:271 and the i18n key engine.flowNode.http_request.label. FlowNodeSchema.type's TypeScript type is still string, so the pinned console build does not break on this change.

Tests

Final head f459d50c (two merges of origin/main, both through os-regen-merge.sh, no conflict; the second brought PR #23902): spec build + check:generated "All 14 generated artifacts are up to date"; @objectstack/spec test (local project) 688 files / 20914 passed (1 todo); @objectstack/spec test:repo (the whole repo project) 64 files / 1082 passed; service-automation typecheck 0 and flow-load-conversion + nested-region-parity + canonicalize-stored-flow 72 / 72; metadata-protocol protocol.save-flow-canonicalization 34 / 34; rest meta-flow-save-retired-spelling 6 / 6; cli typecheck 0 and the five conversion suites 64 / 64 (four e2e under OS_TEST_TIERS=nightly 42, the record door 22); ESLint (--no-inline-config) over every .ts / .mjs file of the diff exits 0. Earlier on bf004d7a: metadata-core typecheck 0 and test 18 / 737; runtime typecheck 0 and http-dispatcher.test.ts 248; cli unit tier 302 files / 4500; service-automation test 186 files / 2507.

Gates on f459d50c: dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 118, each run with its exit captured before any pipe; --ran: "118 derived famil(ies) accounted for — 115 run, 3 NOT-MEASURED (3 DERIVED from a recorded exit 3)". All 115 exited 0, among them check-adr-0087-registration --base origin/main, check-changeset-no-major, check:spec-changes, check:upgrade-guide, check:docs, check:api-surface, check:authorable-surface, check:cross-package-test-inputs, check:doc-authoring and the three check:i18n* gates. The three NOT-MEASURED are prerequisite refusals declared to CI: check-plugin-teardown-shape --self-test (shallow clone), check:skill-examples (client-react unbuilt) and check:dual-build-cjs-loads (a full build absent). Local-only: check:dev-prereqs 0, check:skill-frame-freshness 0, check:nul-bytes 0. PR check-runs on f459d50c: 41, all completed, 36 success and 5 skipped, no failure.

Ablation (scripts/ablation-replace.mjs, restored to the HEAD blob each time, git diff HEAD empty):

1. The entry's load-path role restored (retiredFromLoadPath / retiredAfter deleted). Red, 6: the verdict-list pin; the defineStack refusal pin; the authoring-funnel-vs-stored-door pin; and three removal-version pins (the JOIN row, "every joined entry is a retired conversion", "the joined rows exercise the derivation in both directions"). Spec tests import src, so no dist leg.
2. The engine's registration refusal removed. Red, 5: the three per-name refusals, the descriptor case and the alias case.
3. The cli preload dropped from NODE_OPTIONS. Red, 2: lint-conversion-notices's two "the fixture REALLY converts" anti-vacuity cases.
4. The D3 reason given back its first-round marker (os migrate meta --from 17 in backticks). Red, 2: retired-key-migrate-sentence.test.ts ("every prescription sentence in every corpus is house-form or MIXED two-clause" and its anti-vacuity floor), the repo-project test behind the first round's Test Core (1/6) red.

Acceptance notes

• The ADR-0078 conflict channel has no producer left. ConversionContext.reservedNodeTypes / reportConflict, ApplyConversionsOptions.onConflict, the engine's conflicts array and the save door's FLOW_CONVERSION_CONFLICT 409 stay as a generic mechanism, with zero entries using it. The seat retires it as its own card at landing (it touches protocol.ts and engine.ts), not in this PR.
• One parse reports every site. Measured: a flow with http_request on a top-level node and webhook inside a loop body answers both issues in one parse, at nodes.1.type and nodes.2.config.body.nodes.0.type.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/service-automation, @objectstack/spec, touching 14 documentable anchor(s). ⚠️ 5 changed file(s) yielded no anchor (packages/spec/api-surface/automation.json, packages/spec/export-origins/automation.json, packages/spec/src/automation/index.ts, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx (via FlowSchema (symbol, a top-level const))
• content/docs/automation/index.mdx (via registerNodeExecutor (symbol, a method of class AutomationEngine))

⛔ 6 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v16.mdx (via AutomationEngine (symbol, a top-level class))
• content/docs/releases/v17/17-0.mdx (via AutomationEngine (symbol, a top-level class), FlowSchema (symbol, a top-level const))
• content/docs/releases/v17/17-4.mdx (via FlowSchema (symbol, a top-level const))
• content/docs/releases/v17/17-5.mdx (via retiredAfter (symbol, a field of const object flowNodeHttpRename), retiredFromLoadPath (symbol, a field of const object flowNodeHttpRename))
• content/docs/releases/v17/17-6.mdx (via AutomationEngine (symbol, a top-level class))
• content/docs/releases/v17/17-7.mdx (via FlowSchema (symbol, a top-level const))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 5 changed file(s) yielded no anchor (packages/spec/api-surface/automation.json, packages/spec/export-origins/automation.json, packages/spec/src/automation/index.ts, …) — pages documenting those are invisible to this run
• 5 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 142 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 6d1660dc3b163c30c3a02d34de5cfc219940d958 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 1faf7c8c827dbca0098ca0b8c2f45f450e648acf — the merge of head f459d50c5b3869cc77fa6bdedced8ad732344eb6 into base 6d1660dc3b163c30c3a02d34de5cfc219940d958, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 1faf7c8c827dbca0098ca0b8c2f45f450e648acf && git checkout 1faf7c8c827dbca0098ca0b8c2f45f450e648acf
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 6d1660dc3b163c30c3a02d34de5cfc219940d958 f459d50c5b3869cc77fa6bdedced8ad732344eb6 && git checkout -B drift-repro 6d1660dc3b163c30c3a02d34de5cfc219940d958 && git merge --no-ff f459d50c5b3869cc77fa6bdedced8ad732344eb6

node scripts/docs-audit/affected-docs.mjs --json 6d1660dc3b163c30c3a02d34de5cfc219940d958

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 6d1660dc3b163c30c3a02d34de5cfc219940d958 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: d55439273fabec83437df2cdcb639bf1a0625c9f
Local-runs: none
Scope: packages/spec/src/automation/flow-reserved-node-types.ts, packages/spec/src/automation/flow.zod.ts, packages/spec/src/automation/index.ts, packages/spec/src/conversions/registry.ts, packages/spec/src/conversions/stored.ts, packages/spec/src/migrations/entries/semantic/18.flow-node-http-callout-types-reserved.ts + packages/services/service-automation/src/engine.ts, packages/spec/src/automation/control-flow.zod.ts, packages/spec/src/conversions/apply.ts, packages/spec/src/conversions/types.ts, .changeset/23543-f5-http-callout-node-types-reserved.md, packages/spec/api-surface/automation.json, packages/spec/export-origins/automation.json, packages/cli/test/fixtures/live-conversion-probe.mjs, packages/cli/test/helpers/live-conversion-probe.ts, packages/spec/src/conversions/apply-live-window.test.ts, packages/spec/src/stack-conversion-notices.test.ts, packages/spec/src/stack-conversions-record.test.ts, packages/spec/src/automation/flow-reserved-node-types.test.ts, packages/spec/src/conversions/conversions.test.ts, packages/spec/src/conversions/stored.test.ts, packages/spec/src/conversions/region-walk.test.ts, packages/spec/src/shared/retired-key-removal-version.pin.test.ts, packages/spec/src/shared/retired-key-migrate-sentence.test.ts, packages/spec/vitest.repo-tests.json, packages/services/service-automation/src/flow-load-conversion.test.ts, packages/metadata-core/src/artifact-forward-conversion.test.ts, packages/runtime/src/http-dispatcher.test.ts, packages/cli/test/stack-conversion-record-door.test.ts, packages/cli/package.json

Inputs: card #23543 (body and all 36 comments, among them ruling 6182001882 items 6 and 7, claim 6214417833 and dev report 6217001433), rulings 6212082860 (#23775) and 6216220018 (#23903) with PR #23902's body, this PR's body, file list and net diff against its merge-base b9dbc3d8 with origin/main, and the check-runs on this head. Read-only: git show / git grep / git diff at the sha and unauthenticated REST GETs; nothing built, run or re-run.

Gates on this head (the check-runs' conclusions are the verdicts). 41 check-runs, all completed. Two of the five required contexts are red. Lint & Repo Gates is red through its lane Lint · ESLint: packages/cli/test/fixtures/live-conversion-probe.mjs:33, the namespace import of the @objectstack/spec root, which the repo's import rule restricts (the domain namespaces are restricted names and a namespace import carries them all; a named import of ALL_CONVERSIONS or a subpath satisfies it). Test Core is red through Test Core (1/6): packages/spec pnpm run test:repo exited 1. The other five shards, TypeScript Type Check (every generated-artifact gate inside it), Build Core, Governed Surface Queue Guard, Check Changeset, Spec property liveness and the PM gates are green. The job logs sit behind an Actions results host this container cannot reach, so the red shard's subject is named from the diff in ① item 10.

① Derived judgments

1. One table, three readers — right. FLOW_RESERVED_NODE_TYPES (frozen, flow-reserved-node-types.ts) is what FlowNodeSchema.type refuses with (one pattern per name, the shape F1's DriverType used, so the published JSON Schema carries the refusal), what the FlowSchema superRefine arm reads (reservedFlowNodeTypeRefusal over collectFlowGraphs, the top-level graph skipped), what AutomationEngine.registerNodeExecutor reads (imported from @objectstack/spec/automation), and what the conversion's apply reads. They cannot drift.
2. The flow parse, top level — right: three .regex() checks on type refuse by whole name in exact case (HTTP_REQUEST, http_request_v2, my_webhook parse, pinned), which is exactly what the conversion matched; F1's pattern folds case and whitespace for the driver resolver's sake, this namespace has no resolver to match.
3. The flow parse, region bodies — right, and once per site: parseFlowNodeRegions leaves a region its schema refused raw and adds no issue, so the superRefine walk is the one reporter, at the region path plus nodes, index, type; validateControlFlow's region throw lives at registerFlow, where a stored flow has already been rewritten, so it never meets a reserved name.
4. The engine's executor registration — right: registerNodeExecutor is the only nodeExecutors.set site in engine.ts; it judges executor.type and executor.descriptor?.type, registers nothing on a refusal, and registerNodeAlias is a call through it (pinned). No in-tree builtin registers or aliases one of the three names, so no boot throws on this change.
5. The stored-row and migrate paths — right: applyConversionsToStoredItem forces includeRetired: true (stored.ts:108), the engine's rehydration keeps the full chain, the artifact door replays inside its window (the metadata-core pin), and os migrate meta --from 17 lists the D3 entry and prints the three refusals without an edit, protocol 11 being below the floor — measured against the tool by the dev.
6. The prescription — right in shape: "Flow node type: 'X' was removed in @objectstack/spec 18 (ADR-0087 D2) — … Use type: 'http'. Change the value; …" is the form the F1 to F4 refusals use; it carries no os migrate meta sentence (below the floor, the F5-jsx and F4 precedent); only the webhook one notes that the wait eventType of the same name stays legal.
7. Removing the ADR-0078 conflict guard — safe: with registration refused, reservedNodeTypes can never hold a reserved name, so the guard had no case left; the rewrite is unconditional and pinned at the stored seam (stored.test.ts) and at the engine (flow-load-conversion.test.ts). Nothing produces into the channel any more: no entry in registry.ts calls reportConflict. What remains is plumbing with zero producers — ConversionContext.reservedNodeTypes / reportConflict (apply.ts, types.ts), ApplyConversionsOptions.onConflict, the engine's reservedNodeTypes set and conflicts array, the save door's FLOW_CONVERSION_CONFLICT 409 and its error-code ledger row. The accepted cost (the presentation's axis ③, ruling item 6): a pre-18 third-party executor under webhook now fails at its own registration call, loudly, and its stored nodes are rewritten to http with a notice.
8. Public surface — right: two exports added on @objectstack/spec/automation (FLOW_RESERVED_NODE_TYPES, reservedFlowNodeTypeRefusal), the api-surface and export-origins rows regenerated; a widening beside the narrowing, as F1's RETIRED_DRIVER_ID_GUIDANCE was. The three reference mdx pages are gen:docs output of the .describe() change. waitEventConfig.eventType: 'webhook' is untouched (pinned).
9. The registration — right: retiredFromLoadPath: true, retiredAfter: '17.7.0'; the verdict-list pin's kept list is empty and the entry sits among the retired; the removal-version JOIN gains the three refusal rows; the D3 entry carries no conversionIds and no relevantWhen (the F5-jsx shape); the changeset carries the adr-0087 registered marker naming it; Check Changeset and the ADR-0087 registration gate are green.
10. The D3 entry's text — wrong at one sentence, and by reading that sentence is the red shard. src/shared/retired-key-migrate-sentence.test.ts is a repo-project test (vitest.repo-tests.json): it walks every non-test .ts under packages/spec/src except migrations/registry.ts, reconstructs concatenated string literals, and judges every site that matches its marker — a backticked os migrate meta --from N, with or without Run — against the house sentence, with no allowlist. The entry's reason (line 29) spells the marker inside "applies no edit for it and prints each such node among the refusals left after the chain", which is neither the house sentence nor the MIXED two-clause form; the five sibling D3 entries of this release carry the marker zero times (F2 spells the tool objectstack migrate meta). The dev's "688 files / 20914 passed" is the local project, which excludes the repo list, and the repo project was run for build-schemas-check-mode.test.ts alone, pre-merge. The conclusion failure is the verdict whichever file it was.
11. The test-only live probe — judged against the seat's refusal of "a test-only entry into the published registry" (F4, 6211524841): it is not one. No entry is added to the registry source; the probe is appended to ALL_CONVERSIONS at runtime inside test processes only (vi.mock in-process, a node --import preload for the spawned CLI, a push and finally splice in metadata-core), and every probe file is a test or a test fixture outside files[] (@objectstack/cli publishes dist, README.md, CHANGELOG.md). Two notes for the seat: the preload file is the ESLint red above; and metadata-core's FIRING CONTROL 1 now pins the premise "no real entry is live", so it goes red the day any live conversion lands again — a maintenance hazard, not a defect here.
12. Neighbours: this PR's region of engine.ts (registerNodeExecutor, near line 3501) is disjoint from the region PR feat(metadata-protocol)!: the flow save door refuses a retired spelling on a NEW flow; a stored flow keeps the full chain #23902 changed (canonicalizeStoredFlow, near line 4578), and origin/main has moved fifteen commits past this head's merge-base, PR feat(metadata-protocol)!: the flow save door refuses a retired spelling on a NEW flow; a stored flow keeps the full chain #23902 among them; ③ item 3 names the re-runs the next merge owes.

② Semver level

• Clause-②: yes (narrowing) on the body's second line and in the changeset, as ruling item 7 spells it. The changeset bumps @objectstack/spec and @objectstack/service-automation at minor under feat(spec)!, with the FROM → TO table, the one-line fix and the adr-0087 registered marker: that is what the diff publishes (the spec's accept set narrows at a flow node's type, the engine's registration accept set narrows), and a BREAKING minor under the 18.0.0-next label is the spelling F1 to F4 used. No other published package changes: cli, runtime and metadata-core carry tests and test fixtures only. Check Changeset is green.
• Wrong, and a FAIL item: the paragraph "Not refused yet: a flow saved through the metadata API" states a door behaviour origin/main no longer has and a decision that is already ruled. PR feat(metadata-protocol)!: the flow save door refuses a retired spelling on a NEW flow; a stored flow keeps the full chain #23902 (Fixes #23775, executing ruling 6212082860 letter B) merged as cf071687f1 at 2026-10-16T13:12Z, after this PR's merge-base b9dbc3d8, and is not in this head. On main plus this diff, a NEW flow saved with http_request, http_call or webhook is canonicalized with includeRetired: false, the retired rename is not replayed, and the flow parse refuses it with this family's prescription (422 INVALID_METADATA, located at the node's type), on an engine host and on a host with no automation service alike; a stored row re-saved keeps the full chain. Ruling 6212082860 item 6 says in terms that each later family's changeset no longer needs the "the API door canonicalizes" sentence. The paragraph ships in CHANGELOG.md, where an upgrading agent greps it. The patch: delete it, delete the PR body's "Known gap" table (measured on a tree without PR feat(metadata-protocol)!: the flow save door refuses a retired spelling on a NEW flow; a stored flow keeps the full chain #23902), merge origin/main through scripts/pm/os-regen-merge.sh, and re-measure the four rows against the real door.

③ Boundary flags

1. Open question 1 (the save door) — not escalated: the standing rulings answer it. 6212082860 ([Decision] The metadata save door lifts a retired flow spelling on a NEW flow and stores it, where every other authoring door refuses it — refuse on a new flow, or keep the door a rehydration seam? #23775, letter B) binds that a new flow with a retired spelling meets the parse refusal and its prescription at the save door while a stored row keeps the full chain, and PR feat(metadata-protocol)!: the flow save door refuses a retired spelling on a NEW flow; a stored flow keeps the full chain #23902 executes it on main; 6216220018 ([Decision] The metadata save door silently rewrites a retired flow spelling (ADR-0087, 2026-08-02) while #23543's ruling says every authoring door refuses it: keep healing, refuse only new legacy, or heal on read and refuse at save? #23903, B′ yes, C no) adds that a retired spelling a re-save newly introduces is refused too (a follow-up on [Decision] The metadata save door silently rewrites a retired flow spelling (ADR-0087, 2026-08-02) while #23543's ruling says every authoring door refuses it: keep healing, refuse only new legacy, or heal on read and refuse at save? #23903, blocked on [Decision] The metadata save door lifts a retired flow spelling on a NEW flow and stores it, where every other authoring door refuses it — refuse on a new flow, or keep the door a rehydration seam? #23775's close) and that flows are not canonicalized on read. The dev's option A is letter B as ruled. What this PR owes is the deletion in ② and a re-measured table; nothing in protocol.ts (ruling item 5: the three share no file).
2. Open question 2 (retiring the producer-less ADR-0078 channel) — escalated to the seat as its own card, not this family's: zero producers after this diff (① item 7), a published surface (ApplyConversionsOptions.onConflict, ConversionConflictNotice, the 409 and its ledger row), and a retirement that touches protocol.ts and engine.ts.
3. Deviations, each accepted: the file surface widened to engine.ts and its suite, the stored.ts docblock and suite, region-walk.test.ts, the moved blocks with their probes, the typecheck-debt shrink, the runtime fixture, the cli helper and preload — each measured and named in the body. No closing keyword — per claim 6214417833, which is newer than the "the last family's PR is Fixes" lines of 6189368882 and 6205630082. No RETIRED_KEYS_BY_MAJOR row, no STEP18_RATIONALE fragment, no os migrate meta sentence in the prescription — the F5-jsx and F4 precedent. The save-door reading in a throwaway harness — accepted as a reading, now stale (②). Readings for service-automation, metadata-core, runtime, metadata-protocol and cli taken pre-merge — accepted on the dev's word that the merge touched none of those files, but main has since moved past the merge-base with engine.ts on both sides, so the patch round's merge of main re-runs flow-load-conversion.test.ts, nested-region-parity.test.ts, canonicalize-stored-flow.test.ts and protocol.save-flow-canonicalization.test.ts.
4. The two reds, gate verdicts both: the import in live-conversion-probe.mjs; the marker sentence in the D3 entry's reason (reword it so no backticked os migrate meta --from N remains — the siblings' spelling, or drop the clause; the changeset's copy of the sentence is markdown, outside the scanner, and should be kept consistent). The patch round runs the whole spec repo project, not one file of it, and the record at the patched head is a new review.
5. Downstream, not this PR's: objectui's read sites of the three names, filed by the seat at landing as the claim says; skills/** untouched; the ADR-0018 note is PR docs(adr-0018): dated note — http_request, http_call and webhook are reserved retired node names (F5-http of #23543) #23955, reviewed on its own head.

Implemented-by: claude/issue-23543-f5-http-reserved-node-names
Reviewed-by: session_01HjR8RUwTPQ3TgbfKihmxp9

VERDICT: FAIL

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: f459d50c5b3869cc77fa6bdedced8ad732344eb6
Local-runs: none
Scope: packages/spec/src/automation/flow-reserved-node-types.ts, packages/spec/src/automation/flow.zod.ts, packages/spec/src/automation/index.ts, packages/spec/src/conversions/registry.ts, packages/spec/src/conversions/stored.ts, packages/spec/src/migrations/entries/semantic/18.flow-node-http-callout-types-reserved.ts + .changeset/23543-f5-http-callout-node-types-reserved.md, packages/cli/test/fixtures/live-conversion-probe.mjs, packages/metadata-protocol/src/protocol.ts, packages/services/service-automation/src/engine.ts, packages/spec/src/shared/retired-key-migrate-sentence.test.ts, packages/spec/src/automation/control-flow.zod.ts, packages/spec/src/conversions/apply.ts, packages/spec/src/conversions/types.ts, packages/spec/api-surface/automation.json, packages/spec/export-origins/automation.json, packages/cli/test/helpers/live-conversion-probe.ts, packages/spec/src/conversions/apply-live-window.test.ts, packages/spec/src/stack-conversion-notices.test.ts, packages/spec/src/stack-conversions-record.test.ts, packages/spec/src/automation/flow-reserved-node-types.test.ts, packages/spec/src/conversions/conversions.test.ts, packages/spec/src/conversions/stored.test.ts, packages/spec/src/conversions/region-walk.test.ts, packages/spec/src/shared/retired-key-removal-version.pin.test.ts, packages/spec/vitest.repo-tests.json, packages/services/service-automation/src/flow-load-conversion.test.ts, packages/metadata-core/src/artifact-forward-conversion.test.ts, packages/runtime/src/http-dispatcher.test.ts, packages/cli/test/stack-conversion-record-door.test.ts, packages/cli/package.json

Round 2, on the patched head, after the FAIL record 6217909163 on d55439273f. Inputs this round: the dev's patch report 6219476536 (#23543), the seat's patch record 6217952268 for its item list only, the PR body as the seat replaced it, the net diff of this head against its merge-base 6d1660dc with origin/main, the patch commit f459d50c and the merge commit f16ce01f on their own, and the check-runs on this head; the round-1 inputs stand (card, rulings 6212082860 and 6216220018, PR #23902's body). Read-only: git show / git diff / git log at the shas and unauthenticated REST GETs; nothing built, run or re-run.

Gates on this head (the check-runs' conclusions are the verdicts). 48 check-runs, all completed, none red. The five required contexts are green: Lint & Repo Gates (its lane Lint · ESLint green, the round-1 red), TypeScript Type Check (every generated-artifact gate inside it), Test Core (all six shards, Test Core (1/6) green, the round-1 red), Build Core, Governed Surface Queue Guard. Check Changeset ran twice, once on the push and once after the seat's body edit, green both times; the PM gates, Spec property liveness and Check Documentation Links are green; the dogfood, conformance, console-pin and tarball jobs are skipped as the PR fast set skips them. Nothing is in progress.

① Derived judgments

1. What moved since d55439273f: exactly two commits. The merge f16ce01f of origin/main (through os-regen-merge.sh; it carries PR feat(metadata-protocol)!: the flow save door refuses a retired spelling on a NEW flow; a stored flow keeps the full chain #23902 cf071687f1, which is now an ancestor of this head) and the patch commit f459d50c, three files, +8/-10: the probe preload's import, the D3 entry's reason, the changeset's "what an author sees" sentence, its objectstack migrate meta spelling and the deleted "Not refused yet" paragraph. The PR body was replaced by the seat with the report's text (the Clause-②: yes (narrowing) line stays on line 2; the "Known gap" table is replaced by the measured 422 table). Nothing else.
2. The merge brought nothing into the PR's own diff — right. The round-1 net diff (b9dbc3d8..d5543927) and this round's (6d1660dc..f459d50c), with index lines and hunk headers stripped, differ in the patch commit's hunks alone; the 33-file list is unchanged. The merge touched 136 files on main's side, of which only engine.ts is in the PR's file list, and its net hunks (registerNodeExecutor, registerNodeAlias's docblock, the rehydration comment) are byte-identical between the two heads; PR feat(metadata-protocol)!: the flow save door refuses a retired spelling on a NEW flow; a stored flow keeps the full chain #23902's canonicalizeStoredFlow option arrived from main, in its own region, and is not part of this diff. origin/main has since moved seven commits past the merge-base, none touching a file of this PR.
3. FAIL item 1, the ESLint red — fixed on the code and green: live-conversion-probe.mjs:33 now reads a named import, ALL_CONVERSIONS as ESM_CONVERSIONS, from the @objectstack/spec root, which the restriction (the domain-namespace names) does not reach; an ESM named import is a live binding to the same export, so the probe still appends to the very array the CLI's ESM build reads, beside the CJS table, and nothing else in the file changed. Lint · ESLint and Lint & Repo Gates are green.
4. FAIL item 2, the red repo shard — fixed on the code and green: the D3 reason (line 29) now spells "objectstack migrate meta applies no edit for it", with no --from N, so retired-key-migrate-sentence.test.ts's marker (a backticked os migrate meta --from N) matches nothing in the entry; the docblock's os migrate meta on line 9 is a comment line the scanner drops and carries no --from either; no non-test .ts hunk of the diff adds the marker. The changeset's copy matches (objectstack migrate meta, the F2 D3 spelling). Test Core (1/6) and Test Core are green; the dev reports the whole repo project 64 files / 1082 and an ablation that puts the marker back and reds the two cases the round-1 record named — read, not re-run.
5. FAIL item 3, the save-door text — fixed: the "Not refused yet" paragraph is deleted from the changeset and the "Known gap" table from the body. What replaced it is deviation 1, judged in ② and ③ item 1.
6. The three doors, re-read on this head: unchanged and right. The flow parse (three patterns on FlowNodeSchema.type; the FlowSchema superRefine arm for region bodies, once per site, since parseFlowNodeRegions leaves a refused region raw without an issue), the engine's single registry write (registerNodeExecutor, descriptor type included, registerNodeAlias through it), the stored seams forcing includeRetired: true, the migrate path listing the D3 entry without an edit, the unconditional rewrite with the ADR-0078 guard gone and zero producers left in the channel, the two new exports with their regenerated rows, retiredAfter: '17.7.0', the empty kept list, the three JOIN rows, the prescription in the siblings' shape — every hunk byte-identical to the head the round-1 record judged, and the round-1 judgments carry.
7. The save door on this head, read in protocol.ts (PR feat(metadata-protocol)!: the flow save door refuses a retired spelling on a NEW flow; a stored flow keeps the full chain #23902's code, merged from main, not this PR's): flowSaveReplaysRetired answers false for a flow with no stored row at the save's address (for a draft save, no active row beneath it either) and no server-stated write face; the flow branch then calls the engine's canonicalizeStoredFlow(name, body, { includeRetired: false }), whose chain omits this now-retired rename, so the body still carries the reserved name and the engine's strict parse throws this family's refusal; the branch catches that throw, falls back to applyConversionsToFlow(body, { includeRetired: false, excludeConversionIds }), which leaves the name in place, and the schema gate refuses the body with 422 INVALID_METADATA and the located Zod issue at the node's type, its message the parse's prescription; on a host with no automation service the fallback is reached directly and the same gate answers. Nothing is persisted on either path. That is what the changeset and the D3 reason now say, and what the dev measured at the real PUT /api/v1/meta/flow/:name door for the three names on both hosts, with http as the 200 control.

② Semver level

• Unchanged from round 1 and right: Clause-②: yes (narrowing) on the body's second line and in the changeset, as ruling item 7 spells it; @objectstack/spec and @objectstack/service-automation at minor under feat(spec)!, with the FROM → TO table, the one-line fix and the adr-0087 registered marker naming flow-node-http-callout-types-reserved; no other published package changes (cli, runtime, metadata-core carry tests and test fixtures only). Check Changeset is green on both of its runs.
• Deviation 1, the new sentence: "the metadata save door answers a NEW flow with 422 INVALID_METADATA at the node's type, with or without an automation service, and stores nothing" (changeset), and "the metadata save door (a 422 for a new flow)" among the refusing doors (D3 reason) — true on this head (① item 7) and consistent with the rulings: 6212082860 ([Decision] The metadata save door lifts a retired flow spelling on a NEW flow and stores it, where every other authoring door refuses it — refuse on a new flow, or keep the door a rehydration seam? #23775, letter B) binds exactly a new flow's 422 at the save door with a stored row keeping the full chain, which PR feat(metadata-protocol)!: the flow save door refuses a retired spelling on a NEW flow; a stored flow keeps the full chain #23902 executes and this branch now carries; 6216220018 ([Decision] The metadata save door silently rewrites a retired flow spelling (ADR-0087, 2026-08-02) while #23543's ruling says every authoring door refuses it: keep healing, refuse only new legacy, or heal on read and refuse at save? #23903, B′ yes, C no) adds the re-save that newly introduces a retired spelling as a later follow-up and keeps flows uncanonicalized on read — the changeset claims neither, and its "Stored metadata needs no edit … keeps loading as http" paragraph is the B and C-no posture. Ruling 6212082860 item 6 lifts the old "the API door canonicalizes" sentence; it does not forbid stating the ruled refusal, and the sentence is scoped to a NEW flow, which is the ruled predicate. The round-1 text was wrong; this text is right. Judged a correct one-step-beyond, not a deviation to undo: the CHANGELOG.md reader meets the door that refuses them, named.

③ Boundary flags

1. Deviation 1 — accepted, as ② says. If the seat prefers the deletion-only shape, the two clauses come out without a behaviour change, but nothing in the rulings asks for that.
2. Deviation 2 (a first cli typecheck red on an unbuilt closure, re-run green) and deviation 3 (metadata-core, runtime, cli unit tier and the full service-automation suite carried from bf004d7a, no file of theirs changed by the round or by main) — accepted; the merge-side check is item 2 of ①, and the suites the round-1 record asked to re-run after the merge (flow-load-conversion, nested-region-parity, canonicalize-stored-flow, protocol.save-flow-canonicalization) are reported re-run on this head, with rest's meta-flow-save-retired-spelling beside them; CI's Test Core on this head is the verdict.
3. Open questions: none this round. Round 1's two stand answered: the save door by the rulings (and now by the code on this branch); the producer-less ADR-0078 channel as the seat's own card at landing (its item 2, A), which this PR leaves in place — the 409 branch in protocol.ts and the engine's conflicts array remain dead plumbing.
4. The test-only live probe — unchanged judgment: a runtime append inside test processes only, every file outside files[], not the published entry the seat refused. The metadata-core FIRING CONTROL 1 premise ("no real entry is live") still goes red the day a live conversion lands again; noted for the seat, not a defect.
5. PR docs(adr-0018): dated note — http_request, http_call and webhook are reserved retired node names (F5-http of #23543) #23955's PASS record (6217920402) stands: no sentence it relies on moved. The five code files the ADR note is judged against are byte-identical in net diff between the two heads, and the note's "Authoring refuses them, naming http" is, on this branch, true at the save door for a new flow as well. Its sequencing flag stands too: this PR lands first, the note waits for the maintainer's hand. Its body's maintainer speed-read line about the save door is still stale (body only; the ADR text does not say it).
6. Downstream, not this PR's: objectui's read sites of the three names, the seat's card at landing; skills/** untouched.

Implemented-by: claude/issue-23543-f5-http-reserved-node-names
Reviewed-by: session_01HjR8RUwTPQ3TgbfKihmxp9

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · ACCEPT · PR #23954 @ f459d50c5b (#23543, F5-http PR A, the code) · domain:spec seat 1 · os-elon-musk · session session_01HjR8RUwTPQ3TgbfKihmxp9 · 2026-10-16T16:26Z

Reviewer of record. Every item below was checked against GitHub and the code, not against the reports (6217001433, 6219476536 on #23543).

• Shape: Draft, base main. The first line is Part of #23543, with no closing keyword, then Clause-②: yes (narrowing), matching claim 6214417833. 33 files, +1093/−336 (1429 lines, under the 3000-line human-merge threshold). check-governed-merges.mjs --pr 23954: 0 of 33 paths hit the governed register. Assignee os-elon-musk.
• What it lands: ruling 6182001882 item 6, family F5-http. http_request, http_call and webhook are reserved node types, named by one table (FLOW_RESERVED_NODE_TYPES) that three doors read: the flow parse refuses them at a node's type (top level and region bodies, each site once) with the rename to http; AutomationEngine.registerNodeExecutor refuses an executor or descriptor typed with one; and flow-node-http-callout-rename is retired from the load path (retiredAfter: '17.7.0') and still rewrites a stored row at the data-at-rest seams. eventType: 'webhook' on a wait node is untouched.
• Contract review: FAIL 6217909163 on d55439273f (ESLint at the probe preload, a repo-project house-sentence test, and a save-door paragraph PR feat(metadata-protocol)!: the flow save door refuses a retired spelling on a NEW flow; a stored flow keeps the full chain #23902 made false). Patch round 6217952268. PASS 6219927228 on this head (CONTRACT_REVIEW_TIER), which judged each of the three items fixed on the code and the merge of main neutral to the PR's own diff.
• The patch, re-read by the seat: the preload takes a named ALL_CONVERSIONS import; the D3 reason spells objectstack migrate meta with no --from value; the changeset and the D3 entry now name the save door's 422 for a NEW flow, which is true with PR feat(metadata-protocol)!: the flow save door refuses a retired spelling on a NEW flow; a stored flow keeps the full chain #23902 merged into the branch and matches ruling 6212082860 letter B. The seat accepts that step beyond plain deletion. The PR body is the report's pr_body_replacement, written by the seat in this round.
• Semver: a BREAKING minor for @objectstack/spec and @objectstack/service-automation, FROM → TO, marked registered flow-node-http-callout-types-reserved.
• The report's open questions, the seat's calls: (1) the save door: answered by rulings 6212082860 and 6216220018, executed by PR feat(metadata-protocol)!: the flow save door refuses a retired spelling on a NEW flow; a stored flow keeps the full chain #23902; (2) the ADR-0078 conflict channel, left with no producer: A, retired as this seat's own card, filed at landing (it touches protocol.ts and engine.ts).
• CI on this head: 48 check-runs, 41 success, 7 skipped by their filters, 0 failed; all five required contexts green. mergeable: clean.

At landing, this seat: files the objectui card for the three names' read sites (preview samples, the inspector alias, the canvas cases, the simulator, the metadata viewer and an i18n key, listed in the PR body) and the conflict-channel retirement card. It then ACCEPTs PR #23955, the ADR-0018 note (contract review PASS 6217920402), and hands it to its approvers. That note waits for this PR, so the ADR never states a refusal main does not make.

The PR goes to the merge queue in this act.

---

Generated by Claude Code