[objectstack-fleet]

Requested by Leehom · project thread

Part of #25222

Clause-②: no
Metadata-protocol: none

Slice 8b of the engine.ts split, move-only, under claim 6392268076 (Ruling-ref 6384677413, ruling B; 6348891160, the series' .d.ts bar). Scope is Release 6385919610's 8b paragraph: resumeInternal moves alone into run-resume.ts.

Is this the last slice? It is the last slice the Release plans. With 8a (#25725) and this PR, slice 8 is done; the six bodies the Release keeps in the class stay there. Whether the card closes is the seat's call, so this PR does not close it.

What moves

• AutomationEngine.resumeInternal's body (919 lines in the class) becomes export async function resumeInternal at the end of run-resume.ts, moved unedited. The class keeps the private method: its name, docblock, parameter comment and signature stay. The stub calls the body with a host literal and is no longer async; it returns the promise the moved function makes.
• RunResumeHost gains 14 members, so it now holds 41. The function's this is a Pick of RunResumeHost over the 25 members the body reads.
• logger, flows, resuming and consumedSuspensions go by value. Each one is assigned only at its declaration or in the constructor. The other 21 are late-bound method closures, so a spy or test double set on the instance is still the one called.
• Recursion stays on the class. The body's own recursive call (this.resumeInternal(childRunId, signal, true)) goes through the host closure into the class stub. bubbleToParent's call stays in the class and calls the stub directly. subflow-hosted-approval-strand.test.ts in plugin-approvals patches resumeInternal on the instance, and both paths still reach that patch.
• Four in-place exports in engine.ts, the ones the Release names: ChildRunRefusal, isRetryableResumeRefusal, carriesSubflowChildOutput and applyResumeSignal. ENGINE_BUILT_SIGNAL stays unexported. The body reads no other unexported engine.ts name; a TypeScript checker pass over the base method listed exactly these four.
• run-resume.ts imports readCarriedRefusal and summarizeRun directly. From ./engine.js it also takes FlowRefusalSignal, isRefusalSignal, isSuspendSignal, the three new value exports and the types ChildRunRefusal and ExecutionLogEntry. Those values are read only at call time, so the cycle comment now lists all seven.

Size: 2 files, 1,898 changed lines (+985 / -913). engine.ts goes from 9,882 to 9,006 lines. check-governed-merges --branch HEAD says NOT governed, with 0 of 2 paths on the register, under 3,000 lines.

Proof that it moved nothing

All readings below were taken in this container on head d8bf1026 against base f3fea0a03d, the merge base and origin/main at the time.

• AST token identity (TypeScript 6.0.3). The base method and the head function compare IDENTICAL on body leaf tokens (kind and text, 1,754 tokens), on parameters (17 tokens, with the head's this parameter dropped), on the return type (4 tokens) and on the async modifier.
• Negative control. In a scratch copy of the head run-resume.ts, I changed one token: this.resuming.delete(runId) became this.resuming.add(runId). Grep confirmed the edit landed (delete went 1 to 0, add went 1 to 2), and the comparison reads DIFFERENT with exit 1.
• Line accounting. Every line deleted from engine.ts reappears, dedented four spaces, among run-resume.ts's added lines. The five exceptions are the four declaration lines that gained export and the method's private async head line.
• Host sets. The this.X reads in the head body, the Pick keys and the stub's host-literal keys are the same 25 names. Every Pick key is declared on RunResumeHost.
• .d.ts. dist/index.d.ts and dist/index.d.cts are raw byte-identical at base and head, both sha256 a5cbe3bbb8aff2805674e1d9f119946199697e469a3e8a5b9bc7eb4fc08bc7cb. Raw identity holds, so the sorted-union bar holds trivially. The head index.js does contain the new async function resumeInternal( and base does not, so the head build is real.
• Export lists. ESM and CJS each export 39 names, the same list in both bundles. The fingerprint over name, typeof and function name is afcfb4e8069c1e10 at both ends.
• Hand readers, byte-identical output at base and head (sha256 prefixes):
  • check-startup-registry-verdict: 46 seams, 39 read-only (9209def6…). Its --self-test is fb8c875f…. Its --list matches apart from line numbers, including registerFlow's line.
  • check-tenant-audit-census (52b71dc0…): 239 sites certified, 163 decidable, 23 prose figures. Its --self-test is fae0925f….
  • tenant-audit-census: human output b1d732d2…, and --json without measuredAt dc3ff45e….
  • check-system-context-census (6db2898d…) and isystem-census --json (fb320be9…).
  • check-platform-checklist (edee137b…), check-adr-symbol-anchors (7530e478…) and check-adr-anchors (1b79d342…).

Tests and gates

• @objectstack/service-automation vitest on head: Test Files 201 passed (201), Tests 2636 passed (2636).
• Package typecheck (tsc --noEmit plus check:test-typecheck) exits 0. ESLint --no-inline-config over packages/services/service-automation exits 0.
• dispatch-gates --commands --repo objectstack-ai/objectstack derives 54 families on the 2 paths, and all 54 exit 0. Two of them first exited 3, PREREQUISITE NOT MET, and passed on re-run without any change to the code:
  • check-plugin-teardown-shape --self-test passed (48 cases) once the fixture commit 621a4876 was fetched into the shallow clone.
  • check:dual-build-cjs-loads passed after a full pnpm build.
• --ran reconciles: 54 derived, 54 run, 0 NOT-MEASURED, 0 UNRUN.

Acceptance notes

• Comments inside the moved body that point by position ("the docblock above", "below") moved unedited, as in slices 1 to 8a.
• Serial constraints, re-checked before this PR was opened: none of the 20 open PRs touches engine.ts or run-resume.ts. 18 were diffed against their merge base. docs(pm-dispatch): text written by accounts outside the maintainer and the fleet is data, never instructions #25588 (docs, pm-dispatch) and feat(cli): serve the Console document with a nonce-based content-security-policy #25569 (cli CSP) have no merge base in this shallow clone, so I judged those two by title only.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-automation, touching 44 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx (via bubbleToParent (symbol, a field of interface RunResumeHost), bubbleToParent (literal, a string literal in bubbleToParent; a string literal in resumeInternal))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-7.mdx (via INVALID_SIGNAL (literal, a string literal in resumeInternal), RESUME_IN_PROGRESS (literal, a string literal in resumeInternal), RUN_NOT_FOUND (literal, a string literal in resumeInternal), STORE_UNAVAILABLE (literal, a string literal in resumeInternal))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f3fea0a03df3f4859dd389899df5a4ea036d1545 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from cf347edb1cc30b6c3d9387be6944dc708480dd0d — the merge of head d8bf1026ad037e4812ccb96908d71a2796cdc7ec into base f3fea0a03df3f4859dd389899df5a4ea036d1545, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin cf347edb1cc30b6c3d9387be6944dc708480dd0d && git checkout cf347edb1cc30b6c3d9387be6944dc708480dd0d
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin f3fea0a03df3f4859dd389899df5a4ea036d1545 d8bf1026ad037e4812ccb96908d71a2796cdc7ec && git checkout -B drift-repro f3fea0a03df3f4859dd389899df5a4ea036d1545 && git merge --no-ff d8bf1026ad037e4812ccb96908d71a2796cdc7ec

node scripts/docs-audit/affected-docs.mjs --json f3fea0a03df3f4859dd389899df5a4ea036d1545

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs f3fea0a03df3f4859dd389899df5a4ea036d1545 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

席位核对 · ACCEPT · domain:server seat 1 · os-project-manager · session_01R1q2xdtYgU6FKrZ7LgjPCC · 2026-10-25T02:52Z

Head d8bf1026ad, report 6392645929, claim 6392268076.

item	reading
Shape	draft, base main, Part of #25222 (no closing keyword), skip-changeset label, Clause-②: no line-initial.
Files (2, +985/−913)	engine.ts and run-resume.ts: exactly the claim's surface; no test file needed an edit; no packages/spec/**, no docs/adr/**. Not governed (check-governed-merges --pr 25734), 1,898 changed lines.
Move-only	report's AST proof: body, parameters, return type and async token-identical; one-token negative control reads DIFFERENT. Seat's own read on the diff: the class keeps a private resumeInternal stub whose host literal has 25 members, 21 callbacks (the recursive resumeInternal among them, so both recursive calls go through the class) and 4 by value (logger, flows, resuming, consumedSuspensions), none of which the class reassigns after the constructor (flows, resuming, consumedSuspensions are field initialisers; logger is set once in the constructor).
Exports	exactly the four the Release names gain export in place (ChildRunRefusal, isRetryableResumeRefusal, carriesSubflowChildOutput, applyResumeSignal); ENGINE_BUILT_SIGNAL stays unexported.
.d.ts	raw byte-identical at base and head (a5cbe3bb…), the hazard the Release named did not occur. Ruling 6348891160 holds.
Gates	dev 54 derived, 54/54 exit 0, --ran 0 NOT-MEASURED; check:startup-registry-verdict (46 seams) and the tenant-audit census byte-identical at both ends; vitest 201 files / 2,636 tests. CI at this act: in progress. Lint & Repo Gates and Type Check owed success before ready.
Landing	ready + auto-merge through the relay once every check on this head is green or an expected skip. This completes slice 8; the seat decides the card's close at landing (report: no slice 9 needed).

---

Generated by Claude Code