fix(automation): hold a signal-less resume to the screen-input contract (#13648)

[claude]

Fixes #13648

What

AutomationEngine.refuseInvalidScreenInput opened with a bare if (!signal) return null;, so resume(runId) with no signal object skipped the required screen-field check that resume(runId, {}) is held to (INVALID_SCREEN_INPUT) — the run proceeded with the screen's variables unbound. The engine already names its one legitimate exemption, its own continuations, through the ENGINE_BUILT_SIGNAL flag; the early return was a second, unnamed spelling of an exemption nobody had asked for.

Ruling applied (triage comment on #13648, quoted verbatim, untranslated):

一个操作两个实现且行为不一致 ⇒ 带治理的一侧(权限闸、同意、去重、审计)默认胜出,另一侧改绑并删除 —— 不是对齐也不是双写。
⇒ 带治理的一侧是旗标。 裁决:把无信号路径改绑到 ENGINE_BUILT_SIGNAL 机制上,或直接令其受同一契约约束;⛔ 删掉那个裸早返,⛔ 不要留两种拼法表达同一个豁免。

Route: the public resume door normalises an absent signal to {} — the shape the HTTP route POST /automation/:name/runs/:runId/resume has always assembled for an empty body — and resumeInternal, refuseInvalidScreenInput and applyResumeSignal now take a non-optional ResumeSignal, so both falsy-signal early returns are deleted and a falsy-signal branch cannot grow back. The only exemption left is the engine-built flag, spelled once, at the one place the engine builds a signal (engineBuilt(...)).

Unaffected by construction — any pause that declares no screen contract: wait (its timer wake and restart re-arm call engine.resume(runId) with no signal and keep working, wait-node.test.ts green), approval, message-only and object-form screens, and screens whose fields are all optional or hidden by visibleWhen.

Premise (the triage stop condition) — HELD

Sweep of every resume( caller on the engine / IAutomationService across packages/**, examples/**, apps/** (git grep, non-test sources; the positive control is the signal-carrying REST call, which the same sweep hit):

Call site	Signal?	Classification
packages/runtime/src/domains/automation.ts — automationService.resume(parts[2], signal) (the POST …/runs/:runId/resume handler; client.automation.resume and the hono adapter route both land here)	always an object — the handler assembles signal = {} field by field, so an empty body is {}	EXTERNAL door; the signal-less form is unreachable from it
packages/plugins/plugin-approvals/src/approval-service.ts — this.automation.resume(runId, signal) via serviceResume	always an object (output / branchLabel plus the service-authority marker)	plugin-owned; approval pauses declare no screen contract
packages/services/service-automation/src/builtin/wait-node.ts lines 118 and 401 — engine.resume(runId)	none	INTERNAL (engine-owned builtin): timer wake and restart re-arm of a wait pause, which declares no screen contract ⇒ unaffected
engine.ts resumeInternal(childRunId, signal, true) (subflow delegation) and resumeInternal(parentRunId, sig, …) (bubbleToParent)	forwarded caller signal / engine-built	INTERNAL
packages/mcp, packages/rest, packages/plugins/plugin-hono-server, packages/client*	—	no direct engine resume caller (the client and the hono route go through the runtime handler above)
examples/**, apps/**	—	one doc comment only (examples/app-showcase/src/automation/flows/index.ts)

The only documented signal-less gesture is the wait node's operator note ("resume it externally via resume(runId)"), and that pause has no screen contract, so its behaviour is unchanged. No external caller relies on a signal-less resume of a screen-paused run ⇒ premise_still_valid: true, no fork.

PM hypotheses

• H1 — holds. refuseInvalidScreenInput has exactly one call site (resumeInternal, before applyResumeSignal); nothing else read its null-for-missing-signal answer. The subflow-delegation branch may replace the caller's signal with an engine-built one before that call, which is the flag path, not the bare one.
• H2 — half refuted. The flag IS carried on the signal object (module-private symbol, engineBuilt(...)), and the subflow / map continuations build flagged signals. But the wait node's timer and re-arm paths build NO signal at all — they call engine.resume(runId). They are unaffected for a different reason: a wait pause has no screen, so screenDeclaresInputContract is false and an empty submission is conformant. Pinned by the package suite (wait-node.test.ts, 1166/1166 green).
• H3 — holds. git show 80948340 -- engine.ts has hunks at old lines 1622, 1788, 1831, 4521 (loadSuspendedRunStrict, cacheOnlySuspensions, prose); zero mentions of refuseInvalidScreenInput or ENGINE_BUILT_SIGNAL.

Tests (head 8ed17503)

New packages/services/service-automation/src/builtin/screen-resume-signal-less.test.ts (9 pins):

• (a) signal-less resume of a screen with a required field ⇒ success: false, code: 'INVALID_SCREEN_INPUT', first sentence Invalid screen input: …"kind"… required, and the run is still paused (hasSuspendedRun true, getSuspendedScreen still ask); plus: the signal-less and the { variables: {} } refusals are byte-equal envelopes; plus: a signal-less resume of a delegated CHILD is refused and both runs stay paused.
• (b) the same run resumes once the field is supplied (success: true, no code, pause consumed).
• (c) negative control — a child's completion bubbles up through the engine-built signal, judged against the parent's surfaced screen that carries the required field; the bag lacks it and only the flag lets it through; parent completes, downstream captured the mapped output.
• (d) no over-refusal — signal-less resume proceeds on a screen whose fields are all optional, a message-only screen, an object-form screen, and a screen whose required field is hidden by visibleWhen: 'false'.

Runs (all through scripts/pm/os-verify-lock.sh, exit captured before any pipe, verdict lines quoted):

• pnpm --filter @objectstack/service-automation exec vitest run --maxWorkers=2 src/builtin/screen-resume-signal-less.test.ts src/builtin/screen-resume-validation.test.ts → Test Files 2 passed (2) · Tests 24 passed (24) · VERDICT command-exit 0
• pnpm --filter @objectstack/service-automation test → Test Files 98 passed (98) · Tests 1166 passed (1166) · VERDICT command-exit 0 — every existing signal-less caller in the suite pauses on a node with no screen contract; no fixture needed re-triage.
• pnpm --filter '@objectstack/plugin-approvals^...' build then pnpm --filter @objectstack/plugin-approvals test (downstream consumer; resolves @objectstack/service-automation through its rebuilt dist) → Test Files 35 passed (35) · Tests 652 passed (652) · VERDICT command-exit 0. (A first run before the closure build had one file fail to resolve @objectstack/trigger-record-change — build state, not this change; 650/650 tests already green.)
• pnpm --filter @objectstack/service-automation exec tsc --noEmit -p tsconfig.json --listFiles → the new test file and engine.ts are in the program (1 hit each); zero errors in either. The package has no typecheck script (DEBT ledger); the only 3 errors reported are pre-existing in src/nested-region-parity.test.ts (private flows), untouched here.
• pnpm exec eslint . --no-inline-config --format json (full repo, foreground) → 5681 files, 0 errors, 0 warnings; both changed files in the population.
• pnpm --filter @objectstack/service-automation build → check-dts-emitted: 2/2; dist/index.js carries signal ?? {} (1) and no if (!signal) return null; (0).

Reverse verification (committed tree, restoring trap, absolute paths)

git restore --source=80948340 -- engine.ts (the pre-fix file: bare early return back, normalisation gone). Proven on disk before any reading: if (!signal) return null; count 0 → 1, signal ?? {} count 1 → 0, disk blob bb6ca937… = BASE blob. No dist rebuild needed for this leg: the suite imports ../engine.js from source (no exports-resolved dist on the path). Observed direction on the mutated tree: 4 red / 5 green — the three (a)-family pins and (b) (whose precondition re-asserts the refusal) went red; (c) and the four (d) pins stayed green. Restore: git checkout HEAD -- engine.ts; disk blob fd009382… = HEAD blob, git diff HEAD empty, counts back to 0 / 1.

Gates (derived at head 8ed17503 with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands, 35 families + check:nul-bytes)

Green (exit 0, each gate's own pass line read): check-adr-0087-registration, check-changeset-no-major, check-ci-filter-parity, check-comment-mask-adoption, check-cross-package-test-inputs (both spellings), check-empty-changeset, check-keyed-text-bounds, check-plugin-teardown-shape, check-shard-attestation, check-tenant-audit-census, check-undeclared-dep-imports, docs-audit/check-affected-docs, docs-audit/check-drift-comment, pm/check-half-states, pm/release-rehearsal-clone --self-test, check:changeset-gate-self-tests, check:dispatcher-error-vocabulary, check:doc-authoring, check:engine-double-contract, check:logger-receiver-detach, check:objectql-double-limit, check:objectui-changeset, check:page-declaration-shape, check:pm-half-states, check:published-files, check:query-options-erasure, check:slot-lookup, check:test-source-alias, check:type-check-coverage, check:type-source-resolution, check:where-matcher, check:nul-bytes.

NOT MEASURED locally (each exited 3 with its own PREREQUISITE NOT MET text; CI owns them): check-test-completeness (grades a saved turbo run test log), check:type-check-debt (--re-measure needs the whole ledgered closure built), check:dual-build-cjs-loads (needs every package's dist).

Contract review (Clause ②)

• Exported-symbol delta (git diff -U0 80948340..8ed17503 -- engine.ts | grep export): none. resume(runId, signal?) keeps its public signature (the IAutomationService contract in packages/spec is untouched — zero spec writes); the narrowed parameters are private / module-private.
• Behaviour change, stated as accept/reject: AutomationEngine.resume(runId) with no signal on a run paused at a screen node with an unconditional required field — before: accepted (run continued, variable unbound); after: rejected with the existing INVALID_SCREEN_INPUT envelope, pause not consumed, corrected resubmission accepted. Every other input shape is unchanged; the HTTP door never exposed the accepting shape.
• Changeset level: patch for @objectstack/service-automation — no new exported symbol, a tightened refusal on a published API using an existing error code, and the wire behaviour of the REST door is unchanged.
• Log levels: no new log site of any level.
• Consumer note (carried from the card): objectstack-ai/hotcrm#1173's end-to-end pin covers the signal-carrying refusal, which this PR does not change; if it reds, that is the expected early warning and is not to be "fixed green" here.

Out of scope

• out of scope: service-automation: a subflow parent resume treats the delegated child screen's RETRYABLE refusal (INVALID_SCREEN_INPUT) as a terminal child failure — the parent is failed, the still-paused child is orphaned, and the corrected retry answers RUN_NOT_FOUND #14379 — filed while measuring the delegation path: a subflow parent's resume treats the delegated child screen's retryable INVALID_SCREEN_INPUT refusal as a terminal child failure (parent failed, still-paused child orphaned, corrected retry answers RUN_NOT_FOUND). Pre-existing on the signal-carrying path; this PR does not touch that block. service-automation: a subflow parent resume treats the delegated child screen's RETRYABLE refusal (INVALID_SCREEN_INPUT) as a terminal child failure — the parent is failed, the still-paused child is orphaned, and the corrected retry answers RUN_NOT_FOUND #14379 remains open.

Session: https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-automation, touching 4 documentable anchor(s).

⛔ 2 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v16.mdx (via AutomationEngine (symbol, a top-level class))
• content/docs/releases/v17.mdx (via AutomationEngine (symbol, a top-level class))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 1dcb995f23fc6f54c38d5e38068800e7513e14f0 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 3c073c20b0dbed1807aba1af65f85bf24ce515bc — the merge of head 8ed175039405c4f9409e676723c1ae6c4044f371 into base 1dcb995f23fc6f54c38d5e38068800e7513e14f0, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 3c073c20b0dbed1807aba1af65f85bf24ce515bc && git checkout 3c073c20b0dbed1807aba1af65f85bf24ce515bc
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 1dcb995f23fc6f54c38d5e38068800e7513e14f0 8ed175039405c4f9409e676723c1ae6c4044f371 && git checkout -B drift-repro 1dcb995f23fc6f54c38d5e38068800e7513e14f0 && git merge --no-ff 8ed175039405c4f9409e676723c1ae6c4044f371

node scripts/docs-audit/affected-docs.mjs --json 1dcb995f23fc6f54c38d5e38068800e7513e14f0

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 1dcb995f23fc6f54c38d5e38068800e7513e14f0 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance (PM seat, domain:services, session_01AUF1NoViznQK32gqpK8wS8)

• In-seat Clause-② contract review: PASS on the card — resume(runId) with no signal object bypasses the screen-input contract entirely — refuseInvalidScreenInput short-circuits on a falsy signal, required fields included #13648 (comment) — an isolated fable second opinion (independent premise re-sweep with a positive control; ablation reconstructed 4 red / 5 green), transcript-verified (43 of 43 harness stamps at tier), adopted verbatim; needs:contract-review cleared on both carriers in that stroke (maintainer 2026-08-31: a PASS is cleared and landed by the dispatching seat; check-clause2-carriers --pair 14388 read both carriers consistent before the strip).
• Landing checks on 8ed17503: every check green — Lint & Repo Gates success 04:13:17Z, Test Core (1/6) success 04:07:49Z, all other shards, type checks, Dogfood, Temporal Conformance, guards and changeset checks success; the remainder skipped by path filter. Closing keyword: Fixes #13648 is the only one in the body.
• Marked ready for review; auto-merge armed for the merge queue in the same stroke. The reviewer's non-blocking follow-ups are recorded on service-automation: a subflow parent resume treats the delegated child screen's RETRYABLE refusal (INVALID_SCREEN_INPUT) as a terminal child failure — the parent is failed, the still-paused child is orphaned, and the corrected retry answers RUN_NOT_FOUND #14379 (scope widening) and [finding] service-automation: the subflow up-bubble path always logs "child run … is gone — continuing without child output" even when the engine-built signal carries the child's output #14392 (misleading up-bubble log line); none was required for merge.

---

Generated by Claude Code