[Decision] flows and records: may a flow start input declare a record reference (A), and does a non-system create stop choosing the new record's id (C)?

domain:server#5 · os-steve · session_01ADHkmQKwKFCp1m6Pb6Q8c1

Ruled: 6663860762 · letter A + C0 (C withdrawn) · 2026-11-05T16:47Z (supersedes 6580257050)

Filing gate: ② a decision only the maintainer can make. It is a follow-up to #29050 (closed) and PR #29365 (merged dfbe34d887), handled under ruling C. This card states rules only. The seat holds the reasoning in the project and gives it to the maintainer there, not here. Filed by domain:server seat 5. ⛔ Not a claim. Suggested grade: p2.

Maintainer quick-read

PR #29365 made every door that starts a flow by name check a start input that the flow definition visibly reads as a record id. The check loads the record with the caller's own permissions before the run exists. It covers only inputs the definition reads that way in plain sight. Two further rules would make the check complete. Each one is a product choice, so the seat does not pick for you.

Options

Option	The rule	Who sees it	Work
A — declared record reference	A flow start input may declare "this is the id of a record of object X". Every start door then checks a declared input the same way #29365 checks a visible read: loaded with the caller's permissions, before the run exists.	Flow authors gain one optional key. Flows that don't use it behave as today.	`domain:spec` key first (1 PR), then `domain:server` doors (1 PR). Precedent: PR #29365, 967 lines in 8 files.
C — engine-chosen ids on create	When a non-system caller creates a record, the platform chooses the new record's id. A caller-supplied id is refused with 400 naming `id`. System callers (import, migrate, seed, platform services) keep choosing ids.	API and SDK clients that send their own `id` on create start failing loudly. This is BREAKING (narrowing). Not yet measured: which shipped clients, connectors or examples send an id today. The PR measures that first.	`domain:server` · 1 PR · full dogfood · no landed precedent
A + C (seat recommends)	Both.	Both of the above.	3 PRs, spec first.
Neither	Keep #29365's rule as shipped: only visibly read inputs are checked.	Nobody.	None.

Why A + C: A extends the shipped rule to every input an author declares. C removes a whole class of question at the source, rather than checking each consumer. Both are rules a reader can state in one sentence.

Protocol: A adds a key (Clause-②: yes (widening), Metadata-protocol: added, spec lane). C narrows an accept set (Clause-②: no (narrowing), BREAKING, ADR-0087 marker).

State: needs-user-decision. The seat dispatches the ruled letter privately under ruling C. Public PRs state the rule only.

Brief-claimed-by: session_01QsR2jV5sBSzCYNEDgpYLJw · batch #458 · 2026-11-02T14:50Z

Generated by Claude Code

Ruling: batch #458 item 1 · letter A+C · maintainer 「同意」 2026-11-02T14:54Z

director#1 · zhuangjianguo · session_01QsR2jV5sBSzCYNEDgpYLJw

What the ruling binds

A — declared record reference. A flow start input may declare that it is the id of a record of a named object. Every door that starts the flow by name then loads a declared input in the caller's own scope from that object before the run exists, with the same refusals PR fix(runtime): every flow start door judges a start input against the object the flow's definition reads it from #29365 gives a visibly read input (404 RECORD_NOT_FOUND, 400 VALIDATION_FAILED naming the input). An input without the declaration keeps fix(runtime): every flow start door judges a start input against the object the flow's definition reads it from #29365's visible-read rule. The key's spelling is the spec card's to set (the brief suggests type: 'record' beside an objectName, the word the CRUD nodes already use).
C — engine-chosen ids on create. When a non-system caller creates a record, the platform chooses the id; a caller-supplied id is refused 400 naming id. "System caller" means the system identity only (runAs: system, import, migrate, seed, platform services). An administrator account is a non-system caller and is refused the same way. The refusal names the alternative: upsert by a declared external key.
Not "neither": the rule PR fix(runtime): every flow start door judges a start input against the object the flow's definition reads it from #29365 states stays incomplete for inputs the definition does not read in plain sight.

Workload of the letter

A: domain:spec one PR (the key; Clause-②: yes (widening), Metadata-protocol: added), then domain:server one PR Blocked-by it (every start door checks a declared input; precedent PR fix(runtime): every flow start door judges a start input against the object the flow's definition reads it from #29365, 967 lines / 8 files).
C: domain:server one PR, BREAKING banner, ADR-0087 marker, full dogfood. Before it lands, its body states the measurement the card promised: which shipped clients, connectors, examples and Console paths send an id on create today. If that measurement finds a shipped caller sending ids, those callers move first and C lands after them.

Execution

Server seat 5 dispatches under rule C as the card says: public surfaces state the rule only.
Order: the spec card for A first; the server A half and the C PR may run in parallel, both serial with fix(service-automation)!: a flow's record nodes treat a computed filter operand as a value, never as a query operator #29404 on the flow files.
Label strokes are the lane seat's.

Confidence gaps carried from the brief: the private security reasoning behind C was not read by this seat; the population of id-sending clients is unmeasured until the C PR measures it.

Generated by Claude Code

domain:server#5 · os-steve · session_01ADHkmQKwKFCp1m6Pb6Q8c1

Ruling A+C (6580257050) received. Executed in order:

A, spec half: spec(automation): a flow start input may declare that it is a record id of a named object (#29425 ruling A) #29442 (a flow start input's record-reference declaration), filed into the spec lane queue. The server half of A follows on this card once spec(automation): a flow start input may declare that it is a record id of a named object (#29425 ruling A) #29442 merges, serial with fix(service-automation)!: a flow's record nodes treat a computed filter operand as a value, never as a query operator #29404 on the flow files.
C: claimed below, under ruling C. Public text states the rule only.

Claim: PM loop · card thread · letter C (engine-chosen ids on create) · 2026-11-02T15:04Z

Branch: pending (the card thread is being opened; a "branch named" claim supersedes this one).
Clause-②: no (narrowing)
Metadata-protocol: none

Order: measure first, and put the measurement in the PR body: which shipped clients, connectors, examples and Console paths send an id on create today. If any shipped caller does, stop and report; those callers move first. Then: a non-system caller's create carrying an id is refused with 400 naming id, and the refusal names the alternative (upsert by a declared external key). The system identity only (runAs: system, import, migrate, seed, platform services) keeps choosing ids, and an administrator account is refused like any non-system caller. One PR, Refs #29425, with a BREAKING banner, an ADR-0087 marker and full dogfood run locally.

State: needs-user-decision → pm:dispatched.

domain:server#5 · os-steve · session_01ADHkmQKwKFCp1m6Pb6Q8c1

Claim: PM loop · card thread · letter C (engine-chosen ids on create) · branch named · 2026-11-02T15:08Z (supersedes the pending-branch claim above)

Seat: domain:server#5 · branch claude/project-thread-li91rx · session_01ADHkmQ6MkQtwGFr2gAD9qS
Clause-②: no (narrowing)
Metadata-protocol: none

Order: as in the claim above. Measure first; if a shipped caller sends an id on create, stop and report. One PR, Refs #29425, rule-only.

domain:server#5 · os-steve · session_01ADHkmQ6MkQtwGFr2gAD9qS
os-dev-report

{
  "issue": 29425,
  "status": "needs_decision",
  "branch": "claude/project-thread-li91rx",
  "pr": null,
  "session": "session_01ADHkmQ6MkQtwGFr2gAD9qS",
  "premise_still_valid": true,
  "summary": "Letter C, step 1 (measure first) on origin/main a6441636, static reading, no code written. Three stop conditions hold. (1) A shipped caller sends an id on create in a non-system context: the shared import runner (packages/core/src/utils/import-runner.ts, flushPendingCreates) gives every buffered create row a minted id for its retry recheck and keeps a file-supplied id, and writes as the requester; it serves POST /data/:object/import, the async import jobs, the Console Import wizard and the SDK import. Clone overrides.id and the batch upsert create arm also create with a caller id. (2) ADR-0120's amendment of 2026-11-01 records the opposite rule ('Every create door accepts a caller-supplied id') and lists this exact refusal as rejected option a, with a bar for closing it; two dogfood files and http-protocol.mdx pin that contract, so C needs a superseding ADR record (Tier H). (3) 'Upsert by a declared external key' does not exist for an API caller: the batch upsert declares externalId but keys on id only, and the field externalId flag is described as not read; the only key-matched upsert a non-system caller has is the import door (writeMode 'upsert' + matchFields), which is caller (1). Detail: /mnt/project-files/server-seat5/29425-c-measurement.md (project files).",
  "tests": "none — read-only measurement, no diff",
  "gates": "n/a — no diff, no commit",
  "dogfood_battery": "n/a — no diff; owed once on the final head of the C PR",
  "mcp_calls": "2 — mcp__github__issue_read (get, get_comments) on #29425; no write tool",
  "api_writes": "1 — this os-dev-report comment (POST /repos/objectstack-ai/objectstack/issues/29425/comments, through the fleet relay)",
  "open_questions": [
    {
      "question": "Ruling C contradicts ADR-0120's 2026-11-01 amendment, and a shipped caller (the import runner) creates with an id as the requester. How do the callers move first, and does C supersede the amendment?",
      "options": [
        "A: C stands. A superseding ADR-0120 amendment (Tier H, draft) lands with the code. The import runner moves first, server-only: its own minted ids are admitted through an in-process platform mark that no request can carry, and a file-supplied id on a create row is refused per row with 400 naming id. Existing-row round trips keep working, because an update matched on id is not a create. Clone overrides.id and the batch upsert create arm are refused too, so a by-id upsert becomes: update a readable row, otherwise 400. The refusal names the import door's upsert (writeMode 'upsert' + matchFields) as the alternative. Work: ADR amendment PR plus one server PR (objectql insert door, core import runner, forced dogfood edits, http-protocol.mdx text). BREAKING, no landed precedent.",
        "B: A, plus a real external-key upsert on the API. The batch upsert reads its declared externalId against a declared key field, so the refusal names a door on the same surface. Adds a spec-lane card (the field flag's meaning) and a server PR, landed before the C door.",
        "C0: Withdraw C and keep ADR-0120 as amended (caller-supplied ids accepted, a collision answers 409). Zero PRs on this letter."
      ],
      "recommendation": "B. Two years out, the identity model the ruling describes is engine-chosen ids plus a declared external-key upsert on every API door (the Salesforce model; Dataverse and ServiceNow, which the ADR cites, accept caller ids). B is the only option whose named alternative sits on the same surface the caller was refused on; under A, an API client keyed by its own ids has no API path left. Order: the ADR-0120 amendment and the spec-lane card for the external-key upsert first, then the server PR that makes the batch upsert read its key, then the C PR (import runner moves, insert door refuses). Confidence gaps: the run-time census of exercised create paths was not run (stopped at step 1), and the carrier of the importer mark (engine option vs row registry) is unmeasured."
    },
    {
      "question": "Does 'system caller' include a context-less engine insert (no principal, no isSystem)?",
      "options": [
        "A: No. The ruling's 'system identity only' is read literally: only isSystem: true passes, and a context-less insert carrying an id is refused like a member's, in line with ADR-0096 D5's fail-closed direction.",
        "B: Yes, for the transition. Context-less calls keep their id until ADR-0096 D5 flips, and the census lists them."
      ],
      "recommendation": "A. It is the ruling's own wording and ADR-0096's direction. The C PR runs the census first and moves any context-less id-sender to an explicit system context in the same PR."
    }
  ],
  "security_findings": "withheld",
  "out_of_scope_findings": [
    "carrier: this card's decision (open question 1, option B) · the batch upsert's declared externalId row key is never read by the handler (spec:BatchRecordSchema.externalId -> consumer: none); NOT MEASURED at a public door · noted, not filed"
  ],
  "files_changed": [],
  "line_budget": "n/a — no diff",
  "deviations": [
    "Stopped at step 1 under the delta's stop rule: no edit, no commit, no PR, no changeset.",
    "NOT MEASURED: a run-time census of non-system creates carrying an id over the dogfood battery. Reason: the static reading met the stop rule, and the ADR conflict puts the design with the maintainer. The census is the first step of the C PR once a letter is ruled.",
    "File surface reported, not claimed: if A or B proceeds, it reaches beyond the delta's expected surface. It adds packages/core (the import runner), docs/adr/0120 (governed, Tier H) and content/docs/protocol/kernel/http-protocol.mdx. B also needs a packages/spec card first.",
    "The dogfood closure build was started under the verify lock ahead of the implementation phase. It is a local build only and writes nothing to the repository."
  ]
}

Stamped 2026-11-02T15:22Z.

Generated by Claude Code

domain:server#5 · os-steve · session_01ADHkmQKwKFCp1m6Pb6Q8c1

Needs decision · #29425 letter C · 2026-11-02T15:23Z

Ruling 6580257050 told the C PR to measure first, and to move any shipped caller that sends an id on create before C lands. The dev's measurement (report 6580899246, static reading on main a6441636) found three stop conditions, so letter C returns to the maintainer. Letter A is unaffected: spec #29442 proceeds.

What stopped it (read in the report and spot-checked by the seat in the ADR text):

A shipped caller. The shared import runner creates rows with an id as the requester. That covers POST /data/:object/import, import jobs, the Console Import wizard and the SDK import. Clone (overrides.id) and the batch-upsert create arm do the same.
An accepted ADR says the opposite. ADR-0120's amendment of 2026-11-01 (maintainer 「同意」) states that every create door accepts a caller-supplied id, and it lists this exact refusal as a rejected option, with a bar for reopening it: import round trips must keep working without an exemption that reopens the door. Two dogfood files and http-protocol.mdx pin that contract. C would need a superseding ADR amendment (Tier H).
The named alternative doesn't exist on the API. The batch upsert declares externalId but keys on id only, and the field-level externalId flag is described as not read. The only key-matched upsert a non-system caller has is the import door, which is caller 1.

Options (maintainer):

Option	What it does	Who sees it	Work
C0 — withdraw C (seat recommends)	Keep ADR-0120 as amended: a caller-supplied id is accepted, and a collision answers 409. Letter A still lands.	Nobody.	None on this letter
A′ — C with the ADR amendment	A superseding ADR-0120 amendment. The import runner moves first: its own ids carry an in-process platform mark, and a file id on a create row is refused per row. Clone and the by-id upsert create arm are refused. The refusal names the import upsert as the alternative.	Import files that carry ids for new rows, clone, and API clients keyed by their own ids.	ADR PR (Tier H) + 1 server PR, BREAKING, no precedent
B′ — A′ plus an API external-key upsert first (the dev recommends this)	The batch upsert reads a declared external key, so the refusal names a door on the same surface.	Same as A′, but API clients keep a keyed path.	Spec card + 2 server PRs + ADR PR

Why the seat recommends C0: the maintainer amended ADR-0120 to accept caller ids one day before this ruling, against the same bar the ruling now meets. Letter A plus the shipped rule (#29365) already judge every input a flow reads as a record, as the caller, so C is defence in depth rather than the fix. A′ and B′ break import, clone and by-id upsert for a gain the flow-door rule already covers. If the long-term identity model should be engine-chosen ids, B′ is the honest shape, but as its own ADR-level project, not a follow-up to this card.

A second question is moot under C0. Under A′ or B′: does a context-less engine insert (no principal, not isSystem) count as a system caller? The dev and the seat both say no, read literally, which is ADR-0096 D5's fail-closed direction.

State: pm:dispatched → needs-user-decision. The card thread stays parked on claude/project-thread-li91rx with no diff.

Ruling: batch 2026-11-05/1 item 2 · #29425 · letter C0 (C withdrawn; A stands) · maintainer 「29029 29425 29918 30461 29466 同意」 2026-11-05T16:47:09Z

thread · os-elon-musk · session_016WV4cxaQxzxGCx9xsyjVWu · written 2026-11-05T17:05Z

The maintainer answered batch 1 of the 总监决裁 presentation in the project thread (five cards, one recommendation each) with 「29029 29425 29918 30461 29466 同意」, read as the recommended letter on every card. Presentation: /mnt/project-files/director-batch/2026-11-05-batch-1.md (project files). ⛔ Not a claim.

What the ruling binds

This answers the re-escalation 6580937975 on letter C.

C is withdrawn (C0). ADR-0120's 2026-11-01 amendment stands as written. Every create door accepts a caller-supplied id, a fresh one lands as given, and a collision answers 409 UNIQUE_VIOLATION, the same for every visibility of the holder. The C half of ruling 6580257050 is superseded. Its A half is not.
A stands. A flow start input may declare a record reference, and every door that starts the flow by name loads a declared input in the caller's scope before the run exists. The spec half (spec(automation): a flow start input may declare that it is a record id of a named object (#29425 ruling A) #29442) closed 2026-11-03. The server half proceeds, serial with fix(service-automation)!: a flow's record nodes treat a computed filter operand as a value, never as a query operator #29404 on the flow files.
The second question in the dev report (is a context-less insert a system caller?) is moot under C0.
Not A′ or B′: both break id-preserving import, clone and by-id upsert today. If the platform ever moves to engine-chosen ids plus a declared external-key upsert, that is its own ADR-level project, not a follow-up to this card.

Workload of the letter

C0: none. The C card thread (claude/project-thread-li91rx, no diff) closes with no PR. A's server half: one domain:server PR, precedent PR #29365 (967 lines / 8 files).

Execution

The domain:server seat dispatches A's server half; label strokes are the lane seat's.

Generated by Claude Code

domain:server#2 · os-bill · session_01Utp6Cbvcmv8YWFhFJwzjKL

Claim: PM loop round 14 — letter A, server half (ruling 6663860762; C withdrawn, its thread closes with no PR)..
Session: session_01Utp6Cbvcmv8YWFhFJwzjKL (seat) · dev thread session_01Utp6CbNMpDS92ifzhDw9vf
Account: os-bill
Branch: claude/project-thread-egpm9z (harness-pinned thread branch; platform exception to claude/issue-<n>-<slug>)
Worktree: objectstack-issue-29425
Domain: domain:server
Seat: domain:server#2
File surface: the flow start doors PR #29365 covered and their shared helper, with tests; a hand-written docs sentence this makes false; one changeset .changeset/29425-declared-record-input.md. Exact files named in the dev's first report. ⛔ packages/spec/**, ui/**, apps/**, skills/**, docs/adr/**, content/docs/releases/**, .claude/** (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default tier (opus) — dispatch-gates --tier: no path-derived mandate, effort: high
Clause-②: yes expected (narrowing) — a start whose declared record input the caller cannot read is refused before the run exists; an undeclared input keeps today's rule
Metadata-protocol: none (the declaration is #29442's, merged)
Responsibility: a declared record-id start input is not loaded in the caller's scope at the doors that start a flow by name | #29365's helper and refusals (reused) | flow authors who declare a record input; callers starting such flows
Thread-read: 6663860762
Premise: read, to be measured first — at 2ffdb649: #29442's key is on main; the start doors judge only inputs the definition visibly reads as a record id (#29365)
Serial constraints cleared: #29404 (flow record nodes) merged 2026-11-02T16:02Z, a base, not a wait. No sibling seat claims the start doors.

Handover: from domain:server#5; the maintainer kept one server seat 2026-11-05T16:41Z.

Order: project file server-seat2/dispatch-29425.md, delivered as the card thread's opening message.

domain:server#2 · os-bill · session_01Utp6CbNMpDS92ifzhDw9vf
os-dev-report

{
  "issue": 29425,
  "status": "done",
  "branch": "claude/project-thread-egpm9z",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/30628",
  "session": "session_01Utp6CbNMpDS92ifzhDw9vf",
  "premise_still_valid": true,
  "summary": "Letter A server half. flowDeclaredRecordReads (packages/runtime/src/flow-start-admission.ts, declaredReadsOf) now adds an input's objectName declaration as one read of the declared object (one id), beside every read the definition makes in plain sight (union, seat-ruled), followed into subflow/map callees and not withdrawn by a loop/map rebinding the name. No door changed: all three doors (trigger route both spellings automation.ts:2824, flow action REST + MCP run_action action-execution.ts:2685, declared flow endpoint endpoint-executor.ts:590) already ask refuseUnreadableFlowStartRecords, the #29365 helper. Seat-authorised minimal spec edit: the variables.objectName liveness row flips planned+authorWarn to live and the describe/docblock drop their planned sentences, as both texts ordered for the reader's commit; generated reference docs and liveness counts regenerated. flows.mdx callout replaced by the rule. Shipped flows declaring the key: 0, so no ! in the title.",
  "tests": "New describe 7 in packages/runtime/src/flow-start-declared-record-reads.test.ts (the #29365 harness): per door (trigger, legacy trigger, endpoint, REST action, MCP run_action) readable -> run; unreadable and nonexistent -> 404 RECORD_NOT_FOUND, execute never called; object/list/boolean -> 400 naming the input, nothing loaded; undeclared control -> run as today; plus reading, union, callee, loop-rebind, system-principal pins. 90/90 on 469106e8f. Ablation 1 (--delete the declaration add, blob 2b18eb885049 -> 945bcd4535b1): 30 failed / 60 passed; ablation 2 (declaration replaces visible reads, -> cbe9b748c523): 2 failed / 88 passed (the union pins); both restored, blob == HEAD, git diff HEAD empty; src import, no dist leg. runtime full suite (c55e8047): 547 files, 9911 passed / 19 skipped. lint full suite (469106e8f): 195 files, 8103 passed. runtime + lint typecheck exit 0. eslint --no-inline-config on 5 changed files exit 0.",
  "gates": "dispatch-gates --commands --repo objectstack-ai/objectstack on 469106e8f: 105 commands, all exit 0 (stdin /dev/null, exit captured before any pipe); --ran: 105 derived, 105 run, 0 NOT-MEASURED, 0 UNRUN. Pre-merge head c55e8047 had 3 prerequisite exit-3s (teardown self-test shallow; skill-examples client-react unbuilt; dual-build-cjs-loads unbuilt), all 0 after closure build. spec check:generated: 14/14 current. CI check-runs: not read at report time.",
  "dogfood_battery": "469106e8f · os-verify-lock: VERDICT command-exit 0 · Test Files 420 passed, 3 skipped (423) · Tests 3496 passed, 36 skipped (3532) · no failures",
  "mcp_calls": "6 — mcp__github__issue_read x5 (#29425 get, #29425 get_comments twice, #29442 get, #29404 get), mcp__github__pull_request_read x1 (#29365 get_files); no write tool",
  "api_writes": "2 — relay pr_create (POST /repos/objectstack-ai/objectstack/pulls, run 42087715755, body read back identical); this os-dev-report comment via post-stamped",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    "carrier: none · noted, not filed — an input declared one id (objectName) that the definition also reads as a list (filter.id.$in) can never be satisfied: every start is refused 400 (loud, not silent); a lint candidate",
    "carrier: none · noted, not filed — objectName: 'global' passes the spec name pattern, and the shared subject load treats global / * as the object-less action key and loads nothing, so such a declaration is not judged; same pre-existing behaviour as a visible read of an object named global"
  ],
  "files_changed": [
    ".changeset/29425-declared-record-input.md",
    "content/docs/automation/flows.mdx",
    "content/docs/references/api/automation-api.mdx (generated)",
    "content/docs/references/automation/flow.mdx (generated)",
    "packages/lint/src/lint-liveness-properties.test.ts (forced test edit)",
    "packages/runtime/src/action-execution.ts (docblock)",
    "packages/runtime/src/flow-start-admission.ts",
    "packages/runtime/src/flow-start-declared-record-reads.test.ts",
    "packages/spec/liveness/flow.json",
    "packages/spec/liveness/state-counts/flow.md (generated)",
    "packages/spec/src/automation/flow.zod.ts (describe/docblock)"
  ],
  "line_budget": "417 changed lines (+338 / -79), 11 files, vs precedent 967 / 8",
  "deviations": [
    "packages/spec touched (liveness row, describe/docblock, generated artifacts): authorised by the seat 17:04Z after the stop-and-ask; the order listed packages/spec/** as forbidden.",
    "packages/lint/src/lint-liveness-properties.test.ts edited (test-only, outside the named surface): two pins read the shipped planned state of the flipped row; the control now uses the app navigation dataSource row.",
    "At the action doors a 400 for a non-id value is VALIDATION_ERROR from the action's typed param contract (ADR-0104 D2), which answers before the start check; trigger and endpoint answer VALIDATION_FAILED. Pinned per door; the describe and docs say 400 naming the input.",
    "runtime typecheck first failed on an unbuilt @objectstack/driver-turso (a kernel test import outside the runtime^... closure); built it, exit 0. Not a change in this diff.",
    "Merged origin/main (22 commits) before opening; the merge-driven regeneration of content/docs/references/api/automation-api.mdx is its own commit."
  ]
}

Stamped 2026-11-05T18:49Z.

Generated by Claude Code

domain:server#2 · os-bill · session_01Utp6Cbvcmv8YWFhFJwzjKL

Landed · 2026-11-05T19:50Z

Reading	Value
PR #30628	merged 2026-11-05T19:43Z, merge commit `b90a6f7c`, reviewed head `469106e8` (seat ACCEPT 6666939763)
Review	schema face ⇒ `CONTRACT_REVIEW_TIER`, record 6666908076 (PASS); remainder `TIER_DEFAULT` in the seat ACCEPT. `Clause-②: yes (narrowing)`
#29425	letter A delivered and the card closed by `Fixes #29425` (C was withdrawn, 6663860762): a flow start input that declares `objectName` is loaded in the caller's own scope at every door that starts the flow by name (trigger route, flow actions over REST and MCP, flow endpoints); an unreadable id answers 404, a non-id value 400 naming the input; declared and visible reads are combined. The spec liveness row is now `live`.
Next	#30633 (lint: `objectName: 'global'` and a declared single id read as a list)
Release	rides the next release by its changeset (BREAKING banner, patch)

State change: pm:dispatched removed.

Navigation Menu

Repository navigation

[Decision] flows and records: may a flow start input declare a record reference (A), and does a non-system create stop choosing the new record's id (C)? #29425

Maintainer quick-read

Options

What the ruling binds

Workload of the letter

Execution

Needs decision · #29425 letter C · 2026-11-02T15:23Z

What the ruling binds

Workload of the letter

Execution

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Decision] flows and records: may a flow start input declare a record reference (A), and does a non-system create stop choosing the new record's id (C)? #29425

Description

Maintainer quick-read

Options

Activity

zhuangjianguo commented on Nov 2, 2026

zhuangjianguo commented on Nov 2, 2026

What the ruling binds

Workload of the letter

Execution

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

Needs decision · #29425 letter C · 2026-11-02T15:23Z

objectstack-fleet commented on Nov 5, 2026

What the ruling binds

Workload of the letter

Execution

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions