Card 09 — F9 activation · F3/F4/F10–F14 scheduled jobs · F16 executed upload (M3)

The last card of M3, and the one that has been blocked since 2026-09-07 on four decision cards. All four were ruled by the maintainer on 2026-09-09 (常设决裁批第 1 批), so this card is now dispatchable.

Card spec: docs/backlog/09-post-signature-jobs.md — read it in full; this issue carries only the rulings and the increment.

Why this card matters more than its size suggests

src/flows/ today holds exactly three flows: intake, approval, signature-record. Every scheduled job in this product is missing. Measured on origin/main @ 5d5a254:

obligation-due.flow.ts    (F10 obligation due)      absent
payment-overdue.flow.ts   (F11 payment overdue)     absent
renewal-notice.flow.ts    (F12 renewal notice)      absent
expiration-sweep.flow.ts  (F13 expiry sweep)        absent
legal-review-sla.flow.ts  (F3  legal review SLA)    absent
turn-stalled.flow.ts      (F4  stalled turn)        absent

⇒ A contract lifecycle product that never tells anyone that anything is due. M3's own acceptance criterion is 「到期、逾期提醒在收件箱可见」 — that half has never been built, which is why M3 cannot be signed off. This card is the whole reminder layer.

The four rulings this card implements — adjudicated, ⛔ not re-openable

Maintainer, 2026-09-09, verbatim: 「第 1 批平台的问题去平台修，业务的问题按照你的意见。」

[Decision] DESIGN.md §03 requires a termination reason but declares no field for it #6 → A. clm_contract gains termination_reason (textarea, requiredWhen status is terminated). Never on the intake form; asked once, at termination. Declare it in code here; the §03 field-list text is a separate governed PR (see Serial constraints).
[Decision] Two states in DESIGN.md §03 are dead ends: a started obligation cannot go overdue, a partly paid instalment cannot be completed #10 → 1A + 2A. Two state edges are added: in_progress → overdue on clm_obligation.status, and partial → paid plus partial → overdue on clm_payment_plan.status. Today the hook has in_progress: ['done','waived'] and partial: [].
⇒ The daily sweep MUST include in_progress rows when flagging overdue. Excluding them is the silent under-reporting [Decision] Two states in DESIGN.md §03 are dead ends: a started obligation cannot go overdue, a partly paid instalment cannot be completed #10's own analysis named as the failure to avoid.
Decision: where does the intake-captured payment arrangement F9 reads actually live? #14 → A. F9 activation does not expand any intake-captured payment arrangement. ⛔ Do not leave a hook, a TODO, or a comment anticipating one — that re-creates in another form the declaration just deleted. Payment plans are created by finance after activation, on the contract's own tab (§04 already grants finance RCU).
[Decision] §09 要「各段时长」和「超 SLA」，但语义层算不出时间差——两问共用一个补法 #31 → 1C + 2B. The per-stage duration metric is blocked on the platform (objectstack-ai/objectstack#16737) and is ⛔ not to be worked around here — no daily job that stamps computed durations onto a field. F3 uses a fixed threshold, and the widget title must state its own threshold (「审查超 30 天」, ⛔ never 「超 SLA」): the nine contract types' real SLAs are 2/3/5/10 days, so a title claiming "over SLA" over a 30-day filter would be false.

Scope

Per the card file: src/objects/contract.hook.ts (F9, F14), the six flows above, and the executed_upload action (F16, §13 Q8) — a records/legal-only action creating an already-executed contract straight into active with is_backfilled = true, skipping review and approval, fully audited.

⚠️ executed_upload already appears in src/objects/contract.object.ts (2 hits) and src/translations/en/objects.contract.ts (1 hit). Establish what is already declared before writing anything — it may be a declared action with no implementation, which is this repo's #38 shape.

All scheduled flows runAs: 'system' with the reason stated; os lint must show no flow-runas-unscoped. Dates: the platform CEL has no daysBetween (§12 gap #7) — compute windows in the job's script/query filters, ⛔ never in formula fields. overdue is written by these jobs only. F12's 「发起续签」 is an action pre-filling a new draft with renewed_from. F9 writes back to crm_contract only where the record carries that link.

Out of scope: the e-signature callback (card 12). Anything in DESIGN.md — see below.

Declared rider: `DESIGN.md` §09 wording — ⛔ NOT yours

⛔ Do not touch DESIGN.md. A separate governed PR (chain head #6) carries every design-doc edit for these rulings, including §09. If your work suggests a §09 change, report it; do not make it. Two PRs editing that file is a conflict this card exists to avoid.

Acceptance

Gates: pnpm validate && pnpm lint && pnpm typecheck && pnpm lint:i18n-gate all exit 0, exit codes captured before any pipe. New user-facing strings need both locale bundles or the i18n gate goes red.
With the seeds, one run of each job produces the expected inbox notifications for the seeded due/overdue records and flips exactly those statuses — and no others. Report the counts before and after, from the database, not from the log.
⛔ Do not trust a loader summary over the table. This repo has a live finding (objectstack#17177) where the seed log says a column is NULL while it holds a value. Read the rows.
Browser (AGENTS.md is binding: a card touching a human surface is not done until driven in a real browser): the inbox notifications must be seen. Note that reaching the app requires the README operator setup — three requester accounts, clm_requester grants, the dev admin in clm_admin — without which navigation is empty; that is documented product behaviour (decision card [Decision] pnpm demo 开箱即用时没有任何账号能打开「我的合同」——要不要让脚本建账号，与 #11 第一问耦合 #28), not a regression.
A boot that logs warnings is not a passing boot. ⚠️ On 17.4 there are two known platform ERROR lines on any boot after the first (objectstack#17175, objectstack#17176) — those are pre-existing and not yours. Anything else is.
No changeset: this repo has no changeset gate (no changeset-check.yml, no .changeset/, no @changesets dep). ⛔ Do not create one.

Session: session_01R3n3GGzobdegM4HUzah1iR
Branch: claude/issue-39-post-signature-jobs
Worktree: hotclm-issue-39 (dedicated, off origin/main @ 5d5a254)
Domain: repo:hotclm (single-lane repo — no domain:* axis)
File surface: src/flows/** (six new scheduled flows + index.ts) · src/objects/contract.hook.ts · src/objects/contract.object.ts (the termination_reason declaration and the F16 action) · src/translations/{en,zh-CN}/** (any new user-facing string needs both) — ⛔ DESIGN.md is explicitly OUT (stop on breach; explain in the report)
Container & model: L, mode:subagent, model: default judgement tier — scripts/pm/dispatch-gates.mjs is objectstack-side tooling with no reading to give in this repo, so the tier is the PM's explicit decision under the "M/L and any card carrying design judgement" rule, ⛔ not a quoted --tier line.
Clause-②: no — an application repo implementing its own scheduled flows neither relaxes an acceptance set nor widens a published contract surface. This repo consumes @objectstack/*; it produces none.
Thread-read: none (no comments on this card at claim time, 2026-09-09T15:0xZ)
Serial constraints cleared: the governed design-doc PR dispatched in the same batch (chain head #6, branch claude/issue-6-design-rulings) is the only sibling in flight. File surfaces are disjoint by construction: that PR touches DESIGN.md and nothing else; this one touches src/ and nothing else. ⛔ Neither may cross into the other's file — that is why §09's rewording sits over there and the termination_reason code declaration sits here. Zero other pm:dispatched cards, zero open PRs (origin/main @ 5d5a254, 2026-09-09T15:0xZ).

Why the two halves are split rather than folded: the design-doc edits touch DESIGN.md §01–§04, which AGENTS.md makes a governed surface — that PR is ACCEPTed and left open for the maintainer to merge. Folding them together would drag this whole card's code onto the human-merge path for the sake of four lines of prose. Mixed diffs are ⛔ not judged proportionally, so they are two PRs.

Generated by Claude Code

docs(design): record four maintainer rulings in DESIGN.md §03, §06 an…

WIP: card 09 scheduled jobs — INCOMPLETE AND UNREVIEWED

Dev死于容器重启；工作树已抢救，未丢。重新派发中。（Rescue record — this is not a report and not a review.）

The dispatched dev's container was restarted mid-task at ~2026-09-09T16:0xZ. The host reported the task stopped, so this is an established death, ⛔ not an inference from silence: no report will ever arrive for that run.

Salvage — the tree survived, the process did not

⛔ Death does not mean nothing landed. Before anything else, the dispatch worktree was checked, and it was still on disk with substantial uncommitted work. Ownership gate passed first: the owning agent is confirmed dead by the host, so nothing live could have been writing to that tree.

Observed at rescue time — facts about the tree, ⛔ not claims about behaviour:

Reading	Value
Remote branch before rescue	`5d5a254` — origin/main's tip; not one commit had been pushed
Tracked files modified	13
Untracked files added	10
Diff size (tracked half)	539 insertions / 32 deletions
Flows present	all six card 09 requires, plus `executed-upload.flow.ts` (F16), a `_daily-sweep.ts` helper, and `contract-backfill.actions.ts`

⇒ WIP commit bebd0f7d8e5a7eb7b0b7f2beadd06a466ef3d2d8, pushed to claude/issue-39-post-signature-jobs, subject WIP: card 09 scheduled jobs — INCOMPLETE AND UNREVIEWED.

⛔ What that commit is NOT

It was never gate-run, never browser-driven, and never reported on. Nothing in it has been checked against the four rulings it is meant to implement (#6 → A, #10 → 1A+2A, #14 → A, #31 → 1C+2B). It is a rescue of a working state, not a deliverable.

The successor dev diffs it and re-verifies it; ⛔ it does not build on top of it unreviewed. .counts.local.mjs in that commit is a scratch file and must not survive into the PR.

Claim continuity

The claim on this card (comment 5604485409) still stands and still names branch claude/issue-39-post-signature-jobs. The card keeps pm:dispatched and its assignee — this is a re-dispatch onto the same claim, ⛔ not a release and re-take, so no Release: line is written and no second claim is posted.

Container & model unchanged: L, mode:subagent, default judgement tier.

Rescue performed by the PM seat, session_01R3n3GGzobdegM4HUzah1iR, at 2026-09-09T16:0xZ.

Generated by Claude Code

os-dev-report

{
  "issue": 39,
  "status": "done",
  "branch": "claude/issue-39-post-signature-jobs",
  "pr": "https://github.com/objectstack-ai/hotclm/pull/42",
  "premise_still_valid": true,
  "rescued_commit": "bebd0f7 audited file by file against `git diff 5d5a254..bebd0f7`, then KEPT with four corrections. Kept as authored: all six scheduled flows, `_daily-sweep.ts`, `executed-upload.flow.ts`, `contract-backfill.actions.ts`, the `contract_activate` (F9) and `contract_archive` (F14) hooks, both #10 state-machine edges, the `termination_reason` declaration, the seed and both translation bundles — each re-derived against the four rulings and then RUN. Deleted: `.counts.local.mjs` (0485f7e), the scratch file the rescue swept up; it is not in the PR. Rewritten: three `end{outcome:'refused'}` nodes into throwing `script` nodes (75d300c), `termination_reason`'s field-level security (c1ae888), the F14 freeze allow-list (c1ae888), the detail page's header action list (5e61d73). Nothing was discarded wholesale: the graphs, filters and windows were correct, and running them is what found the three defects the gates could not.",
  "summary": "Card 09's reminder layer lands: six scheduled flows (F3, F4, F10-F13) built on a shared `sweepFlow` that sets `runAs: 'system'` once and contains every per-row body in a `try_catch`, F9 `contract_activate` and F14 `contract_archive` on the contract hook, and F16 `executed_upload` as a flow-backed list-toolbar action plus F12's `start_renewal` button. All four rulings are implemented and measured: #6 declares `termination_reason` and the state machine refuses `active -> terminated` without it; #10 adds `in_progress -> overdue` and `partial -> paid|overdue` AND the two sweeps that select those rows; #14 leaves F9 expanding no payment arrangement, with no hook, TODO or comment anticipating one; #31 keeps F3 on a fixed 30/60-day threshold whose every string states that threshold and stamps no computed duration anywhere. Three defects in the inherited work, all gate-green and all found only by driving a booted app: `termination_reason` was swept into the group-derived FLS lock so nobody could ever write it, making `active -> terminated` unreachable through any surface; F14's freeze allow-list named the platform's audit columns `modified_at`/`modified_by` instead of `updated_at`/`updated_by`, so it refused the `summary` edit it exists to allow; and `start_renewal` was declared, translated and wired but never named in `PageHeaderProps.actions`, so it had no button. A fourth finding is a platform gap, reported not patched: `end` nodes carrying `outcome: 'refused'` are inert on 17.4.0 (`objectstack-ai/objectstack#15788`, open) — a refused backfill answered HTTP 200 'Executed contract recorded.' with zero rows written — so both action-launched flows now refuse through the throwing-script idiom `contract_intake` already uses in the same directory. No governed surface touched; no changeset.",
  "gates": {
    "command": "cmd > file 2>&1; EXIT=$?  (exit code captured before any pipe), at 83eda0a",
    "pnpm validate": 0,
    "pnpm lint": 0,
    "pnpm typecheck": 0,
    "pnpm lint:i18n-gate": 0,
    "lint warnings": "21 warning(s), 5 suggestion(s) — byte-identical to `pnpm lint` on the baseline worktree at origin/main 5d5a254, so this PR adds none",
    "flow-runas-unscoped": 0,
    "i18n coverage": "0 missing keys across 2 locale(s) (en, zh-CN)",
    "boot": "same command, empty DB, both trees: baseline 5d5a254 = no boot-diagnostics block, 3 ERROR lines (_objectstack_sequences x2, sys_oauth_resource unique), `4 flow(s) 3 bound to triggers`; this branch = no boot-diagnostics block, the SAME 3 ERROR lines, `12 flow(s) 9 bound to triggers`. The two known platform ERRORs (objectstack#17175, #17176) are proven pre-existing by their presence on the baseline. Nothing else."
  },
  "tests": "Counts read with better-sqlite3 opening the driver's own SQLite file read-only — never from a loader summary or a run log. Corpus: `pnpm demo` on an empty database, 120 contracts / 200 obligations / 300 instalments / 60 reviews / 30 signature rounds / 25 deviations / 40 counterparties, after the README operator setup (3 requester accounts, `clm_requester` grants, dev admin in `clm_admin`; owner_id dealt 43/43/34 exactly as documented). Jobs run one at a time via POST /api/v1/automation/{name}/trigger. RUN 1 (corpus as seeded): legal_review_sla selected 10 over-30 / 0 over-60 and notified 5 (only 5 of the 10 carry a legal_owner; the other 5 took the partitioned nobody-to-tell edge); turn_stalled 1 selected 1 notified; obligation_due 2/0/0; payment_overdue 0 due-hop + 18 arrears, acted 18, payments partial 18->0 overdue 12->30 and nothing else moved; renewal_notice 21 selected 0 acted — independently confirmed correct by SQL over the same rows (`date(end_date,'-'||renewal_notice_days||' day') <= date('now')` matched 0 of 21; the 11 contracts already in window carry the seed's is_expiring=1); expiration_sweep 0 selected. RUN 2, after placing 5 probe rows for the windows the corpus leaves empty: obligations pending 77->76, in_progress 11->10, overdue 10->12, done 90->90, waived 15->15 (the +2 are exactly the in_progress and pending probes — the in_progress one IS ruling #10 1A); payments planned 150->149, due 30->30, overdue 30->31 (one instalment took planned->due->overdue in a single run, which is why F11's stages are ordered); contracts active 60->59, expired 8->9, draft 10->11, every other status unchanged; is_expiring 11->14; renewed_from rows 0->1 (DPA-2026-0011, start_date the day after the old term ended, end_date 36 months less a day, owner and legal_owner carried); notifications 26->37 (+11 = 5 F10 + 1 F11 + 3 F12 + 2 F13) and inbox rows 44->61 (+17, because F11/F12/F13 each fan out to two recipients — one {recipients.userIds} template resolving to a list). RUN 3, every job a second time: all six acted 0, zero status changes, no second renewal draft, is_expiring unchanged at 14; the only new rows were 9 notifications from the repeating reminder stages, which is what a daily reminder is. HOOKS/ACTIONS: manual `status: overdue` insert refused 422; F9 on signing->active stamped activated_at, opened exactly ONE kind=renewal obligation with due_date 2027-08-10 = end_date 2027-09-09 minus 30 days, and left payment plans at 5->5 for that contract and 300->300 overall (ruling #14 measured, not asserted); #6 terminate with no reason 422 / with a reason 200 + closed_at stamped; F14 archive_no on active 422, on terminated 200 + archived_at, then summary edit 200 and title edit 422 'Fields refused: title'; F16 produced MSA-2026-0017 born active with is_backfilled=1, category/direction/execution_formalities stamped from the type, version_count 1 with a final_signed v1, created_by = the calling admin (audit survives the runAs elevation), and 0 payment plans + 0 obligations; F16 refusals (future signing date, blocked counterparty) 400 carrying the author's own message with 0 rows written; start_renewal pressed twice gave AMD-2026-0005 then 400 naming AMD-2026-0005. BROWSER (Chromium 1194 at /opt/pw-browsers/chromium-1194/chrome-linux/chrome, no `playwright install`): signed in at /_console/, landed on the clm app with full five-section navigation; the inbox panel was SEEN reading '18 total · 18 notifications · 0 pending approvals' and rendering rows from every job that fired, including 'In legal review over 30 days: …' whose body reads 'This is a fixed 30-day threshold, not this contract type's own review SLA' (ruling #31 2B, seen in the product); the Terminate dialog renders the required Termination Reason textarea with its help text; Backfill Executed Contract appears on the contract-register toolbar with all its params and a file drop zone; Start Renewal appears on the record header after 5e61d73 and did not before it. Console: one 404 for a static asset, present on the baseline too; no application errors. NO ABLATION RUN: this card authors no gate or guard whose failure needs proving. The equivalent evidence is the before/after pair carried by each of the three fixes — 403 then 200 for termination_reason, 'Fields refused: updated_at' then summary-200/title-422 for the archive freeze, header-without-button then header-with-button for start_renewal — each measured on a booted app rather than reasoned about.",
  "files_changed": 26,
  "mcp_calls": "6 — issue_read(get), issue_read(get_comments), search_issues(objectstack, dedupe), list_issues(hotclm, dedupe), search_issues(hotclm, dedupe), issue_write(create #41). The PR was created and read back through the REST API with the ambient token, not through MCP.",
  "deviations": [
    "File surface wider than the claim listed. The claim named src/flows/**, src/objects/contract.{hook,object}.ts and src/translations/**. The PR also touches src/actions/** (F16's action and F12's button — the card's own scope), src/data/** (the seed needs a termination_reason on its four terminated contracts or they are refused), src/pages/contract_detail.page.ts (without it F12's button is unreachable) and src/profiles/{_grants,requester,finance}.ts (without it termination_reason is unwritable by anyone). No governed surface (DESIGN.md · AGENTS.md · CLAUDE.md · LICENSE · CHANGELOG.md · docs/design/**) is touched, so the PR stays on the seat's autonomous merge path.",
    "Refusal spelling changed from the spec's declared shape. `end` nodes with `outcome: 'refused'` parse and validate but do nothing on 17.4.0 (objectstack#15788, already open upstream — not filed again). Both action-launched flows use the throwing-`script` idiom `contract_intake` already ships in the same directory. When the engine half lands they can go back.",
    "Five probe rows were created in the demo database to reach the windows the seeded corpus leaves empty (F13's two stages, F10's arrears stage, F12's write path, F11's planned->due hop). They are runtime fixtures in a gitignored local database, not repository changes."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #41: `pnpm demo` stops being re-runnable once these jobs have run — the fixture re-asserts `active` on a contract F13 expired and `planned` on an instalment F11 flagged, both state machines correctly refuse, and the second seed reports 818 ok / 2 errors. Card 08's seed; three options laid out, no recommendation strong enough to act on, and it is a §10 question.",
    "noted, not filed — needs the maintainer, not a developer: §06 F16 says the backfill action is available to 「clm_records.access 与 clm_legal.access」, records OR legal, and `requiredPermissions` is an AND with no capability held by both sets. The action gates on `execute_contract` (records + admin); legal loses this one button and keeps every other path. Closing it needs either a new §04 capability granted to both sets (a governed decision) or an OR-form gate upstream. The PM has the context to raise it as a needs-user-decision card; carrier: the §04 chain, which is where §06 F16's own sentence lives.",
    "noted, not filed — DESIGN.md §06 F14 says 「此后除 notes 外只读」 but §03 gives clm_contract `summary` and puts `notes` on the child objects. The hook keeps `summary` open, the only reading that leaves an archived record annotatable. A §06/§03 wording fix; DESIGN.md is explicitly out of scope for this card, and the governed doc PR (chain head #6) is the carrier already in flight for exactly this class of edit.",
    "noted, not filed: F12 sets `is_expiring` and nothing ever clears it, so a contract that is renewed and re-termed keeps the flag. Harmless today — the flag's only reader is F12's own exclusion filter — and it has no carrier yet; it belongs with whatever card gives renewal a second act. Carrier: none."
  ]
}

Generated by Claude Code

Review: ACCEPT — PR #42, head 83eda0a, CI 2/2 Validate completed/success. Merging under the AGENTS.md delegation. Readings below are mine, taken against the tree and GitHub, ⛔ not read off the report.

⛔ First: the file surface in my own claim was too narrow, and that is my error

My claim declared src/flows/** · contract.hook.ts · contract.object.ts · src/translations/**. The diff also touches src/actions/, src/data/, src/pages/contract_detail.page.ts and src/profiles/.

That is not a breach by the dev — it is a defective declaration by me. The card's own scope names the executed_upload action (which lives in src/actions/), ruling #6 cannot be delivered without the FLS change in src/profiles/, and a declared action with no button is not delivered. I wrote a surface narrower than the card I was dispatching. Recorded here rather than charged to the run.

Independent verification

Check	Method	Result
Head binding	`git rev-parse FETCH_HEAD` vs PR object `head.sha`	both `83eda0ab05bb…`; checks bound to that head, ⛔ not to an event's SHA
Path surface	`git diff --name-only origin/main...FETCH_HEAD`	26 files, all under `src/`
Governed surface	grep of that list against the `AGENTS.md` governed set	0 hits ⇒ the seat's merge delegation applies
Rescue scratch file	`git ls-tree -r FETCH_HEAD \| grep counts.local`	0 — `.counts.local.mjs` is gone (`0485f7e`)
`Fixes` lines	PR body	`#39`, `#6`, `#10`, `#14` — and ⛔ not `#31`, which is correct: that card stays blocked on the platform
Commit story	`git log origin/main..FETCH_HEAD`	`bebd0f7` (rescue) then five commits, each doing one named thing

The audit of the rescue paid for itself — three defects that passed every gate

I dispatched this as "audit bebd0f7, do not trust it". It found three defects in the inherited work, all of which were green on all four gates:

termination_reason could not be written by anybody. Spot-checked in the diff: _grants.ts derives the platform-only write lock from fieldsInGroups(['routing','lifecycle','ai']), and the field had been put in lifecycle — right for the nine hook-stamped timestamps there, wrong for the one a person answers. So the state machine required a reason FLS forbade supplying, and active → terminated was unreachable through any surface. The measured 403 is recorded at the site, and the fix is scoped to the two sets §04 gives terminate_contract. This is exactly the shape ruling [Decision] DESIGN.md §03 requires a termination reason but declares no field for it #6 exists to close, delivered inverted — a required field nobody may write is a closed door, not a requirement.
The F14 archive freeze refused the one field it exists to keep open — OPEN_AFTER_ARCHIVE spelled modified_at/modified_by; this object carries updated_at/updated_by. Spot-checked: the corrected list and the measured 422 Fields refused: updated_at are both at the site.
start_renewal had no button — declared, translated, wired, and absent from the header's action list.

None of these was findable by reading; all three needed the thing to be run. That is the difference between a report and a verification.

The platform gap: verified independently, not taken on trust

The PR reports that a flow end node carrying outcome: 'refused' answers HTTP 200 success: true while writing zero rows on 17.4.0, and cites objectstack-ai/objectstack#15788 as the open upstream card. I read that issue: it is open, domain:services, pm:blocked, titled "honour outcome: 'refused' on the flow end node — a terminal refused run status…", and it is explicitly lane (2) of a maintainer ruling whose lane (1) — the spec half — is what shipped. So the diagnosis is exactly right: the schema accepts the shape and the executor does not honour it.

⇒ report, never patch correctly applied, and the workaround chosen (a throwing script node) is the form contract_intake already uses next door, ⛔ not a novel invention.

The four rulings, each with a measurement rather than an assertion

[Decision] DESIGN.md §03 requires a termination reason but declares no field for it #6 → A: terminate with no reason → 422; with a reason → 200, closed_at stamped.
[Decision] Two states in DESIGN.md §03 are dead ends: a started obligation cannot go overdue, a partly paid instalment cannot be completed #10 → 1A: a started, past-due obligation was flagged — in_progress 11 → 10, overdue 10 → 12. That single row is the ruling. The sweep selects pending and in_progress, which is the silent under-reporting [Decision] Two states in DESIGN.md §03 are dead ends: a started obligation cannot go overdue, a partly paid instalment cannot be completed #10 named as the thing to avoid.
[Decision] Two states in DESIGN.md §03 are dead ends: a started obligation cannot go overdue, a partly paid instalment cannot be completed #10 → 2A: 18 partial rows past their planned date → overdue in one run.
Decision: where does the intake-captured payment arrangement F9 reads actually live? #14 → A: activating a contract moved obligations 0 → 1 and payment plans 5 → 5, total 300 → 300. A negative result, measured rather than promised.
[Decision] §09 要「各段时长」和「超 SLA」，但语义层算不出时间差——两问共用一个补法 #31 → 1C+2B: the inbox string reads "In legal review over 30 days" and the body says "a fixed 30-day threshold, not this contract type's own review SLA". ⛔ No job stamps a computed duration anywhere.

Run 3 is the one I would have asked for and did not: every job a second time, acted 0 across all six, no second renewal draft, is_expiring unchanged — with only the reminder stages emitting, which is what a daily reminder should do. Idempotency proved by running it, not argued.

And M3's acceptance — 「到期、逾期提醒在收件箱可见」 — has a browser behind it: the inbox panel reading "18 total · 18 notifications" with rows from every job that fired. That criterion has never been demonstrable in this repo before, because the jobs did not exist.

Accepted with follow-ups, which are mine now

## Acceptance notes carries three items I am acting on rather than leaving in a PR body:

executed_upload gates on records-only where §06 F16 says records OR legal — requiredPermissions is an AND and no capability is held by both sets, so legal loses this one button. That is a declared-≠-enforced gap against §06, correctly not decided by a dev. Filing it.
§06 F14 says 「此后除 notes 外只读」 and clm_contract has no notes field. A §06/§03 wording inconsistency; the hook keeps summary open, which is the only reading leaving an archived record annotatable. Filing it.
pnpm demo stops being re-runnable once the daily jobs have run: the seed re-asserts statuses the state machines refuse to go back to #41 (pnpm demo stops being re-runnable once the jobs have run) is filed, reproduced, and carries three options. I am triaging it into the decision box.
is_expiring is never cleared — noted only, harmless today, correctly not filed.

Landing

CI green on the head ✓ · ACCEPT recorded ✓ (this comment) · no governed surface ✓ (verified, not asserted) · not a second REWORK round ✓ — the first run died before any review, so this is review round 1. All four AGENTS.md conditions hold ⇒ squash-merge. This repo runs no merge queue, so the direct squash AGENTS.md specifies is the sanctioned path.

Generated by Claude Code

Navigation Menu

Repository navigation

Card 09 — F9 activation · F3/F4/F10–F14 scheduled jobs · F16 executed upload (M3) #39

Why this card matters more than its size suggests

The four rulings this card implements — adjudicated, ⛔ not re-openable

Scope

Declared rider: `DESIGN.md` §09 wording — ⛔ NOT yours

Acceptance

Related

Salvage — the tree survived, the process did not

⛔ What that commit is NOT

Claim continuity

⛔ First: the file surface in my own claim was too narrow, and that is my error

Independent verification

The audit of the rescue paid for itself — three defects that passed every gate

The platform gap: verified independently, not taken on trust

The four rulings, each with a measurement rather than an assertion

Accepted with follow-ups, which are mine now

Landing

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Card 09 — F9 activation · F3/F4/F10–F14 scheduled jobs · F16 executed upload (M3) #39

Description

Why this card matters more than its size suggests

The four rulings this card implements — adjudicated, ⛔ not re-openable

Scope

Declared rider: DESIGN.md §09 wording — ⛔ NOT yours

Acceptance

Related

Activity

zhuangjianguo commented on Sep 9, 2026

zhuangjianguo commented on Sep 9, 2026

Salvage — the tree survived, the process did not

⛔ What that commit is NOT

Claim continuity

claude commented on Sep 9, 2026

zhuangjianguo commented on Sep 9, 2026

⛔ First: the file surface in my own claim was too narrow, and that is my error

Independent verification

The audit of the rescue paid for itself — three defects that passed every gate

The platform gap: verified independently, not taken on trust

The four rulings, each with a measurement rather than an assertion

Accepted with follow-ups, which are mine now

Landing

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Declared rider: `DESIGN.md` §09 wording — ⛔ NOT yours