@@ -17,7 +17,7 @@
  */
 
 import { describe, it, expect } from 'vitest';
-import { ObjectStackDefinitionSchema, applyConversionsToStoredItem, type ConversionNotice } from '@objectstack/spec';
+import { ObjectStackDefinitionSchema, applyConversions, applyConversionsToStoredItem, type ConversionNotice } from '@objectstack/spec';
 import {
   applyArtifactForwardConversions,
   parseRangeFloor,
@@ -401,6 +401,108 @@ describe('the artifact door never turns an authored `hidden: true` into an unpub
   });
 });
 
+/**
+ * #15429 — the second member of the DEFAULT-FLIP class this door refuses.
+ *
+ * `flow-decision-mode-inclusive-explicit` writes `mode: 'inclusive'` onto an
+ * edge-branched `decision` with two or more conditioned out-edges, so a flow
+ * written while every true branch ran keeps that behaviour now that the
+ * traversal is exclusive. An omitted `mode` IS the exclusive gateway by the
+ * contract on `DecisionConfigSchema`, so the rewrite reinterprets a legal
+ * shape — sound only where the source's age is a fact (`os migrate meta
+ * --from 17`, the operator's assertion). At this door the trigger is the
+ * artifact's declared `engines.protocol` floor, and `^17.0.0` is what
+ * `create-objectstack` stamps: an app scaffolded today, authored against the
+ * exclusive contract, lands inside the window. Replaying the entry here would
+ * hand it an inclusive gateway it never asked for — the #17885 shape, on a
+ * key whose omission is the ruled default.
+ *
+ * Same four legs as the block above: SUBJECT (window open, no `mode`
+ * written) · the strict parse the door feeds · NEGATIVE (window shut) ·
+ * FIRING CONTROL (the entry WOULD rewrite this very fixture with the window
+ * open and no refusal, so the subject leg cannot pass vacuously).
+ */
+describe('the artifact door never writes `mode: inclusive` onto an authored exclusive decision (#15429)', () => {
+  /** One edge-branched decision with two conditioned out-edges and no `mode` — the shape the entry rewrites. */
+  const twoBranchDecisionDefinition = (protocolRange: string) => ({
+    manifest: {
+      id: 'app.example.leads', name: 'leads', version: '1.0.0', type: 'app',
+      engines: { protocol: protocolRange },
+    },
+    flows: [{
+      name: 'lead_verdict',
+      label: 'Lead verdict',
+      type: 'autolaunched',
+      nodes: [
+        { id: 'start', type: 'start', label: 'Start' },
+        { id: 'verdict', type: 'decision', label: 'Verdict?' },
+        { id: 'refuse', type: 'end', label: 'Refuse' },
+        { id: 'convert', type: 'end', label: 'Convert' },
+      ],
+      edges: [
+        { id: 'e1', source: 'start', target: 'verdict' },
+        { id: 'e2', source: 'verdict', target: 'refuse', condition: "lead.status != 'suspected'", label: 'Refuse' },
+        { id: 'e3', source: 'verdict', target: 'convert', condition: "lead.status == 'confirmed'", label: 'Convert' },
+      ],
+    }],
+  });
+  const ID = 'flow-decision-mode-inclusive-explicit';
+  const verdictNodeOf = (definition: unknown) =>
+    (definition as { flows: { nodes: { id: string; config?: Record<string, unknown> }[] }[] })
+      .flows[0]!.nodes.find((n) => n.id === 'verdict')!;
+
+  it('leaves the decision without `mode` on an artifact the retired window IS open for', () => {
+    const def = twoBranchDecisionDefinition('^17.0.0');
+    const result = applyArtifactForwardConversions(def, { runtimeSpecVersion: '17.4.0' });
+
+    // ⭐ ANTI-VACUITY: the window really is open on this input.
+    expect(result.verdict).toBe('converted-forward');
+    expect(result.authoredFloor).toBe('17.0.0');
+
+    const verdict = verdictNodeOf(result.definition);
+    expect(verdict.config, 'the authored exclusive gateway is untouched').toBeUndefined();
+    expect(result.notices.map((n) => n.conversionId)).not.toContain(ID);
+    // Copy-on-write: nothing was recognized, so the same reference comes back.
+    expect(result.definition).toBe(def);
+  });
+
+  it('registers the decision without `mode` — asserted AFTER the strict parse the door feeds', () => {
+    const def = twoBranchDecisionDefinition('^17.0.0');
+    const result = applyArtifactForwardConversions(def, { runtimeSpecVersion: '17.4.0' });
+    expect(result.verdict).toBe('converted-forward');
+
+    const parsed = ObjectStackDefinitionSchema.parse(result.definition);
+    const registered = verdictNodeOf(parsed);
+    expect(Object.keys(registered.config ?? {}), 'what registration receives').not.toContain('mode');
+  });
+
+  it('floor ^99.0.0 — the window is shut and nothing is replayed at all', () => {
+    const def = twoBranchDecisionDefinition('^99.0.0');
+    const result = applyArtifactForwardConversions(def, { runtimeSpecVersion: '17.4.0' });
+    expect(result.verdict).toBe('authored-current');
+    expect(result.notices).toEqual([]);
+    expect(verdictNodeOf(result.definition).config).toBeUndefined();
+  });
+
+  /**
+   * ⭐ FIRING CONTROL — the entry WOULD rewrite this exact fixture: the same
+   * bytes through the primitive with the retired window open and no refusal
+   * come back inclusive, with the entry's own notice. A door that had merely
+   * stopped recognizing the shape, or a fixture the entry never matched, would
+   * go green above and prove nothing; this leg is what makes the subject a
+   * reading of the refusal.
+   */
+  it('FIRING CONTROL — without the refusal, the same fixture IS rewritten to `mode: inclusive`', () => {
+    const notices: ConversionNotice[] = [];
+    const rewritten = applyConversions(twoBranchDecisionDefinition('^17.0.0'), {
+      includeRetired: true,
+      onNotice: (n) => notices.push(n),
+    });
+    expect(verdictNodeOf(rewritten).config).toEqual({ mode: 'inclusive' });
+    expect(notices.map((n) => n.conversionId)).toContain(ID);
+  });
+});
+
 describe('parseRangeFloor — the range spellings artifacts actually carry', () => {
   it.each([
     ['^17.1.0', [17, 1, 0]],
 
@@ -287,8 +287,30 @@ export function resolveInstalledSpecVersion(): string | null {
  *   materialization path, and `os migrate meta --from <=16`, where the
  *   operator asserts the source's age) — this door is neither, so it opts out
  *   rather than the entry ceasing to fire.
+ * - `flow-decision-mode-inclusive-explicit` (#15429, maintainer ruling
+ *   「跟主流对齐」): writes `mode: 'inclusive'` onto an edge-branched `decision`
+ *   (no `conditions` list) that has two or more conditioned out-edges, so a
+ *   flow written while every true branch ran keeps that behaviour now that the
+ *   traversal is exclusive (first true edge in declaration order). Both shapes
+ *   are legal and mean different things — an omitted `mode` IS the exclusive
+ *   gateway, by the contract on `DecisionConfigSchema` — so the rewrite is a
+ *   reinterpretation, sound only where "this source predates the flip" is a
+ *   fact. Here it is a guess: the trigger is the artifact's declared
+ *   `engines.protocol` floor, and `^17.0.0` is the range `create-objectstack`
+ *   stamps, so an app scaffolded today, whose author wrote two branches
+ *   against the contract that says an omitted `mode` is exclusive, lands
+ *   inside the window and would be handed an inclusive gateway it never
+ *   asked for — the ruled default made unobservable for every artifact-deployed
+ *   app. The entry is sound at exactly one seam: `os migrate meta --from 17`,
+ *   where the operator asserts the source's age and reviews the diff. The
+ *   automation engine's flow rehydration seam refuses it by id for the same
+ *   reason (`CONVERSIONS_NOT_REPLAYED_AT_REHYDRATION` in
+ *   `packages/services/service-automation/src/engine.ts`); this door does too.
  */
-const DEFAULT_FLIPS_NOT_REPLAYED_HERE: readonly string[] = ['app-hidden-to-unpublished'];
+const DEFAULT_FLIPS_NOT_REPLAYED_HERE: readonly string[] = [
+  'app-hidden-to-unpublished',
+  'flow-decision-mode-inclusive-explicit',
+];
 
 /**
  * Apply the versioned forward conversion to one compiled-artifact definition.
 
@@ -2126,11 +2126,12 @@ export const IN_PROCESS_DISPATCH_CLAIM_TTL_MS = 48 * 60 * 60 * 1000;
 
 /**
  * ADR-0087 conversions the flow rehydration seam refuses to replay, by id —
- * the DEFAULT-FLIP class, on the artifact door's precedent
- * (`DEFAULT_FLIPS_NOT_REPLAYED_HERE` in `@objectstack/metadata-core`). The
- * registry stays the single authority on what converts; this is only this
- * seam saying which entries its own evidence cannot carry, and each id owes
- * its reason beside it.
+ * the DEFAULT-FLIP class, the same per-door refusal the artifact-ingestion
+ * door makes (`DEFAULT_FLIPS_NOT_REPLAYED_HERE` in
+ * `packages/metadata-core/src/artifact-forward-conversion.ts`, which lists this
+ * seam's one id beside its own precedent). The registry stays the single
+ * authority on what converts; this is only this seam saying which entries its
+ * own evidence cannot carry, and each id owes its reason beside it.
  *
  * - `flow-decision-mode-inclusive-explicit` (#15429) writes `mode: 'inclusive'`
  *   onto an edge-branched `decision` with two or more conditioned out-edges,
@@ -2145,7 +2146,9 @@ export const IN_PROCESS_DISPATCH_CLAIM_TTL_MS = 48 * 60 * 60 * 1000;
  *   new exclusive decision into an inclusive one at registration and persist
  *   that at save, and the ruled default would be unobservable. The entry
  *   replays where the age IS asserted: `os migrate meta --from 17`, by the
- *   operator, over authored sources — never at a load seam.
+ *   operator, over authored sources — never at a load seam. The artifact
+ *   door refuses it for the same reason (its declared `^17.0.0` floor is a
+ *   dependency range, not an age), in the module named above.
  */
 const CONVERSIONS_NOT_REPLAYED_AT_REHYDRATION: readonly string[] = [
     'flow-decision-mode-inclusive-explicit',
 
@@ -11389,10 +11389,12 @@ const reportJoinedChartRemoved: MetadataConversion = {
  * data-at-rest seam that opens the retired window has to refuse this id by
  * name, on the artifact door's precedent for `app-hidden-to-unpublished`
  * (#17885, `DEFAULT_FLIPS_NOT_REPLAYED_HERE` in `@objectstack/metadata-core`):
- * the automation engine's flow rehydration seam does (`registerFlow` serves
- * code-shipped flows, REST bodies and Studio saves alike, none of them dated),
- * and the artifact-ingestion door must (a scaffolded `^17.0.0` floor is a
- * dependency range, not an age). ⛔ Not replayed over stored `sys_metadata`
+ * the automation engine's flow rehydration seam does
+ * (`CONVERSIONS_NOT_REPLAYED_AT_REHYDRATION` in `service-automation/src/engine.ts`:
+ * `registerFlow` serves code-shipped flows, REST bodies and Studio saves alike,
+ * none of them dated), and the artifact-ingestion door does
+ * (`DEFAULT_FLIPS_NOT_REPLAYED_HERE` in `metadata-core/src/artifact-forward-conversion.ts`:
+ * a scaffolded `^17.0.0` floor is a dependency range, not an age). ⛔ Not replayed over stored `sys_metadata`
  * flows by `os migrate meta --stored` either — that pass canonicalizes through
  * the same engine seam, and an operator-asserted rewrite of stored rows is a
  * separate plumbing, named by the D3 entry as the judgment still owed.