fix(spec,service-automation)!: an undeclared config key on 10 more builtin node types is refused at the build doors; one judge per type

[objectstack-fleet]

Fixes #21982

Clause-②: yes (narrowing: an undeclared config key on 10 more builtins, every strict-contract builtin but try_catch, is refused at the build doors and the save door, where it passed; widening: a save door with no flow canonicalizer judges the D2-converted body, so a D2 alias spelling it refuses today, script functionName / input and subflow flow, is accepted again, as at every other door)

That line is the claim's, as revised by the seat answer 6063587988, copied verbatim. The narrowing covers 10 builtins; try_catch stays on the descriptor walk, as the seat ruled, and is named below with its measured key difference. The widening is the save door's flow fallback (below).

Seat answers to the build round, comment 6063587988

• Q1: A. On the save door's flow fallback (no canonicalizer resolved, or it threw), the gate judges the D2-converted body. The stored body stays the raw request body, exactly as before. This keeps the 6 tests in protocol.save-flow-canonicalization.test.ts that the build round turned red green as written.
• Q2: A. The two spec controls that pinned 'a builtin's key membership is nobody's at the build doors' are re-pointed, test-only. Each keeps an assertion of code and location.

What changes

• Spec (flow-node-config-refusals.ts). The key arm of flowNodeConfigRefusals now judges key membership on every builtin in getBuiltinNodeConfigContracts() except try_catch. Before, it covered only script and subflow (pass 1, PR feat(spec)!: the build doors refuse an undeclared key on a script / subflow node config, with its location #22129).
  • The new export builtinNodeConfigKeysJudged(nodeType) names exactly the types it judges.
  • An undeclared key is refused as node-config-refused-by-contract, params: { nodeType, key }, one refusal per key, anchored where the author wrote it (nodes.N.config.bogusKey, nodes.N.config.fields.0.visibleIf).
  • The message carries the contract's own sentence, including its prescription for a known slip (fieldValues → fields, bulk → multi: true, visibleIf → visibleWhen, a did-you-mean for a near miss). It now closes with the remedy the walk's rejection carried: rename the key to one the contract declares there, or remove it.
  • A body-less legacy loop is judged on key membership alone. Presence and values keep parsedWhen.
  • A key at or under a region slot belongs to validateControlFlow at registration, the same carve-out the value arm has. That covers a key on a loop body or a parallel branch, and the keys of their nodes and edges.
• metadata-protocol (protocol.ts, domain:engine), the save door's flow fallback. When no flow canonicalizer resolved, or it threw, the gates judge applyConversionsToFlow(raw body) from @objectstack/spec. No reservedNodeTypes are passed, because no engine is on that path; the result is used for the verdict only and is never persisted. The stored body is the raw request body, as before. The canonicalized path is untouched. Two gates read that verdict body:
  • the schema gate (the surface the seat named);
  • the runtime authoring gate. This is one line, body: flowGateVerdictBody ?? gatedItem, declared here as a measured extension. On an active save the lint's config judge refused the raw filters alias there too: 5 of the 6 tests stayed red with the schema gate alone, failing at failed author-time validation … config.filters. The credential walk keeps the raw body.
  • duplicatePackage needs no edit. With no canonicalizer it copies the raw body (item = body, about :24693) and re-saves through this.saveMetaItem (about :24779), which reaches the same fallback.
• service-automation (engine.ts). validateNodeConfigKeys stands aside for every type builtinNodeConfigKeysJudged names, so each node type has one judge. It keeps try_catch and every plugin node type.
• Ledger. One step-18 D3 entry, flow-builtin-node-config-undeclared-keys-refused, with rationale order 89 (the highest on main at dc4a5c630 is 88). registry.ts is regenerated. api-surface/ and export-origins/ are regenerated for the new export.
• Changeset. .changeset/21982-flow-builtin-node-config-undeclared-keys-refused.md: @objectstack/spec minor (BREAKING, ADR-0087 registered), @objectstack/service-automation patch, and @objectstack/metadata-protocol minor. It carries the revised Clause-② line verbatim. Pre mode is on at main dc4a5c630 (.changeset/pre.json mode pre, tag next). The grade follows pass 1 and service-automation: a built-in node's config value its own contract refuses still registers, then fails every run — the built-in half of #21848's class #21898's launch-window convention for accept-set narrowings.
• Comments only (flow.zod.ts). The FlowSchema superRefine comment (the surface the seat named), and the module header's key-membership paragraph, which the change also made false. Both are in the same file and are comment-only.

P1: descriptor key sets against contract key sets

Measured at fbcbcf124 (tsx probe, descriptors from installBuiltinNodes, contracts from the spec dist):

type	descriptor walk positions and keys	contract keys at those positions	equal?
get_record	config {fields, filter, limit, objectName, outputVariable}	same, strict	yes
create_record	config {fields, objectName, outputVariable}	same, strict	yes
update_record	config {fields, filter, multi, objectName}	same, strict	yes
delete_record	config {filter, multi, objectName}	same, strict	yes
notify	config {actionUrl, actorId, channels, message, payload, recipients, severity, sourceId, sourceObject, template, templateData, title, topic}	same, strict	yes
http	config {body, durable, headers, method, signingSecret, timeoutMs, url}	same, strict	yes
screen	config (9 keys); fields[] (12 keys); fields[].options[] {label, value}	same at all three, strict	yes
map	config {collection, flowName, indexVariable, input, itemObject, iteratorVariable, outputVariable}	same, strict	yes
loop	config {body, collection, indexVariable, iteratorVariable, maxIterations}; body {edges, nodes}	same, strict	yes (the walk also judged a body-less loop: kept, see H2)
parallel	config {branches}; branches[] {edges, name, nodes}	same, strict	yes
try_catch	config {catch, errorVariable, retry, try}; try/catch {edges, nodes}; retry {maxRetries, backoffMs, backoffMultiplier, maxRetryDelayMs, jitter}	config/try/catch same and strict; retry is RetryPolicySchema, a plain z.object that strips an unknown key, plus the retryDelayMs tombstone	no, at retry: not moved

try_catch (named, not moved). Moving it would have widened registration: retry.bogusKey would have registered. So it stays on the walk, whole type, one judge. os validate and os compile still pass an undeclared try_catch key that registration refuses. The seat files the RetryPolicySchema strictness follow-up at landing.

Hypotheses, measured

• H1, confirmed. All 13 contracts answer unrecognized_keys at the root for { bogusKey: 1 }. Nested positions are strict too, except try_catch.retry.
• H2, falsified as stated; route per the seat. Today the walk refuses an undeclared key on a body-less loop. So the key arm judges loop key membership whatever parsedWhen says. Pinned: a body-less loop with bogusKey is still refused at registerFlow (config-unknown-keys.test.ts), so registerFlow widens nowhere.
• H3, confirmed. assignment is in neither the contract map nor the walk.
• H4, measured. No alias tolerance is needed in validate-expressions.ts. The whole lint suite had one red, a fixture writing itemVariable (a wrong key, not a D2 alias) on a loop with a body. Fixed in the test, and validate-expressions.ts is untouched.

Registration verdicts, before and after (59-variant probe)

Every variant that registerFlow refused before is still refused, and every one it registered still registers.

• On the 10 moved types, the refusal now comes from the FlowSchema.parse that registerFlow makes first. That covers a top-level bogusKey on each type, the walk's 6 guidance keys, screen fields[0] and fields[0].options[0], and a body-less loop's bogusKey / flowName.
• Region-object keys (loop body.bogusKey) and region-node keys are refused by validateControlFlow, as before.
• try_catch keys are refused by the walk, as before.
• Free-form-map keys and D2 aliases (converted first) register, as before.

Measured at the CLI doors

On examples/app-showcase, node notify in showcase_task_completed. The mutation went through scripts/ablation-replace.mjs (blob 562e884310 → 87b20a9570, restored to 562e884310 == HEAD).

door	control	message: '{summary}' , bogusKey: 1,
objectstack validate	exit 0	exit 1, path nodes,2,config,bogusKey, the spec refusal's text
objectstack compile	exit 0, artifact without bogusKey	exit 2, no artifact

The first attempt used an anchor that is a substring of its replacement. ablation-replace refused it before running anything (anchor count 1 → 1) and restored the file, so nothing was measured on that attempt.

Ablation

At HEAD b9a3295d1, builtinNodeConfigKeysJudged's body was replaced by return false; via ablation-replace (blob 12eb374153 → 6ab82dce15, restored to 12eb374153 == HEAD, git diff HEAD empty). On flow-builtin-node-config-keys.test.ts plus flow-approval-node-config-contract.test.ts, 21 of 50 tests went red and 29 held. The spec tests import src/, so no dist preflight applies.

Tests (real readings)

Patch round, at d7466a01b (merged with origin/main 4e4111ca0 through os-regen-merge.sh):

• @objectstack/metadata-protocol, whole suite: 221 files passed, 3 skipped; 28283 tests passed, 19 skipped, 0 failed.
  • Pre-change red set: the build round's 6 tests in protocol.save-flow-canonicalization.test.ts (at b9a3295d1), all flow/purge_flow failed spec validation: nodes.0.config.filters.
  • At 72b8d3e97, with the schema-gate edit alone, 5 of those 6 were still red at failed author-time validation … config.filters. Only the draft-mode test had gone green.
  • At d7466a01b all 6 are green as written, plus the 3 new pins: 19/19 in the file.
• @objectstack/spec, --project local: 626/626 files, 18732 passed, 1 todo. The two re-pointed controls (Q2) are green.
• Typecheck, exit 0: metadata-protocol (tsc --noEmit) and spec (with check:test-typecheck).

Build round, unchanged by the patch (at b9a3295d1; pin files re-run at 414fc860c):

• service-automation whole suite 176/176 files, 2163/2163.
• lint whole suite 127/127, 5843/5843.
• runtime --project local 336/336, 4752 passed, 19 skipped.
• trigger-record-change 11/11, 114/114.
• dogfood 17 flow pin files, 105/105.
• Examples: showcase 408/408, todo 238/238, crm 45/45.
• Typecheck exit 0: service-automation, runtime, lint.

Ablation of the fallback edit (patch round)

At d7466a01b, through ablation-replace. Each run was restored to blob f15e4802b5 == HEAD with git diff HEAD empty.

• Schema gate reverted to schema.safeParse(request.item) (blob f15e4802b5 → a0cc936d94): 9 of 19 red in protocol.save-flow-canonicalization.test.ts. That is the 6 fallback tests and all 3 new pins: the functionName body is refused, and the filters + bogusKey bodies report two paths instead of one.
• Authoring gate reverted to body: gatedItem (blob f15e4802b5 → 19e8bbb4ed): 5 of 19 red, the active-mode fallback tests. The new pins hold: the lint already tolerates the script functionName alias, and bogusKey is refused either way.

Acceptance notes

• approval has two judges: the spec arm, which judges it whole, and the walk against getApprovalNodeConfigJsonSchema(). registerFlow's parse throws first, so the walk never decides an approval key. Carrier: none.
• FLOW_NODE_UNKNOWN_KEY_GUIDANCE in engine.ts is now unread: every type it keys is spec-judged, and each entry's prescription lives in that type's contract. It is kept and marked UNREAD, because removing it also needs the two comments in builtin-node-config.zod.ts that name it updated. Carrier: the next PR to touch builtin-node-config.zod.ts.
• The node-config-refused-by-contract docblock in flow-node-expression-paths.ts still names only script / subflow for the key half. It is incomplete, not false. Carrier: the next PR to touch that file.
• objectstack validate prints the raw issue array at 'Loading configuration…' for a refused flow. This predates the PR and was noted on pass 1.
• The designer's fallback writer (http outputVariable, notify url) is tracked at flow inspector fallback form: the http_request group writes config.outputVariable, a key the http executor contract does not declare, so registration drops the saved flow objectui#11968, not changed here.
• Open PR fix(lint)!: os build and the object save door refuse a select option's visibleWhen that reads parent (#22157) #22268 also edits packages/lint/src/validate-expressions.test.ts. This PR changes one fixture line there (itemVariable → iteratorVariable). Whichever lands later merges main.

Gates

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, run with no paths, at d7466a01b against merge base 4e4111ca0, derived 96 commands. Two families joined for the metadata-protocol edit: check:durability-log-level and check:filter-alias-parity. All 96 were run, each exit code captured before any pipe. 95 exited 0. check:dual-build-cjs-loads exited 3, PREREQUISITE NOT MET (packages outside the built closure have no dist), so it is NOT MEASURED and CI answers it. --ran: ✓ dispatch-gates --ran: 96 derived famil(ies) accounted for — 95 run, 1 NOT-MEASURED (1 DERIVED from a recorded exit 3). check:adr-0087-registration: [BREAKING+clause-②-narrowing] registered flow-builtin-node-config-undeclared-keys-refused.

eslint, narrowed (--no-inline-config --format json) over the diff's 20 .ts files: 20 files, 0 errors, 0 warnings. The population is the 20 .ts paths of git diff --name-only 4e4111ca0 HEAD, and the file count is read from the json. Invariance: parserOptions.project and projectService are null (checked with --print-config), so no type-aware linting runs and no untouched file's verdict can move.

Size

23 files, +955 / -203 vs merge base 4e4111ca0 (1158 changed lines). 0 governed paths.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/metadata-protocol, @objectstack/service-automation, @objectstack/spec, touching 16 documentable anchor(s). ⚠️ 2 changed file(s) yielded no anchor (packages/spec/api-surface/automation.json, packages/spec/export-origins/automation.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

8 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/approvals.mdx (via try_catch (literal, a string literal in BUILTIN_KEYS_JUDGED_AT_REGISTRATION))
• content/docs/automation/flows.mdx (via FlowSchema (symbol, a top-level const), registerFlow (symbol, a method of class AutomationEngine), try_catch (literal, a string literal in BUILTIN_KEYS_JUDGED_AT_REGISTRATION))
• content/docs/concepts/metadata-lifecycle.mdx (via saveMetaItem (symbol, a method of class ObjectStackProtocolImplementation))
• content/docs/data-modeling/formulas.mdx (via registerFlow (symbol, a method of class AutomationEngine))
• content/docs/deployment/validating-metadata.mdx (via saveMetaItem (symbol, a method of class ObjectStackProtocolImplementation))
• content/docs/kernel/cluster.mdx (via saveMetaItem (symbol, a method of class ObjectStackProtocolImplementation))
• content/docs/kernel/services-checklist.mdx (via saveMetaItem (symbol, a method of class ObjectStackProtocolImplementation))
• content/docs/permissions/authorization.mdx (via saveMetaItem (symbol, a method of class ObjectStackProtocolImplementation))

⛔ 6 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v16.mdx (via AutomationEngine (symbol, a top-level class), try_catch (literal, a string literal in BUILTIN_KEYS_JUDGED_AT_REGISTRATION))
• content/docs/releases/v17/17-0.mdx (via AutomationEngine (symbol, a top-level class), FlowSchema (symbol, a top-level const), registerFlow (symbol, a method of class AutomationEngine))
• content/docs/releases/v17/17-4.mdx (via FlowSchema (symbol, a top-level const), registerFlow (symbol, a method of class AutomationEngine))
• content/docs/releases/v17/17-5.mdx (via registerFlow (symbol, a method of class AutomationEngine))
• content/docs/releases/v17/17-6.mdx (via AutomationEngine (symbol, a top-level class), try_catch (literal, a string literal in BUILTIN_KEYS_JUDGED_AT_REGISTRATION))
• content/docs/releases/v17/17-7.mdx (via FlowSchema (symbol, a top-level const), registerFlow (symbol, a method of class AutomationEngine))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 2 changed file(s) yielded no anchor (packages/spec/api-surface/automation.json, packages/spec/export-origins/automation.json) — pages documenting those are invisible to this run
• 6 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 140 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 28bff18d0c4013db86d61eba87c739c3145e17fd → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 043f58c4a9d8ac57f4cf59233167fc748004b587 — the merge of head 6e56f2f68a5439d2ed797a91e7016750782a9662 into base 28bff18d0c4013db86d61eba87c739c3145e17fd, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 043f58c4a9d8ac57f4cf59233167fc748004b587 && git checkout 043f58c4a9d8ac57f4cf59233167fc748004b587
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 28bff18d0c4013db86d61eba87c739c3145e17fd 6e56f2f68a5439d2ed797a91e7016750782a9662 && git checkout -B drift-repro 28bff18d0c4013db86d61eba87c739c3145e17fd && git merge --no-ff 6e56f2f68a5439d2ed797a91e7016750782a9662

node scripts/docs-audit/affected-docs.mjs --json 28bff18d0c4013db86d61eba87c739c3145e17fd

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 28bff18d0c4013db86d61eba87c739c3145e17fd → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: beda06e97812716e44a07ab84688df64e161fdc4
Local-runs: none

Read: card #21982 (body and all 18 comments, the triage grade 6015698142, the claim 6059609053 as revised by 6060189970 / 6063587988 / 6063670139, the four dev reports and the ACCEPT 6064942288), PR #22319 (body, 23-file list, net diff against merge base f2626c71db), the head's check-runs, and on origin/main AGENTS.md (changeset rules, Prime Directives) and ADR-0087 (D2, D3, the pre-launch level ruling, the disposition vocabulary). Source at the head read with git show refs/pm/review-22319:PATH.

Check-runs on the head at this read (33): 22 success, 3 skipped (Build Docs, Console Pin Gate, Packed-tarball smoke), 0 failed, 8 still in_progress: Lint & Repo Gates, Test Core (1/6 to 6/6), Type Check · workspace. Among the completed successes: Check Changeset, Build Core, Dogfood Regression Gate (all three shards), Dogfood Verify CLI, Temporal Conformance, Type Check · source / consumer / debt ledger, Spec property liveness, Governed Surface Queue Guard, the three card/branch guards. The in-progress eight are recorded as such and not waited for; their conclusions remain the landing's gate verdicts.

① Derived judgments

Each accept-set or public-surface change the diff implies, named right or wrong.

1. The spec key arm judges key membership on 10 more builtins (get_record, create_record, update_record, delete_record, notify, http, screen, map, loop, parallel) at every door that parses FlowSchema. Right. At the head getBuiltinNodeConfigContracts() holds 13 types; BUILTIN_KEYS_JUDGED_AT_REGISTRATION holds exactly try_catch; builtinNodeConfigKeysJudged answers true for the 12 others (the 10 plus script / subflow from pass 1). The refusal reuses node-config-refused-by-contract with params: { nodeType, key }, one per key, anchored at nodes.N.config.KEY; no new code joins FLOW_SLOT_REFUSAL_CODES. A narrowing of the build doors to what registerFlow already refused: the triage pin (refused at objectstack validate and compile, located; the control passes) is pinned in flow-builtin-node-config-keys.test.ts and measured by the dev on examples/app-showcase (notify + bogusKey: validate exit 1 at nodes,2,config,bogusKey, compile exit 2).

2. New public export builtinNodeConfigKeysJudged(nodeType) from @objectstack/spec/automation. Right, additive. automation/index.ts re-exports the module wholesale; api-surface/automation.json and export-origins/automation.json carry the new row; the root index re-exports only defineFlow / defineWebhook from automation, so root.json owes no row.

3. A body-less legacy loop is now judged on key membership alone (parsedWhen gates presence and values only). Right. The loop body at flow-node-config-refusals.ts:703-746: parsedAtRun false with keysJudged true parses the contract, pushes only unrecognized_keys refusals (with the "executor reads no key … registration refuses the whole flow" closing) and continues past every other issue. Registration's walk already refused an undeclared key on a body-less loop (H2, measured; pinned at registerFlow in config-unknown-keys.test.ts), so the build doors narrow to registration's verdict and registerFlow widens nowhere.

4. A key at or under a region slot stays validateControlFlow's (unknownKeyUnderRegionSlot: path[0] is a FLOW_REGION_SLOTS_BY_TYPE slot). Right. Keys on a loop body, a parallel branch, or their nodes and edges are refused at registration as before and not at the build doors; the value arm has the same carve-out (insideRegion). No second judge, no accept-set change there.

5. try_catch stays registration's, whole type. Right. P1 measured its contract's retry as the shared plain RetryPolicySchema (strips an unknown key) against a descriptor that closes retry to five keys; moving it would have widened registerFlow. Named in the PR and the changeset with that reason, as triage's step 2 asks for a builtin that is not strict; os validate / compile keep passing its undeclared key, stated plainly. Pinned on the walk (config-unknown-keys.test.ts: retry key refused, located).

6. service-automation validateNodeConfigKeys stands aside for every spec-judged type and keeps try_catch and plugin node types. Right; registerFlow's accept set is unchanged. The method is private with one call site (engine.ts:4407), after FlowSchema.parse(converted) in canonicalizeStoredFlow (:4367), so the parse refuses first on every registration path (boot, sys_metadata, REST). The move changes no verdict only because the descriptor key sets equal the contract key sets at every walked position on the 10 types (P1 table, the 59-variant probe) — accepted as the dev's measurement, not re-run. What changes is the refusal's carrier: the parse's located issue instead of the walk's Flow '…' rejected: N undeclared config key(s) text. The runtime REST face keeps its 400 VALIDATION_FAILED envelope with the key located at nodes.0.config.KEY (re-pointed and pinned in automation-register-error-class.test.ts and automation-put-post-error-parity.test.ts); no non-test consumer keys on the walk's text (grepped). FLOW_NODE_UNKNOWN_KEY_GUIDANCE is kept and marked unread, so no service-automation export moves.

7. metadata-protocol save door, flow fallback (no canonicalizer resolved, or it threw): the schema gate and the runtime authoring gate judge applyConversionsToFlow(request.item); the stored body, the credential walk (item: gatedItem) and duplicatePackage keep the raw body. Right, and it is two changes. (a) A widening against main: main's fallback parsed the raw body and its pass-1 key arm already refused script functionName / input and subflow flow there; they are accepted again, converted first, as at every other door. (b) The narrowing of item 1 reaches this door in canonical spelling, so a live D2 alias on the 10 types (filters, notify to / subject / body / url, map flow) is accepted and an undeclared key is refused 422 INVALID_METADATA at its path (three new pins; the six invariant tests green as written; the dev's two ablations attribute the schema-gate line and the authoring-gate line separately). The two grafts after a passing verdict (graftNormalizedOperators, graftFoldedFormSections, read at protocol.ts:1376 / :1462) walk the AUTHORED keys and rewrite only an operator string or the groups to sections fold where a parsed counterpart exists; a converted key has no authored counterpart, so nothing from the converted parse enters the stored body. One edge, within the declared narrowing: with no reservedNodeTypes the live flow-node-http-callout-rename conversion renames http_request / http_call / webhook to http for the verdict unguarded; on the no-engine path nothing local can be reserved, an engine-backed save keeps its 409 conflict guard, and the one known writer of http_request + outputVariable (the objectui fallback inspector, objectui#11968) produces a flow registration already refuses.

8. @objectstack/lint: no source line moves; its judge is the spec's. Right, carried by the spec changeset. A raw pre-conversion alias on the 10 types handed directly to validateStackExpressions now draws a finding; the lint's declared pre-conversion tolerance is scoped to the script functionName alias alone (validate-expressions.ts:1673-1683), and every real door converts first (os validate at load; the authoring gate now on both save paths). The one red fixture was a wrong key (itemVariable), fixed in the test file.

9. The ledger. Right. One D3 semantic entry 18.flow-builtin-node-config-undeclared-keys-refused.ts whose id matches the changeset marker and is new in the diff; surface carries no backtick and no pipe; no tombstone and no D2 conversion, which is correct for a change that removes no key. STEP18_RATIONALE order 89 is unique at the head; origin/main's highest is 88 and packages/spec/src/migrations has not moved on main since the merge base, so 89 is still free. registry.ts regenerated (CI check:generated sits in the in-progress Lint & Repo Gates).

10. The card closes. The PR's first line Fixes #21982 is its only closing keyword; the remainder named in 6051476304 (the 11 descriptor-configSchema builtins, and the judge at registerFlow) is covered: 10 moved, the judge decided (one per type), try_catch named as staying registration's with its follow-up owed at landing. The card this PR closes must claim this branch: success.

② Semver level

• @objectstack/spec: minor, with the **BREAKING** banner and the marker adr-0087: registered flow-builtin-node-config-undeclared-keys-refused. Right. An accept-set narrowing on published authoring surfaces, shipped minor under ADR-0087's pre-launch level ruling (.changeset/pre.json on origin/main: mode pre, tag next); the banner and the disposition carry the breaking-ness; the body carries the FROM → TO table and the one-line fix, and names what stays as it was.
• @objectstack/metadata-protocol: minor. Right. The fallback path widens back to the D2 spellings (item 7a) — yes takes at least minor.
• @objectstack/service-automation: patch. Right. Source moved (engine.ts), no accept-set change at registerFlow, no public-face change.
• No @objectstack/lint or runtime line: only test files move there. Right.
• Clause-②: line: yes (narrowing: … 10 more builtins … ; widening: a save door with no flow canonicalizer judges the D2-converted body …), byte-identical in the PR body and the changeset, and the claim's revised line (6063587988). Read through the gates' own reader (scripts/pm/clause2-line.mjs): value yes; the arm is the first token inside the parenthetical, narrowing (followed by :, so the exact-spelling regex matches and the reasoning is kept, as no (narrowing — …) is documented to do); the later "widening:" is reasoning, not a second arm. One arm from the closed pair, so AGENTS.md's rule holds, and yes (narrowing) is exactly the reader's documented shape for "a diff that widens one surface and narrows another". check:adr-0087-registration reads [BREAKING+clause-②-narrowing] registered … (dev, at the head); Check Changeset on the head: success. The ! in the PR title agrees.

③ Boundary flags

Every dev flag and open_questions entry on this PR's rounds, answered or escalated:

1. 6060083863 Q1 — P2 found one writer (Studio's fallback inspector writes http outputVariable). Seat 6060189970: A, proceed; triage's step 3 (send a writer to the maintainer's box) declined on the ground that this writer's output does not work today — registerFlow already refuses it, so the narrowing removes no working behaviour and moves the refusal earlier and located; the writer filed as objectui#11968. Verified on the diff: the save door now answers 422 at nodes.N.config.outputVariable where it stored and then silently dropped. Answered by the seat. Named here visibly: it is the one triage direction declined on this card, the seat itself wrote that the maintainer may overrule before enqueue, and no maintainer ruling on the card touches it.
2. 6060083863 Q2 — try_catch P1 fails at retry. Seat: A, stays on the walk; the RetryPolicySchema strictness card is to be filed when this PR lands. Answered; the card is not yet filed — a landing to-do, not a blocker.
3. 6063482248 Q1 — the fallback refuses D2 aliases. Seat 6063587988: A, judge the converted body, store raw. Answered and built (item ①7).
4. 6063482248 Q2 — two spec controls pinned the old reading. Seat: A, test-only with code and location. Answered and built (flow-builtin-node-config-values.test.ts, flow-node-config-required.test.ts).
5. Dev deviation — the authoring gate reads the verdict body too (body: flowGateVerdictBody ?? gatedItem, one line beyond the named schema gate). Accepted by the seat in 6064942288; verified the credential walk still receives the raw gatedItem. Answered.
6. Dev deviation — the PR body was not PATCHed by the dev (role file). The seat wrote the dev's pr_body_revision; the stored body carries the revised Clause-② line and Fixes #21982 as the only closing keyword. Answered.
7. Dev deviation — grafts after a converted parse, and applyConversionsToFlow defaults (live window, includeRetired false, no reservedNodeTypes). Read at the head (item ①7): authored-key walks, nothing converted is stored; the one unguarded rename is named above. Answered.
8. Out-of-scope carriers, named not filed: FLOW_NODE_UNKNOWN_KEY_GUIDANCE unread (next PR on builtin-node-config.zod.ts); the node-config-refused-by-contract docblock in flow-node-expression-paths.ts naming only script/subflow (incomplete, not false); approval's two judges where the walk never decides; objectstack validate's raw issue print (predates this PR). Each has its carrier or is recorded in the PR's Acceptance notes.
9. Serial: fix(lint)!: os build and the object save door refuse a select option's visibleWhen that reads parent (#22157) #22268 also edits packages/lint/src/validate-expressions.test.ts (one fixture line here; whichever lands later merges main); metadata-protocol/spec: the _drafts header carries no label, so a draft-only item can only be shown by its machine name (ListDraftsResponseSchema drops the label the repository already reads) #22200 (in flight, this seat) edits a disjoint hunk of protocol.ts. Since the merge base, origin/main moved only on two runtime test files outside this PR's list. No conflict.
10. Gates still in progress at this read (Lint & Repo Gates, Test Core 1-6, Type Check · workspace): not waited for; landing reads them. No completed check-run on the head failed.

Implemented-by: claude/issue-21982-builtin-undeclared-keys
Reviewed-by: session_01DhTqaEHqPVSVnAkjG3jywn

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

CI on beda06e97: Test Core (6/6) red on its timing-drift step, not on a test · domain:spec seat 2 (#18549) · session session_01DhTqaEHqPVSVnAkjG3jywn · 2026-10-08T17:24Z.

• What failed: the shard-timing drift step read 2462.2s measured vs 1609.1s predicted (1.53x, red past 1.5x). No test failed: check-test-completeness reports all 15814 scheduled tests accounted for.
• Why it is not this PR's: the overshoots are @objectstack/runtime 1.63x, plugin-security 1.55x and driver-sql 1.53x. This diff touches no plugin-security or driver-sql file, and in runtime only two test files (+74 lines in total), which cannot add 287s. PR feat(spec, metadata-protocol): each _drafts row carries the draft body's own label, or null #22323, an unrelated diff, drifted on the same shard with the same three packages an hour earlier (1.56x). The shard-timings dataset's staleness is tracked on finding(ci): the shard-timings dataset rests on ONE scheduled run, and records @objectstack/spec at 1134.86 s against 1573–1651 s executed — #16468's 25%-headroom ceilings built on it would red every PR that runs spec #22014 (domain:devx). No fix exists to port into this PR.
• Re-run: this seat has no re-run op. A merge of main into this branch (main has moved 88 files since the merge base, none shared with this PR, including PR feat(plugin-auth,objectql,metadata-protocol,runtime)!: under single the Default Organization exists before the seeds and the listener; an unowned seed row or system write is derived there or refused (ADR-0131 C1) #22186's metadata-protocol changes) is the next push. It re-runs every shard and is ordered as soon as a slot frees. The contract review 6065149119 stands for the PR's own diff; the seat will confirm the merge adds no PR-side change before the PR enqueues.

---

Generated by Claude Code