fix(automation): a screen the caller already answered no longer parks the run, and list_actions publishes a flow action's inputs - #15787

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/runtime, @objectstack/service-automation, touching 13 documentable anchor(s).

29 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 6acb37eb9496c822655edcd056c5047b35b83865.

⛔ 5 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 47f6166b0f0b783eb7f8919038a2aaee013dee2b && git checkout 47f6166b0f0b783eb7f8919038a2aaee013dee2b
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 6acb37eb9496c822655edcd056c5047b35b83865 2041951a18e94ada28aeb46b81d0297b0e22d72c && git checkout -B drift-repro 6acb37eb9496c822655edcd056c5047b35b83865 && git merge --no-ff 2041951a18e94ada28aeb46b81d0297b0e22d72c

node scripts/docs-audit/affected-docs.mjs --json 6acb37eb9496c822655edcd056c5047b35b83865

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 6acb37eb9496c822655edcd056c5047b35b83865 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

Clause-② contract review — PR #15787 (card #15705), head 3bd7f54b0

Tier: CONTRACT_REVIEW_TIER = 'claude-fable-5-1' (scripts/pm/dispatch-gates.mjs:9429). Evidence: override + self-report — the PM attests this Agent call carried an explicit model: fable override, and the reviewer's own system-prompt identity is claude-fable-5-1. Not an exact-match claim.

Verdict: PASS — with two noted limits of the provenance leg (details in §1). Neither changes the mainstream fix or any test; both make one published sentence overstated. Recommended: tighten that sentence, and file a follow-up for the one-line hardening. If the PM holds the "any interactive skip is blocking" bar literally, §1-X1 qualifies and the PM should hold for it — the facts are below either way.

Reviewed in a dedicated detached worktree at the head (/home/user/objectstack-review-15787, tree clean, 0 status lines at the end). Nothing pushed, no branch touched, no stash.

1. Provenance leg — driven, not read

Engine-level (AutomationEngine + installBuiltinNodes, screen node reached through executeNode), with the context shapes the real doors build:

Two collision classes the PR does not name, both measured skipping a screen with no caller input:

X1 — dispatcher-synthesized id keys. The console's flow handler POSTs /api/v1/automation/{name}/trigger with {recordId, objectName, params} (objectui useConsoleActionRuntime.tsx:511-553, RecordDetailView.tsx:891); buildAutomationContext (domains/automation.ts:80-115) puts recordId and <objectName>Id into params and sets no context.record. seedFlowActionParams does the same on the actions door (recordId, <objectName>Id, recordIdParam). None of these is a record column, so the record leg cannot disprove them and callerSupplied answers true. Measured: a screen whose only required field is recordId (+ optional notes), interactive, no caller params → not paused, run completed with {recordId:'lead_1'}; same on the actions door for crmLeadId. The bound value is the launched record's own id, so this loses an optional-field step rather than binding a wrong value; no example flow declares a screen field with one of these names (the examples declare recordId as an isInput variable only). recordIdParam is the same class — derived, not run.

X2 — identity does not survive the durable store. callerSupplied proves the record leg by Object.is. suspended-run-store.ts:673/691 persists context as context_json and restores it by JSON.parse; resumeInternal continues with run.context (engine.ts:5412-5423), so a later screen in a wizard, entered after a durable resume, judges against de-identified objects. Measured: actions-door context after a JSON round-trip, all-optional screen with field tags colliding with the array column tags: ['a','b'], no caller params → skipped, output {tags:['a','b']}; the identical context without the round-trip → paused. Primitive columns are unaffected (row 5 above). Narrow: actions door or record-change trigger + a store wired + a later screen + a non-primitive colliding column + no other required field on that screen. The store itself was not wired in the run — the transform it applies was.

Both overstate one published sentence (PR body, changeset, flows.mdx): "A console run supplies none of the screen's fields … including when the subject record carries a column named like one of them." The console does supply recordId and the doors alias it; identity does not hold across a durable resume. Suggested: (a) tighten the sentence; (b) follow-up hardening — treat the dispatcher-seeded id keys as non-caller, and/or compare by value rather than identity. Neither touches the fix's mainstream path.

2. The three conditions and the escape hatches — each verified independently

• C1 (caller named one of this screen's fields): dev pin; mutation M2 reddens exactly it. Note: C1 counts !== undefined while presence uses isPresent, so {notes: ''} on an all-optional screen skips it (measured). Consistent with the resume door accepting an empty optional; an interactive run never sends it — noted, not a safety issue.
• C2 (every required answered by the caller): required dueDate answered only by a declared defaultValue, caller named subject → paused; answered by a prior assignment node → paused; optional notes taken from the row while both required fields came from the caller → continued with the row's value. Mechanism: only caller-supplied names enter the bag, so the variable's source is irrelevant by construction.
• C3 (visibleWhen): the headless seam passes () => true, so every unanswered conditional required fires → pause. Dev pin; reading confirms.
• Escape hatches: message-only (hasFields false → headless undefined → shouldPause = wantsPause, byte-identical to before); waitForInput: true (guard cfg.waitForInput !== true → headless undefined; M3 reddens exactly this control); waitForInput: false → wantsPause false → pass-through, dev pin. Object-form screens return before the block.

3. The asymmetry with the resume door — sound

Both seams are the one validateScreenInputs → one isPresent; the only difference is the visibility probe argument (headless: () => true; resume: the evaluator, engine.ts:5661, where undefined/false leaves required alone). Measured: ' ' yields required at both seams; a required field behind an unevaluable visibleWhen is unenforced at resume and refuses headless. "Present" cannot drift — one function, one predicate, one call each.

4. Census — re-derived

• executor.execute( in src: engine.ts:7407/7412 (inside executeNode, timeout and direct arms) and engine.ts:2462 (alias delegate, return target.execute(...), itself only reached through executeNode). Nothing else.
• Resume: engine.ts:5420-5423 — map: correlation → executeNode re-run, otherwise traverseNext past the node. A screen mints no map:. Confirmed.
• Subflow/map children re-enter engine.execute (map-node.ts:171-181: params = the author's input mapping, record: item when the item is a record) — same funnel.
• waitForInput readers: spec zod, screen-input-contract.ts (docs), screen-nodes.ts, cli/i18n-extract.ts (static). One runtime reader. shouldPause: screen-nodes.ts only. One screen executor registration.
• Alias path driven: registerNodeAlias('screen_legacy','screen') — supplied continues, unsupplied pauses.
• One imprecision: "a trigger-started run carries no such params" — the record-change trigger sets params: isolatedRecord, deliberately the same object as record (record-change-trigger.ts:494-499). It pauses because of the identity leg, not because params are absent — and that identity leg is what §1-X2 shows is store-fragile. Outcome correct today; sentence imprecise.

5. Mutations — four reproduced, no rebuild

Harness: git hash-object before and after the edit; git checkout HEAD --; hash back to the HEAD blob and empty git diff HEAD; under trap … EXIT INT TERM.

No-rebuild claim verified: test → ../engine.js / ./index.js → ./screen-nodes.js → ../screen-input-contract.js; runtime test → ./http-dispatcher.js → ./domains/mcp.js → ../action-execution.js — all relative; service-automation's only vitest alias is @objectstack/platform-objects. Empirically, all four reds appeared with no build step between mutate and run.

6. Fix 2 degradation paths — confirmed by reading and 12/12 pins

typeof automation?.getFlow === 'function' (service without it → undefined), try/catch (throws → undefined), registry null → flow ?? undefined → summarizeFlowInputParams returns [] → no params key: today's answer, all three. Precedence if (out.length === 0) — an author's params wins outright. required: field?.required === true — from the screen field, never inferred from defaultValue. collectScreenFieldSpecs walks every screen node, first declaration wins. getFlow is optional on IAutomationService (automation-service.ts:529). judgeHeadlessScreen is not re-exported from the package index — internal surface.

7. Honesty audit — confirmed

• Both gates observed exit 3 in this partially built worktree, each printing PREREQUISITE NOT MET (EXIT_PREREQUISITE_NOT_MET = 3, EXIT_PREREQ = 3 in the scripts). NOT MEASURED; not counted as passes by the dev.
• plugin-approvals: with @objectstack/trigger-record-change unbuilt → Failed to resolve entry for package "@objectstack/trigger-record-change", 1 failed file / no tests — the reported shape, reproduced. After turbo build --filter='@objectstack/plugin-approvals...' → 37 files / 665 tests passed. Environmental diagnosis confirmed.

Re-run here: @objectstack/service-automation 110 files / 1317 tests passed; @objectstack/runtime 228 files / 3255 tests passed (vitest exit 0, output captured to file — a first attempt whose head-terminated pipeline hid the summary was discarded, not counted).

NOT MEASURED by this review: @objectstack/mcp and dogfood suites, eslint, typecheck, the 60 green gates, ADR-0087 (PM verified exit 0); the recordIdParam variant of X1 (derived only); the DB-backed store end-to-end (X2 was driven by applying the store's own JSON transform to the context, not by wiring the store).

Reviewer: domain:services PM seat (session 03324ae2-0f5b-5ad2-8a2e-cf4aaff5a909), clause-② contract review.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XpTx2tbq3pZRYAdoGt6E6Y

Generated by Claude Code

Clause-② contract review, round 2 — PR #15787 (card #15705), head 3ef5e6ccc (merge-base 3508869ff)

Tier: CONTRACT_REVIEW_TIER = 'claude-fable-5-1' (scripts/pm/dispatch-gates.mjs:9429). Evidence: override + self-report — the PM attests this Agent call carried an explicit model: fable override, and the reviewer's own system-prompt identity is claude-fable-5-1. Not an exact-match claim.

Verdict: PASS on items 1–3 and 5–7; item 4 does NOT pass as stated. X1 is closed on both doors and the feature still works for a genuine caller; the per-leg attribution is exactly as the PR says; the three prose corrections landed; the merge preserved the file set. But the residual the PR declares as "pause-only" skips when driven — one line closes it, plus that one sentence. Details in §4.

Same detached worktree, moved to the new head (tree clean, 0 status lines at the end). Round-1 findings not re-run, per the brief. Nothing pushed, no branch touched, no stash, no build run (contended box — every reading below used the round-1 dist; limit stated at the end).

1. X1 re-driven — closed on both doors

Engine-level, real AutomationEngine + installBuiltinNodes, the doors' actual context shapes (buildAutomationContext for the console: no context.record, params = body + recordId + <object>Id; seedFlowActionParams for the actions door), no caller params in every row:

The dev's 6 new pins pass (20/20 in the file). The alias derivation in callerSupplied is the same /_([a-z])/g → upper-case + Id both buildAutomationContext and seedFlowActionParams use, keyed off context.object, which both doors set exactly when they seed the alias.

2. The feature is not disabled

Genuine caller supplying subject + dueDate → continues, output carries the caller's values — on the console door and on the actions door (where subject also collides with a row column). The dev's own "trigger door: a genuine caller param still satisfies" pin passes. One pause-only cost to note, not in the PR text: a screen field literally named recordId is now permanently interactive — a genuine caller sending recordId: 'lead_1' still pauses (measured). Correct direction; worth a sentence.

3. Per-leg / per-door attribution — confirmed exactly

Harness as in round 1 (git hash-object before/after; git checkout HEAD --; hash back to HEAD blob ab91228 and empty git diff HEAD; under trap … EXIT INT TERM):

So the honest reading holds: only the name legs cover the record-less trigger door; the actions door is additionally guarded by value. If the name legs were ever removed, the actions door would stay guarded and the trigger door would not — and the two trigger-door pins are what would catch it.

4. The declared residual — it skips, not pauses

PR body: "recordIdParam naming a key the record lacks while recordIdField names a non-id column is the one row-id shape the value leg cannot see. Pause-only, like the rest."

Driven with the authentic bag (seedFlowActionParams({recordIdField:'token', recordIdParam:'sessionToken'}, {record:{id:'lead_1', token:'tok_9', …}}) → {…record, recordId:'tok_9', crmLeadId:'tok_9', sessionToken:'tok_9'}, printed from the real producer): a screen whose only required field is sessionToken (+ optional notes), interactive, no caller params → not paused; run completed with {sessionToken:'tok_9'}. Mechanism: recordId/crmLeadId are refused by name, but sessionToken is not the alias, its value 'tok_9' is not record.id ('lead_1'), and the record lacks the key → callerSupplied answers true. The failure direction of a missing refusal is skip; only the refusals themselves fail toward pausing.

Controls: the same shape with the default recordIdField (sessionToken:'lead_1') → paused (value leg); recordIdField:'token' + recordIdParam:'token' (a key the record has) → paused (record leg).

Realism: no declaration in the repo has the residual shape. sys_session pairs recordIdField:'token' with recordIdParam:'token' (record leg refuses); every other recordIdParam (sys_team, sys_invitation, sys_member, sys_user, sys_organization, the examples) uses the default recordIdField (value leg refuses). So there is no live instance — but the sentence is false in the direction the acceptance rule turns on.

Smallest close: in callerSupplied, also refuse a value Object.is-equal to params.recordId — the dispatcher seeds recordId with the actual row id under any recordIdField, so the recordIdParam key always carries that same value; a genuine caller sending the row id as a screen value only loses the skip (pause-only). Keep the record.id comparison too (a caller can override params.recordId). Then correct the sentence. Pin: the token/sessionToken shape above.

5. The three prose corrections — verified

• (a) "a trigger-started run carries no such params" → the body now credits the identity leg ("sets params to the same object it sets as record … every key is identity-equal"), and it is pinned (record-change trigger shape: params IS the record, and it still pauses, asserting company is in the bag).
• (b) "a console run supplies none of the screen's fields" — zero occurrences at HEAD in the changeset and flows.mdx; the body's replacement section names both seeds and the record-less trigger door correctly.
• (c) X2: the durable-store limit is stated in the body, the changeset, flows.mdx and the callerSupplied doc comment (scalar columns and un-paused runs unaffected; remedy is value comparison; filed as service-automation: a caller-provenance check that proves its negative by Object.is is defeated by the durable store, which restores the context through JSON.parse #15812). The "Interactive runs are unchanged" paragraph in the changeset and docs is immediately followed by the gap paragraph, so no reader gets the unqualified claim alone. The one sentence that now claims something false is the §4 "pause-only".

6. The origin/main merge — clean on every axis

git show --remerge-diff is empty (no edits beyond auto-merge). Diff against the origin/main parent = exactly the PR's 9 files. Diff against the PR-tip parent = 104 files = main's own 24-commit set (104). HEAD^2 = the new merge-base 3508869ff. The PR's content diff against the new base is byte-identical to the pre-merge diff against the old base (0 lines of difference — main touched none of the 9 files). No sibling file was attributed to this branch.

7. Honesty spot-checks — confirmed

• check:dual-build-cjs-loads and check:published-readme-exports observed exit 3 at the new head, each printing PREREQUISITE NOT MET. NOT MEASURED.
• "Cannot find package @objectstack/spec/contracts" in a fresh worktree: engine.ts:14 value-imports RESUME_AUTHORITY_SERVICE from @objectstack/spec/contracts, which service-automation resolves through dist (its only vitest alias is @objectstack/platform-objects). Unbuilt-closure trap, not a real failure — the dev's reading is right.

Re-run here: @objectstack/service-automation full suite 110 files / 1323 tests passed (vitest exit 0, output captured to file, 0 FAIL lines).

Limits / NOT MEASURED by this round: every reading used the round-1 dist (built at the pre-merge base) — main's merge touched packages/spec/src/automation/flow.zod.ts only to add a duplicate-edge-id superRefine, immaterial to these readings, and no build was run on the contended box; @objectstack/runtime not re-run (no PR-side runtime change between the two heads — the PR-side diff of packages/runtime is empty); eslint, typecheck, the 60 green gates, @objectstack/mcp / dogfood / approvals suites; X2 (#15812) not re-driven; round-1 items not re-run, per the brief.

Reviewer: domain:services PM seat (session 03324ae2-0f5b-5ad2-8a2e-cf4aaff5a909), clause-② contract review, round 2.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XpTx2tbq3pZRYAdoGt6E6Y

Generated by Claude Code

Clause-② contract review, round 3 — PR #15787 (card #15705), head c31fdc8c7 (merge-base cc5b3dd0c)

Tier: CONTRACT_REVIEW_TIER = 'claude-fable-5-1' (scripts/pm/dispatch-gates.mjs:9429). Evidence: override + self-report — the PM attests this Agent call carried an explicit model: fable override, and the reviewer's own system-prompt identity is claude-fable-5-1. Not an exact-match claim.

Verdict: PASS. The round-2 residual is closed on the door that carries it and on the door that disproved revision 1; a genuine caller still continues; each of the three row-id candidates is separately load-bearing under mutation; the boundary is stated as a skip. Two findings to carry, neither of which makes a published behaviour claim false in the unsafe direction: the accepted-cost sentence is imprecise both ways (§2), and the boundary has a second construction the section does not name (§4). Both are one-sentence edits; I would not hold the PR for them, and I say why.

Scope: only what revision 3 changed. Rounds 1–2 stand. Same detached worktree at the new head; tree clean at the end; nothing pushed, no branch touched, no stash. One build this round: @objectstack/spec alone at --concurrency=1, because main's second merge made engine.ts import structuralConditionRefusal, which my pre-merge dist lacked (see limits).

1. The residual — closed, end to end

The shape that skipped in round 2 (recordIdField: 'token' + recordIdParam: 'sessionToken', a key the record lacks) is seeded only by seedFlowActionParams — i.e. the actions door; buildAutomationContext (the console door) seeds recordId and the alias and nothing else. So the residual lives on the actions door, and the console door is the one that disproved revision 1. Driven on both, engine-level, no caller params:

Mechanism confirmed by reading: params.recordId carries the dispatcher's row id under any recordIdField, so 'tok_9' is now Object.is-equal to a candidate and refused. The dev's 24 pins pass at the new head.

2. The widening — sound; the stated cost is imprecise in both directions

Adding the alias's value and record.id as candidates fails toward pausing on every shape I could build; on the merits it is fine. Feature alive: a genuine caller supplying subject + dueDate continues with its values on the actions door.

The cost claim (body, changeset, flows.mdx): "a screen field named recordId or the object-id alias is now always collected interactively, even from a headless caller, and so is any field whose value happens to equal the launched row's id." Measured:

• Accurate for the central case: a required field whose value equals the row id, genuinely supplied → paused.
• Overstated (safe direction): an optional field whose value equals the row id, with another required field supplied → continued, and the value bound ({subject:'x', parentId:'lead_1'} in the output). The same holds for an optional field named recordId. "Always collected interactively" is true only of required fields; an optional one is simply not counted toward condition 1.
• Understated (pause-only, contrived): the refusal set is "equal to whatever the bag carries under recordId, the alias, or record.id", which is the launched row's id on every real door unless the caller or the schema redefines those keys. Three such shapes measured, all paused: console door with the caller overriding params.recordId = 'X' and sending ref: 'X'; console door with the caller overriding crmLeadId = 'Y' and sending parent: 'Y'; actions door where the record carries a recordId column 'shadow' and the caller sends ref: 'shadow'. None of those values is the launched row's id.

Why I do not read this as blocking: the sentence is true for every unmodified door; the shapes it omits require a self-inconsistent caller (overriding the id keys with a different value) or a column literally named recordId/<object>Id — the same shadowing the boundary section already describes — and every omitted case is a pause. Precise wording, one sentence: "a field is never treated as caller-supplied when it is named recordId or <object>Id, or when its value equals what the bag carries under recordId, <object>Id, or record.id (normally the launched row's id); a required such field is therefore always collected interactively, an optional one simply does not count as answering the screen."

3. Candidate discrimination — real, not asserted

All four, each proved on disk (git hash-object before/after), restored to HEAD blob 34585de with an empty git diff HEAD, under trap … EXIT INT TERM:

23 of 24 stay green under each single-candidate drop, so no candidate is answerable by another fixture. The disclosed "was 0 red before the fixtures" is consistent by construction — the token pin seeds 'tok_9' under all three keys, so any one candidate satisfies it — reasoned, not re-measured.

4. The boundary — stated as a skip; a second construction exists

The section says the remaining conjunction "skips rather than pauses — said plainly", and it does: object-less action, record carrying a recordId column, recordIdField: 'token', recordIdParam: 'sessionToken', authentic bag {…record, recordId:'shadow', sessionToken:'tok_9'} (no alias seeded — '', '*' and 'global' are the object-less keys) → run completed with {sessionToken:'tok_9'}. Not softened.

Finding — a second construction, same class: the alias candidate is lost not only when no object is bound but also when the record shadows the alias key itself. Object-bound crm_lead, record {id, token:'tok_9', recordId:'shadow', crmLeadId:'shadow2'}, same recordIdField/recordIdParam, authentic bag {…record, sessionToken:'tok_9'} → run completed with {sessionToken:'tok_9'}. Controls: shadow only recordId on an object-bound action → paused (alias value); object-less with the default recordIdField → paused (record.id). So the boundary is "every candidate shadowed", of which object-lessness is one way to lose the alias and a <object>Id column is the other. The body's own sentence ("a record column can shadow any one of them") already implies it; the boundary paragraph should name it. Same inference limit, same skip direction, same remedy (an explicit provenance signal, scoped out); no real declaration has either shape. Not blocking on that basis.

No third construction found: every other seeded key is name-refused, the record leg refuses every column, and the console door seeds nothing the name legs miss.

5. Merge and honesty

• Merge with origin/main at cc5b3dd0c: --remerge-diff empty; 9 files against the main parent; the PR's content diff is byte-identical across the merge (0 lines of difference).
• Pins: 24/24 at the new head. Re-run here after the spec rebuild: @objectstack/service-automation full suite 111 files / 1340 tests passed (vitest exit 0, captured to file, 0 FAIL lines).
• The dev's exit-code discipline (single command, redirect, $? immediately) is the right reading of the trap I fell into myself in round 1.

Limits / NOT MEASURED: @objectstack/runtime full suite not re-run (the PR's runtime files are unchanged in revision 3); eslint, typecheck, the 60 green gates and the new check:dts-closure, @objectstack/mcp / dogfood / approvals; the "0 red before the fixtures" claim (reasoned only); the two exit-3 gates not re-run this round (confirmed at both earlier heads). Every reading before the spec rebuild ran with structuralConditionRefusal undefined in dist — provably off the screen-judging path (registerFlow would otherwise have thrown) — and the pins and my constructions were re-run after the rebuild with the same results.

Reviewer: domain:services PM seat (session 03324ae2-0f5b-5ad2-8a2e-cf4aaff5a909), clause-② contract review, round 3.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XpTx2tbq3pZRYAdoGt6E6Y

Generated by Claude Code

PM verification of the revision-4 fix-up — undrafted and armed

Verified independently at head 2041951a18e94ada28aeb46b81d0297b0e22d72c before undrafting. No fourth review round: the change is prose only, and I checked that rather than accepting it.

"No source change" proved by blob hash, not by the diffstat. Against revision 3 (c31fdc8c7), each of the four source files the behaviour lives in is byte-identical:

with .changeset/screen-flow-headless-satisfaction.md as the control in the same comparison — it reports CHANGED, so an all-identical result is a measurement rather than a broken comparison. ⚠️ Note the raw c31fdc8c7 → 2041951a1 diffstat shows 132 files; that is origin/main moving under the branch (merged at 6acb37eb9), not this PR's content. The PR's own merge-base diff is 9 files, +1148/−7 — revision 3's 9 files plus the +8/−6 of prose.

Fences on the merge-base diff, all 0: ^packages/mcp/, ^packages/spec/, content/docs/releases, packages/plugins/ — with service-automation = 3 as the control that the scan fires at all.

node scripts/check-adr-0087-registration.mjs --base origin/main --head 2041951a1… → exit 0.

The two closes

1. The cost sentence is genuinely identical across both shipped files — extracted from each and compared: 345 characters, byte-equal, with a deliberately-impossible variant as the control returning 0 length. ⚠️ My first comparison reported a mismatch and was wrong: I had extracted to end-of-line, and the changeset's line continues with two further sentences that flows.mdx places elsewhere. Scoping the extraction to the sentence itself is what settles it. The wording is the reviewer's, not re-invented.

The half that mattered was the overstatement, and it was in the changeset, which feeds release notes: revision 3 claimed a row-id-valued field is "always collected interactively", when an optional one continues with the value bound. A reader would have expected a prompt they will not get. The understated half (values equal to a caller-overridden params.recordId/alias, or to a shadowing recordId column) is now covered too, though it was always the safe direction — every one of those pauses.

2. The boundary section names both constructions and calls both what they are. It now reads "it skips rather than pauses — said plainly, in both of the shapes that reach it", then separates them by how the alias candidate is lost: an object-less action whose record carries a column literally named recordId, and an object-bound action whose record shadows both recordId and the alias key (a crmLeadId column on crm_lead). ⛔ Neither is softened into a pause, and the remedy is unchanged — an explicit caller-provenance signal, which is #15705's open question B and the maintainer's.

What this PR's history is actually worth recording

Four passes, and each one found a construction the previous had not — X1 at the buildAutomationContext door, then a self-declared residual that measured as a skip rather than the pause it was described as, then a fixture set that could not tell its own three candidates apart, then a cost sentence wrong in both directions. ⭐ The dev's own reading of that pattern is the right one and it is in the PR body: this module infers what the caller meant, and every dispatcher seed it does not know about re-opens the question. That is an argument for the provenance signal, not against this PR — which ships the documented-boundary option and states the boundary plainly.

⭐ Worth keeping separately: the dev found the fixture defect against its own tests and reported it rather than quietly fixing it. Dropping params.recordId — the exact line revision 3 was asked to add — left all 21 pins green, because one pin was satisfiable by any of the three candidates. Had that gone unreported, the residual could have come back silently, which is the one thing those pins exist to prevent.

⛔ Still Part of #15705, not a closing keyword. The third expectation — a resume_run verb on the MCP surface — expands a published, authorizable surface and is not carried here; the card stays open as its carrier.

Undrafted and auto-merge armed.

Generated by Claude Code