Merge origin/main into claude/issue-16111-flow-template-leaves-outside-filters

origin/main landed a change to `packages/lint/src/lint-flow-patterns.ts` — the
other caller of `stripRegions`, whose behaviour this branch's signature change
has to preserve. Merged before opening the PR so the suite is measured on the
joint tree (AGENTS.md §10).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vbw3RPgdtqesx4azk9SbW8

Author: claude

.changeset/flow-decision-gates-on-nothing.md

@@ -0,0 +1,11 @@
+---
+"@objectstack/lint": patch
+---
+
+`flow-decision-unconditional-branch` now reports the decision that gates on nothing — the shape the rule used to skip.
+
+A `decision` whose out-edges carry no `condition` and no `isDefault`, and whose node declares no `config.conditions[]`, selects no branch at all: the automation engine's own decision executor reports no branch when `conditions[]` is empty, so traversal considers every out-edge and each successor runs on every pass. The gateway is decoration. The rule could not see that shape, because it was framed as "an unconditional edge undercuts a guarded one" and read zero guarded edges as nothing to undercut — so the strictly worse gateway was the one case that stayed silent, and it is the harder one to notice in review, because the node still says `type: 'decision'`.
+
+Same rule id, same `warning` tier, with its own message: it names the out-edges that run unconditionally and offers the three fixes (a `condition` per branch plus `isDefault: true` on the fallback, a `config.conditions[]` whose `label` matches an out-edge, or dropping `type: 'decision'` for the node the gateway already behaves as). The mixed shape — one guarded out-edge beside an unconditional one — keeps its existing wording and its single finding.
+
+Decisions that do declare their routing stay silent, including the two that are easiest to catch by mistake: an ordinary gateway with guarded edges, and a decision that routes by `config.conditions[]` labels alone with bare out-edges. A decision declaring a label no out-edge claims remains the gating `flow-branch-label-unmatched` on its own, with no second finding piled on the same node.

.changeset/screen-provenance-record-leg-by-value.md

@@ -0,0 +1,15 @@
+---
+"@objectstack/service-automation": patch
+---
+
+A wizard screen is no longer skipped after a durable pause because a record column happens to be an array.
+
+`judgeHeadlessScreen` decides a screen was already answered by proving the negative: a field is **not** caller-supplied when the subject record carries that key and `params` holds the same value — necessary because the params bag a flow action arrives with is `{ ...record, recordId, <object>Id, ...params }`, so every column of the launched row is in there whether the caller named it or not.
+
+That comparison was reference identity (`Object.is`), which is real in memory and does not survive persistence. A suspended run stores its context as JSON and resumes from the parsed copy — and the store is preferred over the in-process cache whenever one is wired, so no restart is needed. After that round trip an **array or object** column is equal but no longer identical: the record leg could not disprove it, the field read as caller-supplied, and a later screen with no required fields of its own was **skipped on a run that had supplied nothing**. An interactive user pressed a button and never saw a form they should have been shown; the run completed carrying the row's own value as if they had typed it. Reproduced end to end against a wired store, not inferred.
+
+The record leg now compares by value (`isDeepStrictEqual`), which survives serialisation. That predicate compares primitives with `Object.is` itself, so this is a strict widening of the "not caller-supplied" set — every pair the old check called equal it still calls equal, plus the structurally identical non-primitives. More screens render, never fewer, which is the direction this module resolves every ambiguity in.
+
+**Accepted cost, precisely.** A caller that genuinely re-sends a value structurally identical to the row's column is no longer distinguishable from the dispatcher's seed, so it now gets the screen rendered instead of skipped — a lost skip on a headless call, never a lost run, and the same trade the module's other legs already make. Scalar columns behave exactly as before, on both sides of a pause. The row-id leg keeps identity comparison deliberately: a row id is a scalar by construction, so serialisation cannot defeat it and there is nothing there to widen. Measured overhead is a deep compare per declared screen field at screen entry: ~1.5 µs added for a deliberately maximal screen that declares a field for every one of a ten-column row, which is about 38% of one `JSON.stringify` of the run context — a cost the durable store already pays on every suspend.
+
+This closes the gap the same release's screen-flow headless-satisfaction note records as known.

.changeset/suspend-snapshot-aliasing.md

@@ -0,0 +1,13 @@
+---
+"@objectstack/service-automation": patch
+---
+
+A restored suspension now carries the state the run was paused with, including nested values.
+
+`restoreConsumedSuspension` is the operator exit from a run whose resume consumed the pause and then failed downstream: it puts the suspension back so the run is resumable again. What it put back was documented as the pause "verbatim", and was — for the top-level variables only.
+
+The flow scope a resume hands the downstream nodes was rebuilt as `new Map(Object.entries(run.variables))`: that copies the keys and shares every value object with the parked snapshot. An executor that keeps state in the scope and updates it **in place** — `map` tracks its progress in `<nodeId>.$mapState` — therefore wrote straight through into the snapshot, and the journal recorded the result as the pause. An operator repairing a stranded `map` run got a snapshot claiming progress made by the attempt that failed, not the progress the run actually had when it paused.
+
+Measured, not inferred: the durable row held `started: 1` at the pause and the restore put back `started: 99`.
+
+The pause's variables are now copied before the failed attempt runs, on the line that already captures the pause's step count for the same reason. No later placement works — the node mutates and then throws, so a copy taken when the journal is written copies the mutation. Nothing else changes: the running flow still sees exactly the scope it saw before, the resume ordering is untouched, and a value that cannot be copied falls back to the previous behaviour with a warning rather than costing the operator the repair.

packages/lint/src/lint-flow-patterns.test.ts

@@ -893,7 +893,18 @@ describe('flow-error-label-not-fault (#3863)', () => {
   it.each(['decision', 'approval'])(
     "does NOT flag label:'error' out of a %s node — the label IS the branch selector",
     (sourceType) => {
-      expect(lintFlowPatterns(edgeFlow({ label: 'error' }, sourceType))).toHaveLength(0);
+      // Scoped to THIS rule since #16093. The assertion was a global zero,
+      // which held only because the fully-inert decision was invisible: the
+      // `decision` half of this fixture declares no `conditions[]` and no edge
+      // is guarded, so it now (correctly) draws a `flow-decision-unconditional-
+      // branch` warning of its own. A bare `label` is not a guard in either
+      // half of that rule — the mixed branch has always counted a labelled
+      // edge the decision cannot select as ungated — so exempting it here to
+      // keep the zero would make one rule id answer two ways. What this case
+      // tests is unchanged: an error-ish label out of a branching node is not
+      // the #3863 footgun.
+      const fnds = lintFlowPatterns(edgeFlow({ label: 'error' }, sourceType));
+      expect(fnds.filter((f) => f.rule === FLOW_ERROR_LABEL_NOT_FAULT)).toHaveLength(0);
     },
   );
 });
@@ -1013,8 +1024,15 @@ describe('flow-decision-unconditional-branch (#4414)', () => {
     })).filter((f) => f.rule === FLOW_DECISION_UNCONDITIONAL_BRANCH)).toHaveLength(0);
   });
 
-  it('does NOT flag a decision with no guarded edge at all — nothing to undercut', () => {
-    expect(lintFlowPatterns({
+  // #16093 — the fully-inert gateway, the shape the rule could not see. Until
+  // this case landed, `if (gated.length === 0) continue` dropped exactly the
+  // node whose declared branching is worst: a `decision` with NO edge
+  // `condition`, NO `isDefault` and NO `config.conditions[]`. The mixed case
+  // (one guarded edge, one not) was at least partially routed; this one was not
+  // routed at all, and it is the harder one to spot, because the node still
+  // says `type: 'decision'`.
+  it('flags a decision that gates on NOTHING — no edge guard, no conditions[]', () => {
+    const fnds = lintFlowPatterns({
       flows: [{
         name: 'plain',
         nodes: [{ id: 'start', type: 'start', config: {} }, { id: 'check', type: 'decision' }, { id: 'a', type: 'screen', config: {} }],
@@ -1023,9 +1041,152 @@ describe('flow-decision-unconditional-branch (#4414)', () => {
           { id: 'e2', source: 'check', target: 'a' },
         ],
       }],
+    }).filter((f) => f.rule === FLOW_DECISION_UNCONDITIONAL_BRANCH);
+
+    expect(fnds).toHaveLength(1);
+    // Advisory, like the mixed shape: an unconditional fan-out is legal — the
+    // node is merely typed `decision` while behaving as a plain step. See the
+    // severity policy at the top of the rule module.
+    expect(fnds[0].severity).toBeUndefined();
+    expect(fnds[0].where).toContain("decision 'check'");
+    // Names the node's out-edge targets and what the decision gates on.
+    expect(fnds[0].message).toContain('gates on NOTHING');
+    expect(fnds[0].message).toContain("'a'");
+    expect(fnds[0].message).toContain('EVERY pass');
+    expect(fnds[0].hint).toContain('conditions');
+  });
+
+  // The wording is the whole point of keeping this under the SAME rule id: the
+  // fully-inert shape must NOT read as the mixed "guarded alongside unguarded"
+  // sentence, which would send the author looking for a guard that is not there.
+  it('does not describe the inert decision with the mixed-branch wording', () => {
+    const inert = lintFlowPatterns({
+      flows: [{
+        name: 'plain',
+        nodes: [{ id: 'start', type: 'start', config: {} }, { id: 'check', type: 'decision' }, { id: 'a', type: 'screen', config: {} }],
+        edges: [
+          { id: 'e1', source: 'start', target: 'check' },
+          { id: 'e2', source: 'check', target: 'a' },
+        ],
+      }],
+    }).filter((f) => f.rule === FLOW_DECISION_UNCONDITIONAL_BRANCH);
+    expect(inert[0].message).not.toContain('alongside');
+
+    const mixed = lintFlowPatterns(guardFlow()).filter(
+      (f) => f.rule === FLOW_DECISION_UNCONDITIONAL_BRANCH,
+    );
+    expect(mixed[0].message).toContain('alongside');
+    // One finding each — the inert branch must not double-report the mixed one.
+    expect(mixed).toHaveLength(1);
+  });
+
+  it('flags EVERY out-edge of an inert decision in one finding, not one each', () => {
+    const fnds = lintFlowPatterns({
+      flows: [{
+        name: 'plain',
+        nodes: [
+          { id: 'start', type: 'start', config: {} },
+          { id: 'check', type: 'decision' },
+          { id: 'a', type: 'screen', config: {} },
+          { id: 'b', type: 'screen', config: {} },
+        ],
+        edges: [
+          { id: 'e1', source: 'start', target: 'check' },
+          { id: 'e2', source: 'check', target: 'a' },
+          { id: 'e3', source: 'check', target: 'b' },
+        ],
+      }],
+    }).filter((f) => f.rule === FLOW_DECISION_UNCONDITIONAL_BRANCH);
+    expect(fnds).toHaveLength(1);
+    expect(fnds[0].message).toContain("'a'");
+    expect(fnds[0].message).toContain("'b'");
+  });
+
+  // As measured on the reporting app: the inert decision sat inside a `loop`
+  // body, so the finding has to survive region descent (#5383) too.
+  it('flags a nested inert decision inside a loop body', () => {
+    const fnds = lintFlowPatterns(loopBodyFlow({
+      nodes: [
+        { id: 'gate', type: 'decision' },
+        { id: 'nudge', type: 'create_record', config: { objectName: 'touch_log' } },
+      ],
+      edges: [{ id: 'b1', source: 'gate', target: 'nudge' }],
+    })).filter((f) => f.rule === FLOW_DECISION_UNCONDITIONAL_BRANCH);
+    expect(fnds).toHaveLength(1);
+    expect(fnds[0].where).toBe("flow 'campaign_enrollment' · loop 'loop_leads' body · decision 'gate'");
+    expect(fnds[0].message).toContain("'nudge'");
+  });
+
+  // ⛔ NEGATIVE CONTROL — the ordinary gateway. Guarded edges AND a matching
+  // `config.conditions[]`: the shape every correct flow has, and the one a new
+  // positive case is most likely to break. It must stay silent.
+  it('does NOT flag a normal decision — guarded edges plus matching conditions[]', () => {
+    expect(lintFlowPatterns(guardFlow({
+      proceed: { isDefault: true },
+      conditions: [{ label: 'Yes', expression: "lead.status == 'converted'" }],
+    }))).toHaveLength(0);
+  });
+
+  // ⛔ NEGATIVE CONTROL — routing by `config.conditions[]` alone. The edges
+  // carry no `condition` and no `isDefault`, so `gated` is empty, but the
+  // decision DOES declare its branching: the labels select the path. Not inert.
+  it('does NOT flag a decision that routes by conditions[] alone', () => {
+    expect(lintFlowPatterns({
+      flows: [{
+        name: 'by_label',
+        nodes: [
+          { id: 'start', type: 'start', config: {} },
+          {
+            id: 'check', type: 'decision',
+            config: { conditions: [{ label: 'Yes', expression: 'lead.score > 50' }, { label: 'No', expression: 'true' }] },
+          },
+          { id: 'a', type: 'screen', config: {} },
+          { id: 'b', type: 'screen', config: {} },
+        ],
+        edges: [
+          { id: 'e1', source: 'start', target: 'check' },
+          { id: 'e2', source: 'check', target: 'a', label: 'Yes' },
+          { id: 'e3', source: 'check', target: 'b', label: 'No' },
+        ],
+      }],
     })).toHaveLength(0);
   });
 
+  // ⛔ NO DOUBLE REPORT — a decision that declares `conditions[]` no out-edge
+  // claims is already the GATING `flow-branch-label-unmatched`; the inert branch
+  // must not pile a second, contradictory finding on the same node.
+  it('leaves an unmatched-label decision to flow-branch-label-unmatched alone', () => {
+    const fnds = lintFlowPatterns({
+      flows: [{
+        name: 'unmatched',
+        nodes: [
+          { id: 'start', type: 'start', config: {} },
+          { id: 'check', type: 'decision', config: { conditions: [{ label: 'Yes', expression: 'true' }] } },
+          { id: 'a', type: 'screen', config: {} },
+        ],
+        edges: [
+          { id: 'e1', source: 'start', target: 'check' },
+          { id: 'e2', source: 'check', target: 'a' },
+        ],
+      }],
+    });
+    expect(fnds.filter((f) => f.rule === FLOW_DECISION_UNCONDITIONAL_BRANCH)).toHaveLength(0);
+    expect(fnds.filter((f) => f.rule === FLOW_BRANCH_LABEL_UNMATCHED)).toHaveLength(1);
+  });
+
+  // A decision with no out-edge at all is a different defect and is skipped
+  // before any of this (`outs.length === 0`); the inert branch must not claim it.
+  it('does NOT flag a decision with no out-edge at all', () => {
+    expect(lintFlowPatterns({
+      flows: [{
+        name: 'dead_end',
+        nodes: [{ id: 'start', type: 'start', config: {} }, { id: 'check', type: 'decision' }],
+        edges: [{ id: 'e1', source: 'start', target: 'check' }],
+      }],
+    }).filter((f) => f.rule === FLOW_DECISION_UNCONDITIONAL_BRANCH)).toHaveLength(0);
+  });
+
+
   it('does NOT flag a fault edge — error routing is not branch selection', () => {
     expect(lintFlowPatterns(guardFlow({
       proceed: { isDefault: true },