chore: version packages (rc)

Author: github-actions[bot]

.changeset/pre.json

@@ -152,7 +152,9 @@
     "agents-md-worktree-staleness",
     "agents-pd12-alias-retirement-path",
     "agents-pd12-shim-retired",
+    "agents-releases-freeze-merge-queue",
     "agents-spec-generated-artifacts-map",
+    "aggregate-bulk-dispatch-selected-ids",
     "aggregate-temporal-output",
     "aggregation-vocabulary-lockstep",
     "ai-agent-authoring-and-tools-removal",
@@ -194,6 +196,7 @@
     "approval-attachment-descriptors",
     "approval-dead-run-ordering-invariant",
     "approval-dead-run-record-lock",
+    "approval-decision-survives-restart",
     "approval-empty-position-admin-override",
     "approval-lock-schedule-run-provenance",
     "approval-participant-visibility",
@@ -214,6 +217,7 @@
     "auth-validationerror-4xx-mapping",
     "authorable-surface-ratchet",
     "authoring-key-lint-full-coverage",
+    "authoring-rule-command-coverage-registry",
     "authz-ledger-flow-runas",
     "automation-client-resume-screen-flow",
     "automation-resume-authority-gate",
@@ -222,6 +226,7 @@
     "batch-dropped-fields-observability",
     "better-auth-1-7-0-rc-2-and-prod-dep-batch",
     "better-auth-team-member-count",
+    "blueprint-summary-operations",
     "body-write-lint-message-driver-truth",
     "boot-api-merge",
     "builtin-node-config-reconciliation",
@@ -246,6 +251,7 @@
     "client-keys-sharelinks-security",
     "client-meta-automation-descriptors",
     "client-packages-lifecycle",
+    "client-readme-retired-validate-only",
     "client-retires-parking-spot-read",
     "client-url-conformance-capstone",
     "close-approvals-and-record-shares-gaps",
@@ -254,8 +260,10 @@
     "close-the-eight-reports-rest-gaps",
     "close-the-final-nine-rest-gaps",
     "close-the-nine-metadata-rest-gaps",
+    "cold-boot-flow-bind-read-decorations",
     "connector-authoring-guide",
     "connector-descriptors-meet-their-contract",
+    "connector-template-cluster-removed",
     "console-09c6a177bb4a",
     "console-1bb77aa24514",
     "console-2cb8d78e24ad",
@@ -280,12 +288,15 @@
     "datasource-admin-503-names-its-own-service",
     "datasource-availability-observability",
     "datasource-bound-connect-failfast",
+    "datasource-config-driver-contract",
+    "datasource-read-replicas-removed",
     "datasource-routes-catch-service-throws",
     "datasource-teardown-ownership",
     "date-bucket-parity-gate",
     "date-now-default-utc",
     "datetime-canonical-utc-storage",
     "datetime-storage-form-memory-mongodb",
+    "decision-branch-routing-enforced",
     "decision-outputs-surface-3447",
     "declared-unique-index-not-legacy",
     "default-datasource-adopt-seam",
@@ -300,6 +311,7 @@
     "dev-plugin-production-hatch-brands",
     "dev-plugin-protocol-family-removed",
     "dev-plugin-security-stubs-and-prod-guard",
+    "discovery-cache-queue-job-no-route",
     "discovery-data-slot-computed",
     "discovery-metadata-slot-computed",
     "discovery-remedy-names-a-real-package",
@@ -362,14 +374,18 @@
     "filter-no-silent-drop",
     "filter-tokens-runtime-resolver",
     "find-data-wire-context",
+    "findone-requires-a-predicate",
     "fix-stale-hono-changeset-ref",
     "fix-stale-scaffolder-changeset-refs",
     "fix-unmounted-local-file-url",
     "flow-action-record-id-seeding",
+    "flow-branch-gates-and-inert-condition",
+    "flow-condition-bare-string-is-cel",
     "flow-create-record-write-lint",
     "flow-error-object-serialization",
     "flow-executors-parse-config",
     "flow-filter-collapse-and-write-path-tokens",
+    "flow-function-declared-effect",
     "flow-lookup-expand",
     "flow-max-retries-single-default",
     "flow-nested-region-walk",
@@ -429,6 +445,7 @@
     "isLikelyEmail-no-control-char",
     "job-placeholder-migrates-to-db-adapter",
     "job-retry-timeout-3494",
+    "kernel-metadata-loader-envelope-removed",
     "keyset-batch-walks",
     "lazy-deps-dist-probe-timeout",
     "lifecycle-event-registry-enforced",
@@ -440,6 +457,7 @@
     "lint-unique-double-declaration",
     "list-column-prefix-summary-object",
     "liveness-evidence-path-resolution",
+    "liveness-governs-every-registered-type",
     "liveness-ledger-ai-scope-honesty",
     "liveness-orphan-row-gate",
     "liveness-register-orphan-proofs",
@@ -461,6 +479,7 @@
     "metadata-remove-artifact-api-source",
     "metadata-type-registration-names-a-real-hook",
     "metadata-unresolvable-posture-fail-closed",
+    "migrate-meta-stored-rewrite",
     "migrate-occupancy-and-deferred-ddl",
     "migrate-occupancy-file-descriptor-signal",
     "migrate-plan-lists-datetime-convergence",
@@ -516,8 +535,10 @@
     "query-having-enforced",
     "rbac-objects-bulk-primitive",
     "react-block-field-props-lint",
+    "react-blocks-declaration-parity-not-conformance",
     "react-listview-searchable-fields-lint",
     "react-page-props-joins-the-suite",
+    "react-tier-record-blocks-withdrawn",
     "readme-fde-audience",
     "readonly-flow-write-json-warning",
     "readonly-flow-write-lint",
@@ -591,12 +612,14 @@
     "runtime-domain-extraction-batch3",
     "runtime-domain-handler-registry",
     "runtime-meta-data-extraction",
+    "runtime-overlay-not-artifact",
     "runtime-packages-extraction",
     "runtime-share-links-extraction",
     "sandbox-structured-error-passthrough",
     "savemeta-persists-normalized-operators",
     "scaffolds-drop-memory-driver",
     "schemaless-node-config-contracts",
+    "schemaless-node-expression-ledger",
     "scim-provider-key-and-sso-scim-parity",
     "scoped-invitation-placement",
     "screen-field-visible-when-on-the-wire",
@@ -661,13 +684,16 @@
     "storage-adapter-swap-verdict",
     "storage-download-filename",
     "stored-metadata-replays-the-chain",
+    "stored-migration-covers-flows",
     "strictness-ledger-gate",
     "strictness-ledger-recursive-coverage",
     "strip-read-decorations-on-save",
+    "summary-index-registry-revision",
     "sweep-close-out",
     "sys-migration-ledger-platform-infra",
     "sys-secret-store-platform-infra",
     "sys-view-definition-default-open",
+    "system-field-name-injected-columns",
     "temporal-conformance-matrix",
     "temporal-conformance-stall-guard",
     "temporal-conformance-token-axis",
@@ -676,6 +702,7 @@
     "temporal-hooks-on-contract",
     "temporal-storage-form-axis-tests",
     "temporal-time-axis",
+    "tenancy-default-org-fail-closed",
     "tender-hats-brush",
     "test-core-stall-guard",
     "tests-off-memory-driver",
@@ -702,6 +729,7 @@
     "unordered-paged-read-determinism",
     "update-record-dropped-field-warnings",
     "url-field-accepts-relative-urls",
+    "user-field-implicit-target",
     "user-less-run-data-ops-refused",
     "user-level-export-axis",
     "v17-dissolve-protocol-alias",
@@ -721,6 +749,7 @@
     "webhook-liveness-ledger-flip",
     "webhooks-drop-dead-delivery-i18n",
     "wildcard-fallthrough-guard",
-    "withdraw-adr-0107-drop-writes-proposal"
+    "withdraw-adr-0107-drop-writes-proposal",
+    "workflow-slot-retired"
   ]
 }

examples/app-crm/CHANGELOG.md

@@ -1,5 +1,126 @@
 # @objectstack/example-crm
 
+## 4.0.92-rc.2
+
+### Patch Changes
+
+- 5293114: fix(automation): a decision's three declared ways to route a branch are now one working model (#4414)
+
+  A `decision` node advertised three mechanisms for splitting a path and only one
+  of them did anything. The other two were the ADR-0049 `declared ≠ enforced`
+  shape, and the pair of them shipped a guard that does not guard in
+  `examples/app-crm`.
+
+  | mechanism                                            | before                                                                                                 | now                                                   |
+  | :--------------------------------------------------- | :----------------------------------------------------------------------------------------------------- | :---------------------------------------------------- |
+  | `edge.condition`                                     | ✅ the only one that worked                                                                            | unchanged                                             |
+  | `edge.isDefault`                                     | **zero readers** anywhere but the schema declaration                                                   | BPMN default flow, enforced in `traverseNext`         |
+  | `decision.config.conditions[].label` → `branchLabel` | matched **0** out-edge labels across every example app, then fell back to the full edge set in silence | routes; an unclaimable label is logged, not swallowed |
+
+  ## What was broken, end to end
+
+  `crm_convert_lead_wizard` means "already converted → abort screen; otherwise →
+  the wizard". It ran **both**: an already-converted lead got
+  "This lead has already been converted" and then walked straight into the
+  conversion wizard behind it. Four independent silences stacked up:
+
+  1. the decision's first condition was authored `{lead_record.status} ==
+'converted'` — braces in a slot declared bare CEL, so it was string-compared
+     and never true;
+  2. the second (`'true'`) therefore won, yielding `branchLabel: 'No — proceed'`;
+  3. no out-edge carried that label (they were `'Yes'` / `'No'`), so traversal
+     discarded the branch and considered every out-edge;
+  4. `e3b` was unconditional, so it ran regardless — and the natural fix, marking
+     it `isDefault: true`, was a dead key.
+
+  ## The model
+
+  `branchLabel` narrows the edge set → `condition` gates each edge → `isDefault`
+  catches whatever is left. Concretely:
+
+  - **`isDefault` is enforced.** A default edge is traversed only when no
+    conditional sibling of the same source node matched, and it is no longer part
+    of the unconditional parallel fan-out — that distinction is the whole point of
+    the marker. Passed over because a real branch won, its target records the same
+    `skipped` step a closed gate does (#4354).
+  - **An unclaimable branch label warns.** Traversal still falls back to the full
+    edge set (a run mid-flight must not die on a metadata error) but says so,
+    naming the computed branch and the out-edge labels that exist.
+  - **A decision that declares no `conditions` reports no branch.** It used to
+    report `'default'` unconditionally — a label no out-edge in the repo ever
+    carried — which is why every decision node fell back to the full edge set.
+    The `'default'` sentinel survives for the case it actually describes (declared
+    conditions, none matched) and is now claimed by the `isDefault` edge as well
+    as by an edge literally labelled `'default'`.
+  - **`conditions[].expression` is evaluated as the bare CEL it is declared to
+    be.** The raw string went to the legacy `{var}` template path, where
+    `lead.status == 'converted'` cannot resolve and the branch is decided by
+    string comparison. Unlike `edge.condition` this slot carries no
+    `ExpressionInput` envelope — the decision descriptor is deliberately
+    schemaless — so the executor supplies the dialect. A brace-in-CEL predicate
+    now fails loudly (ADR-0032 §1c) instead of deciding `false`.
+
+  ## Caught at authoring time too
+
+  Four new `os build` / `os validate` warnings, because a wrong route is silent at
+  run time by nature (Prime Directive #12):
+
+  `flow-branch-label-unmatched` (the shipped shape),
+  `flow-decision-unconditional-branch` (a guarded decision with an unconditional
+  sibling — the actual hole), `flow-default-edge-with-condition` and
+  `flow-multiple-default-edges`.
+
+  Both of the first two fire on the pre-fix `convert-lead.flow.ts` and are silent
+  after it.
+
+  ## Effect on flows that already exist
+
+  Enforcing `isDefault` changes how a **stored** flow behaves, and the flows it
+  changes are mostly Studio's own. `objectui`'s flow edge inspector has always
+  written `isDefault: true` when you bind an out-edge to a decision's default/else
+  branch — into a key with zero readers, so that edge ran unconditionally, in
+  parallel with whichever branch actually matched. Those flows now take exactly
+  one branch. That is the fix, but it is a behaviour change on existing data
+  rather than only on newly authored metadata, so it is worth knowing before
+  upgrading: a flow that quietly ran two paths will now run one.
+
+  Nothing changes for an edge that never carried the marker — `isDefault` defaults
+  to `false`, and an ordinary unconditional out-edge still fans out in parallel
+  exactly as before.
+
+  ## The example app
+
+  `crm_convert_lead_wizard`'s guard is now a plain exclusive gateway: the
+  redundant `config.conditions` is gone and `e3b` carries `isDefault: true`. One
+  mechanism per decision, and exactly one branch runs.
+
+  Verified: 11 new engine/executor tests (including the reported repro in both
+  directions), 12 new linter tests; `@objectstack/service-automation` 577 tests
+  and `@objectstack/cli` 652 tests green, all three example apps build with no new
+  findings.
+
+- Updated dependencies [e6b1b69]
+- Updated dependencies [2826d1e]
+- Updated dependencies [462d9c4]
+- Updated dependencies [5b843fb]
+- Updated dependencies [b4487aa]
+- Updated dependencies [cdf4d9a]
+- Updated dependencies [9ca2d85]
+- Updated dependencies [5293114]
+- Updated dependencies [20bc357]
+- Updated dependencies [ec975f1]
+- Updated dependencies [eb4204b]
+- Updated dependencies [cf2c9b7]
+- Updated dependencies [0f9faa2]
+- Updated dependencies [9c93465]
+- Updated dependencies [ebb209c]
+- Updated dependencies [f3141d8]
+- Updated dependencies [04f1182]
+- Updated dependencies [ad5fe25]
+- Updated dependencies [dadb43f]
+  - @objectstack/spec@17.0.0-rc.2
+  - @objectstack/runtime@17.0.0-rc.2
+
 ## 4.0.92-rc.1
 
 ### Patch Changes

examples/app-crm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/example-crm",
-  "version": "4.0.92-rc.1",
+  "version": "4.0.92-rc.2",
   "description": "Minimal CRM example — a smoke-test workspace that exercises the metadata loading pipeline (objects → views → app → dashboard → hook → flow → seed). For a full-featured enterprise CRM see https://github.com/objectstack-ai/hotcrm.",
   "license": "Apache-2.0",
   "private": true,