docs(spec): the migration text offers a {token} only where http interpolates before its parse

The changeset's FROM -> TO rows and the D3 entry's replacement told an
author to write a {token} template in limit or maxIterations, but
get_record and loop parse their config as authored, so such a value
passes the build doors and fails every run. A number or boolean slot
outside http now takes a literal only, http's slots keep the sole-token
form, and the "still accepted" token bullet says the hold-back is no
promise the value runs. The step-18 fragment says the same; the
registry region is regenerated.

Claude-Session: https://claude.ai/code/session_01T9u38rswFp5Rw8DswRUReJ
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/21898-flow-builtin-node-config-values-refused.md

@@ -14,10 +14,10 @@ Clause-②: yes (narrowing)
 
 **What is refused.** A node of any builtin type (`get_record`, `create_record`, `update_record`, `delete_record`, `notify`, `http`, `screen`, `script`, `subflow`, `map`, `loop`, `parallel`, `try_catch`), at any depth, whose present config value its executor contract refuses — a wrong type, a value outside the declared set or range, an empty `function` / `flowName`, or a rule finding on present keys (a `notify` `template` beside an inline `title`). The refusal is the existing closed-set code `node-config-refused-by-contract`, `params: { nodeType, key }`, anchored at the key (`nodes.N.config.outputVariable`, `nodes.N.config.fields.0.min`), from the one judge `flowNodeConfigRefusals` that `FlowSchema.parse`, `AutomationEngine.registerFlow` (which parses first) and `objectstack validate` share. The issue's `code` is `custom`. That covers `FlowSchema`, `defineFlow()`, `defineStack` (`STACK_SCHEMA_INVALID`, 422, at `flows.N.nodes.M.config.<key>`), `os validate`, `os compile`, an artifact's parse, `registerFlow` and the metadata save door (`422 INVALID_METADATA`).
 
-**What stays accepted, byte for byte.** Every value its contract accepts, and the values the build cannot know the run will parse:
+**What the build doors still accept, byte for byte.** Every value its contract accepts, and the values this arm holds back:
 
-- a value carrying a `{token}` (also spelled with double braces or a leading `$`) — never refused for its pre-interpolation type;
-- on `http`, which parses after interpolating its whole config, any value with a token inside it, and `signingSecret` (the credential channel may supply it);
+- a value carrying a `{token}` (also spelled with double braces or a leading `$`) — never refused at the build doors for its pre-interpolation type. That is not a promise it runs: only `http` interpolates its config before it parses, so only an `http` slot sees the token's resolved value. Every other builtin parses its config as authored, so a token in one of its number or boolean slots (`limit: '{n}'`, `maxIterations: '{cap}'`, a screen field `min: '{m}'`, `multi: '{bulk}'`) still fails at its first run, exactly as before — write a literal there;
+- on `http`, any value with a token inside it, and `signingSecret` (the credential channel may supply it);
 - a `loop` with no `body` (its executor does not parse it), and the region slots of `loop`, `parallel` and `try_catch`;
 - an undeclared or retired key, a screen field's `visibleWhen` and a CRUD `fields` value — each keeps the judge it had.
 
@@ -27,14 +27,15 @@ Clause-②: yes (narrowing)
 |:--|:--|
 | `outputVariable: 42` | `outputVariable: 'taskId'` — the variable's name |
 | a screen field `min: '1'`, `max: '10'` | `min: 1`, `max: 10` |
-| `limit: '10'`, `timeoutMs: '5000'`, `maxIterations: '5'` | `limit: 10`, `timeoutMs: 5000`, `maxIterations: 5` — or a `{token}` template computed per run |
-| `multi: 'true'`, `durable: 'yes'`, a screen field `required: 'yes'` | `multi: true`, `durable: true`, `required: true` |
+| `limit: '10'`, `maxIterations: '5'` (any number slot outside `http`) | `limit: 10`, `maxIterations: 5` — a literal number only: these executors parse the config as authored, so a `{token}` here passes the build and fails every run |
+| `multi: 'true'`, a screen field `required: 'yes'` (any boolean slot outside `http`) | `multi: true`, `required: true` — a literal boolean only, for the same reason |
+| `http` `timeoutMs: '5000'`, `durable: 'yes'` | `timeoutMs: 5000`, `durable: true` — or, on `http` alone, a sole-token template such as `timeoutMs: '{timeout}'`: `http` interpolates before it parses, so the token resolves to its value's type first |
 | `severity: 'loud'`, `mode: 'view'` | one of the declared values (`'info'` / `'warning'` / `'critical'`; `'create'` / `'edit'`) |
 | a `notify` with both `template` and `title` | one content path, as the refusal's sentence says |
 
 **The one-line fix: write the value the contract declares at the key the refusal names.** The runtime never ran such a node, so the fix changes nothing a working flow does.
 
-**Who is affected, measured.** At `833d57c9cf`, every builtin node `config` authored in this repository's examples, docs, skills and `packages/qa` fixtures (96 nodes), and every one in hotcrm at `4054ec2680` (138 nodes), parses under this arm. The one real writer found to store a refused value is the Studio flow designer, which saved a screen field's Min / Max as strings until objectui `5ba255538a`. Deployed metadata, and other repositories, were not measured. Where such a node already sits in a stored flow, the whole flow is refused at registration: at boot it is skipped with a warn naming it, its trigger not armed, while the flows beside it register.
+**Who is affected, measured.** At `833d57c9cf`, every builtin node `config` authored in this repository's examples, docs, skills and `packages/qa` fixtures (96 nodes), and every one in hotcrm at `4054ec2680` (138 nodes), parses under this arm. A second census at `d1c7d8d392` that also reads helper calls, same-file constants and assignments into a node config (1065 configs in this repository, 138 in hotcrm) found no other real writer; 64 configs here take a value from an import, a call or a spread that no static reading evaluates, and are not counted either way. The one real writer found to store a refused value is the Studio flow designer, which saved a screen field's Min / Max as strings until objectui `5ba255538a`. Deployed metadata, and other repositories, were not measured. Where such a node already sits in a stored flow, the whole flow is refused at registration: at boot it is skipped with a warn naming it, its trigger not armed, while the flows beside it register.
 
 ### The kit
 

packages/spec/src/migrations/entries/semantic/18.flow-builtin-node-config-values-refused.ts

@@ -30,11 +30,14 @@ export const entry: SemanticMigration = {
   replacement:
     'the value the contract declares, written at the key the refusal names: a string where it wants a '
     + 'string (`outputVariable: \'taskId\'`), a number where it wants a number (`min: 1`, `limit: 10`, '
-    + '`timeoutMs: 5000`), a boolean where it wants a boolean (`multi: true`, `durable: true`), one of the '
-    + 'declared values (`severity: \'warning\'`, `mode: \'edit\'`), or a value inside the declared range. '
-    + 'A value meant to be computed per run is written as a `{token}` template (`limit: \'{page.size}\'`) — '
-    + 'the build never judges a token\'s type. For a rule finding, follow the rule\'s own sentence (keep '
-    + '`template` or the inline `title` / `message`, not both)',
+    + '`maxIterations: 5`, `timeoutMs: 5000`), a boolean where it wants a boolean (`multi: true`, '
+    + '`durable: true`), one of the declared values (`severity: \'warning\'`, `mode: \'edit\'`), or a value '
+    + 'inside the declared range. Outside `http`, a number or boolean slot takes a LITERAL only: those '
+    + 'executors parse the config as authored, so a `{token}` template there (`limit: \'{page.size}\'`, '
+    + '`maxIterations: \'{cap}\'`) passes the build doors and still fails every run. Only `http` '
+    + 'interpolates its config before it parses, so only an `http` slot may also take a sole-token template '
+    + 'that resolves to the declared type (`timeoutMs: \'{timeout}\'`, `durable: \'{durable}\'`). For a rule '
+    + 'finding, follow the rule\'s own sentence (keep `template` or the inline `title` / `message`, not both)',
   reason:
     'Every builtin executor (`service-automation` `builtin/`) parses its node\'s `config` against the '
     + 'contract `getBuiltinNodeConfigContracts()` names before it acts, and refuses the node on any '
@@ -46,8 +49,11 @@ export const entry: SemanticMigration = {
     + '`AutomationEngine.registerFlow` (which parses first) and `objectstack validate` share '
     + '(`flowNodeConfigRefusals`) now refuses such a value as `node-config-refused-by-contract`, anchored '
     + 'at the key, in the contract\'s own words — the code the approval contract already uses. It judges '
-    + 'only what the build can know the run will parse: a value carrying a `{token}` is never refused for '
-    + 'its pre-interpolation type; `http` parses after interpolating its whole config, so only token-free '
+    + 'only what the build can know the run will parse, and holds one more class back by ruling: a value '
+    + 'carrying a `{token}` is never refused at the build doors for its pre-interpolation type — which is '
+    + 'no promise it runs, since every builtin but `http` parses its config as authored and so still '
+    + 'refuses a token in a number or boolean slot at its first run; `http` parses after interpolating its '
+    + 'whole config, so only token-free '
     + 'values are judged there and never `signingSecret`, which the credential channel may supply; a '
     + '`loop` with no `body` is not parsed by its executor and is judged for nothing; the region slots of '
     + '`loop`, `parallel` and `try_catch` are judged as graphs of their own and by `validateControlFlow`. '
@@ -67,6 +73,9 @@ export const entry: SemanticMigration = {
     + 'For each hit write the value the contract declares, per the replacement. Two proofs. (1) For a '
     + 'stack authored in config files, `objectstack validate` is clean. (2) Boot the stack and confirm '
     + 'each flow REGISTERS: no `failed to register flow` warn for it — that warn line is the locator for '
-    + 'a row that exists only in `sys_metadata`. A node whose values its contract accepts, and any value '
-    + 'written as a `{token}` template, parses and registers byte-identically to before.',
+    + 'a row that exists only in `sys_metadata`. A node whose values its contract accepts parses and '
+    + 'registers byte-identically to before. A `{token}` template parses and registers as before too, and '
+    + 'runs only where the run parses it after interpolation (`http`) or where the slot takes a string; in a '
+    + 'number or boolean slot of any other builtin it fails at its first run exactly as it did, so write a '
+    + 'literal there.',
 };

packages/spec/src/migrations/registry.ts

@@ -5605,7 +5605,9 @@ const STEP18_RATIONALE: readonly RationaleFragment[] = [
       + 'contract before it acts, so a `create_record` `outputVariable: 42` or a screen field `min: \'1\'` '
       + 'used to pass `objectstack validate` and `objectstack compile`, register, and fail every run that '
       + 'reached the node. The arm judges only what the build can know the run will parse: never a value '
-      + 'carrying a `{token}`, whatever its slot\'s type; on `http`, which parses after interpolating, only '
+      + 'carrying a `{token}`, whatever its slot\'s type (held back by ruling, not admitted: outside `http` '
+      + 'such a token in a number or boolean slot still fails at its first run, so those slots take a '
+      + 'literal); on `http`, which parses after interpolating, only '
       + 'token-free values and never the credential-held `signingSecret`; on a `loop`, only one with a '
       + '`body`; on the region containers, never the region slots. Key membership is untouched. No key '
       + 'is removed, so there is no tombstone, and no D2 conversion exists: the platform cannot know the '
@@ -13184,11 +13186,14 @@ const step18: MigrationStep = {
       replacement:
         'the value the contract declares, written at the key the refusal names: a string where it wants a '
         + 'string (`outputVariable: \'taskId\'`), a number where it wants a number (`min: 1`, `limit: 10`, '
-        + '`timeoutMs: 5000`), a boolean where it wants a boolean (`multi: true`, `durable: true`), one of the '
-        + 'declared values (`severity: \'warning\'`, `mode: \'edit\'`), or a value inside the declared range. '
-        + 'A value meant to be computed per run is written as a `{token}` template (`limit: \'{page.size}\'`) — '
-        + 'the build never judges a token\'s type. For a rule finding, follow the rule\'s own sentence (keep '
-        + '`template` or the inline `title` / `message`, not both)',
+        + '`maxIterations: 5`, `timeoutMs: 5000`), a boolean where it wants a boolean (`multi: true`, '
+        + '`durable: true`), one of the declared values (`severity: \'warning\'`, `mode: \'edit\'`), or a value '
+        + 'inside the declared range. Outside `http`, a number or boolean slot takes a LITERAL only: those '
+        + 'executors parse the config as authored, so a `{token}` template there (`limit: \'{page.size}\'`, '
+        + '`maxIterations: \'{cap}\'`) passes the build doors and still fails every run. Only `http` '
+        + 'interpolates its config before it parses, so only an `http` slot may also take a sole-token template '
+        + 'that resolves to the declared type (`timeoutMs: \'{timeout}\'`, `durable: \'{durable}\'`). For a rule '
+        + 'finding, follow the rule\'s own sentence (keep `template` or the inline `title` / `message`, not both)',
       reason:
         'Every builtin executor (`service-automation` `builtin/`) parses its node\'s `config` against the '
         + 'contract `getBuiltinNodeConfigContracts()` names before it acts, and refuses the node on any '
@@ -13200,8 +13205,11 @@ const step18: MigrationStep = {
         + '`AutomationEngine.registerFlow` (which parses first) and `objectstack validate` share '
         + '(`flowNodeConfigRefusals`) now refuses such a value as `node-config-refused-by-contract`, anchored '
         + 'at the key, in the contract\'s own words — the code the approval contract already uses. It judges '
-        + 'only what the build can know the run will parse: a value carrying a `{token}` is never refused for '
-        + 'its pre-interpolation type; `http` parses after interpolating its whole config, so only token-free '
+        + 'only what the build can know the run will parse, and holds one more class back by ruling: a value '
+        + 'carrying a `{token}` is never refused at the build doors for its pre-interpolation type — which is '
+        + 'no promise it runs, since every builtin but `http` parses its config as authored and so still '
+        + 'refuses a token in a number or boolean slot at its first run; `http` parses after interpolating its '
+        + 'whole config, so only token-free '
         + 'values are judged there and never `signingSecret`, which the credential channel may supply; a '
         + '`loop` with no `body` is not parsed by its executor and is judged for nothing; the region slots of '
         + '`loop`, `parallel` and `try_catch` are judged as graphs of their own and by `validateControlFlow`. '
@@ -13221,8 +13229,11 @@ const step18: MigrationStep = {
         + 'For each hit write the value the contract declares, per the replacement. Two proofs. (1) For a '
         + 'stack authored in config files, `objectstack validate` is clean. (2) Boot the stack and confirm '
         + 'each flow REGISTERS: no `failed to register flow` warn for it — that warn line is the locator for '
-        + 'a row that exists only in `sys_metadata`. A node whose values its contract accepts, and any value '
-        + 'written as a `{token}` template, parses and registers byte-identically to before.',
+        + 'a row that exists only in `sys_metadata`. A node whose values its contract accepts parses and '
+        + 'registers byte-identically to before. A `{token}` template parses and registers as before too, and '
+        + 'runs only where the run parses it after interpolation (`http`) or where the slot takes a string; in a '
+        + 'number or boolean slot of any other builtin it fails at its first run exactly as it did, so write a '
+        + 'literal there.',
     },
     // The absent half of the decision-branch predicate rule. A SEPARATE entry from
     // `flow-predicate-slot-blank-string-refused` on purpose: that one keeps the