gate-46: the last 25 anchors need requirements that do not exist yet (conversation-title deferral, cross-app flow-engine)

[rubenvdlinde]

gate-46 spec-anchor-existence went 201 → 25 on hermiq (PR #180) by retargeting 176 tags at canonical requirements that already exist under openspec/specs/. The remaining 25 are left dangling on purpose: each would require writing the requirement the tag is supposed to be checked against, and authoring the spec you were sent to check against is how a false claim gets into a spec and stays there.

Measured with ConductionNL/.github@main run-hydra-gates.sh, re-run after every batch (201 → 151 → 116 → 98 → 59 → 32 → 25).

1. Conversation-title deferral is UNSPECIFIED — 20 findings

tag	sites
openspec/changes/session-context-performance/specs/agent-engine-port/spec.md#requirement-the-deferred-title-write-preserves-the-whole-conversation-object	lib/Service/Engine/ConversationTitleWriter.php (5), tests/Unit/Service/Engine/ConversationTitleWriterTest.php (12)
…#requirement-conversation-title-generation-does-not-block-the-reply	lib/Cron/ConversationTitleJob.php (3)

The change session-context-performance does not exist in this repo — not active, not archived. Canonical openspec/specs/agent-engine-port/spec.md carries only two requirements (no-LLM-API-key, legacy-cleartext-keys-deleted), and grepping all of openspec/ for "conversation title" / "deferred title" / "block the reply" returns nothing.

So there is shipped, tested behaviour — a background title write that must not block the reply and must preserve the whole conversation object — with no requirement anywhere. That is a spec gap, not a tagging gap. It needs an openspec change that states the two requirements, written by someone who owns the behaviour.

2. flow-engine is OpenRegister's spec, not hermiq's — 4 findings

lib/Service/ScheduleService.php:233, lib/Flow/HermiqAgentNode.php:147, src/store/flowEditor.js:895, src/modals/Flow/RunLogModal.vue:128 point at openspec/specs/flow-engine/spec.md#requirement-a-run-records-what-each-node-received-returned-and-logged and #requirement-a-node-type-declares-its-own-form-and-its-own-run-log-actions.

flow-engine belongs to OpenRegister (ADR-065). Hermiq's own flow-authoring / flow-canvas specs are UI-facing and carry no run-recording requirement, so pointing these there would be a false claim.

This needs a fleet decision, not an app fix: either gate-46 learns to resolve a cross-app @spec against the owning app's repo, or the convention gains an explicit cross-app spelling (compare x-external-register for the same problem in the relation dialect — see ADR-062 rule 7). Worth raising on ConductionNL/.github: any app implementing an OpenRegister interface will hit this.

3. Scaffold leftover — 1 finding

src/formFields/EmailField.vue:19 → openspec/changes/scaffold-v2/specs/scaffold-v2/spec.md. A leftover scaffold demo component ("Replace or delete when scaffolding a new app"); no scaffold-v2 change or capability exists in hermiq. Resolves itself when the component goes.

What was NOT done

No requirement was written to point a tag at. No tag was deleted to make the count fall. Where a method carried both a dangling tasks.md#task-N-M tag and a resolving requirement tag naming the same requirement, the pair was collapsed to the single canonical tag — every affected method still carries a @spec.

[rubenvdlinde]

Drift note, measured not predicted: on development @ a4eca493 (post-#186) gate-46 reads 26, not 25. Diffing the finding logs across 468f5f13 → a4eca493, the single addition is

src/store/flowEditor.js: @spec target file not found →
  openspec/specs/flow-engine/spec.md#requirement-a-run-records-what-each-node-received-returned-and-logged

which is another instance of §2 of this issue — the cross-app flow-engine case, OpenRegister's spec per ADR-065 — introduced by 5154ac79 (feat(flows): read a run from its card). So it is a new site, not a new class, and it still must not be closed by writing the requirement into hermiq's tree.

It does make the point sharper: this target is being reached for again as flow work continues, so the cross-app @spec spelling is worth raising on ConductionNL/.github rather than waiting. Base named on both numbers: origin/beta, canonical package @main 81c8c97.

[rubenvdlinde]

Re-measured on development @ ce6e1e5, 2026-08-13, ConductionNL/.github@923f57d check_spec_anchors.py over the same 547 lib//src//tests/ files. This issue's count of 25 now reads 26, and #202 takes it to 21. Two of its three conclusions need correcting.

⚠️ Before comparing any gate-46 number to an older one: .github#378 made whole-tree scope the default at 2026-08-12 13:14Z. And note the checker's argv contract — check_spec_anchors.py <log-path> <file> <file> …. Hand it a directory and it writes an empty log and exits 0, which reads exactly like a clean repo.

	findings	distinct targets
before #202	26	5
after #202	21	3

Correction 1 — section 2 is fixable today, with no fleet decision

This issue said the four flow-engine tags "need a fleet decision, not an app fix". They did not. #202 repoints all five (the one in section 2's table plus HermiqAgentNode.php:138 from section 2's first paragraph) at requirements that already exist and that the surrounding code already cites.

• HermiqAgentNode::logActions() and ScheduleService::lastRunConversationUuid() → openspec/changes/consume-or-flow-engine/specs/or-flow-consumer/spec.md. The other eleven methods on HermiqAgentNode already carry that exact target; line 138 was the single odd one out, and lastRunConversationUuid() exists solely so logActions() can hang a session link on the run-log entry.
• RunLogModal.vue, flowEditor.openRunLog(), flowEditor.openStepPayload() → openspec/specs/flow-canvas/spec.md#requirement-selecting-a-run-replays-its-path-on-the-canvas, which mandates this surface in words: "Beside each followed connection there MUST be a control opening the JSON that passed along it" and "A run whose record has no path MUST say so rather than drawing an empty canvas." FlowBuilder.vue:1078, PayloadModal.vue:75 and flowEditor.js:964 already resolve against that same anchor.

The general point in section 2 — that gate-46 cannot resolve a genuinely cross-app @spec — still stands and is still worth raising on ConductionNL/.github. It just was not what these five tags needed.

Correction 2 — section 3 will not resolve itself

src/formFields/EmailField.vue is described here as a leftover that "resolves itself when the component goes". It is live and it is not going. src/registry.js:42 imports it and :672 registers it as the app's only kind: "form-field" entry, and tests/registry.spec.js:53 declares REQUIRED_KINDS = ['page', 'form-field'] — so this file is the sole thing keeping npm run check:registry green.

I looked for a replacement target and left it dangling on purpose. The two candidates are both misattributions: manifest-driven-pages#requirement-manifest-and-registry-changes-keep-check-specs-and-lint-green is about registry changes not breaking the checks, not about a form-field binding by appliesTo.format; app-manifest#requirement-the-production-manifest-carries-no-template-scaffold-pages constrains manifest pages, not registry form-fields. Either would put a false claim in a docblock to move a number.

Adjacent and also stale, though gate-46 cannot see it because it is prose rather than a tag: tests/manifest-v2.spec.js:85 still refers to openspec/changes/scaffold-v2/specs/scaffold-v2/spec.md.

Correction 3 — section 1's 20 findings are a deleted spec, not a missing one

This is the important one, and it is why 20 of the 21 remaining findings are cheaply recoverable rather than blocked on someone writing a requirement.

The change session-context-performance existed. All six of its files were deleted by 6cc6f17 — "wip: session-consolidation (preserved from scholiq-goal2 working tree)" — which removed the spec while leaving the code and its tests in place. That is the signature of a working-tree snapshot taken from a checkout that never had the directory, not of a decision to drop the requirements.

$ git show 6cc6f17^:openspec/changes/session-context-performance/specs/agent-engine-port/spec.md
19:### Requirement: Conversation-title generation does not block the reply
44:### Requirement: The deferred title write preserves the whole conversation object
55:### Requirement: Deferring title generation preserves tenant-model-policy enforcement

Both dangling headings, verbatim, plus a third nobody has tagged.

Measured cost, so the decision is made with it in hand: that one file carries 6 #### Scenario: blocks, and restoring it hands every one of them to gate-19 (currently 491). gate-19's verdict does not change — it is already FAIL — but the number rises, and a rising number after a "fix" is exactly the shape that gets misread later.

Not done in #202, on purpose. Restoring a deleted spec is a spec-governance act, the whole change also carries design.md, proposal.md, tasks.md and a second specs/agent-context-retrieval/spec.md whose checkbox state I cannot verify, and the third requirement's implementation status is unknown to me. It wants the person who owns the behaviour, and probably wants to land as openspec/changes/archive/<date>-session-context-performance/ since the work has shipped.

With that restored, gate-46 on hermiq goes 21 → 1 — the EmailField tag above, which is the only one that genuinely needs a requirement written.