Assignment fan-out to a removed account creates a task silently: the system write skips the reference check #148

Found during the @objectstack 18 upgrade (PR #144; os-dev report on #139). The card thread measured the same case on main at 0a8d116 (17.3.0), and the task is created silently there too, so the upgrade did not introduce it.

What happens

When an assignment names an account that has since been removed, the fan-out flow still creates a duly_task for it, with no error and no failure notice to the assigner. The flow's create_record runs as a system write, and a system write skips the platform's reference check on owner. The task's owner then points at an account that can never open it, so the duty is "assigned" and nobody does it. That breaks the product promise to see the state of play without asking.

What done looks like

• Re-measure on main once Upgrade to @objectstack 18.2.0 #144 has landed (18.x): which write path the fan-out takes, and whether the platform offers a declarative way to keep the reference check on a system write.
• The fan-out refuses an assignee that does not resolve to an active account and reports it through the existing per-assignee failure path (the try_catch from Assignment fan-out: wrap the loop body in try_catch so one failing person does not abort the fan-out #124), so the assigner is told. The other assignees still get their tasks.
• A test: one valid assignee and one removed assignee; one task is created, one failure is reported.
• If the right fix is a platform change (the reference check skipped on system writes), file it upstream with the measurement and keep this card for the app-side guard.

Restart-when: #144 is merged.

Generated by Claude Code