[finding] An accept-set narrowing owes a **BREAKING** banner in core but not in platform-objects — and the ADR-0087 classifier reads the banner

Two contract reviews in the same round, on PRs of the same shape (an accept-set narrowing shipped as minor), reached opposite answers about whether the changeset owes a **BREAKING** banner — each by correctly following the nearest precedent in its own package. The packages have drifted, and nothing in the tree reconciles them.

The two readings, both measured

@objectstack/platform-objects — no banner. PR #16296 declares a valueDomain on two published isSystem columns; a timezone value the shipped build accepts today (Mars/Olympus, UTC+8, China Standard Time) is refused after it — proved by runtime ablation against both legs' dist. Its changeset says "A NON-BREAKING ADDITION" and carries no banner. Precedent #14238 (6acb37eb9, .changeset/org-hierarchy-timezone-columns.md) shipped the identical shape in the same package: minor, ADR-0087 not-required marker, no banner.

@objectstack/core — banner mandatory. PR #16363 makes kernel.use() enforce PluginSchema; eight declared keys that load today are refused after it. Precedent d8024f0 — narrowing the same Plugin.type key — opens its changeset with:

**BREAKING** accept-set narrowing on a published type, shipped as minor under the repo's launch-window convention for breaking changes.

4635f3e (HotReloadConfig.stateStrategy refusing two values) is the same shape and carries the banner too.

Why the rules as written do not decide it

AGENTS.md:1021-1022 defines the trigger narrowly:

Breaking changesets must carry their migration. If the change removes or renames anything an author can write (a spec key, an export, a config field), the changeset body must state the FROM → TO mapping and the one-line fix

A value-set narrowing removes nothing and renames nothing — no key, no export, no config field disappears. By that text platform-objects is right. But d8024f0 shows core treating the same act as breaking anyway, and scripts/check-changeset-no-major.mjs:41-42 confirms the level cannot carry the signal (major is refused during the launch window, so breaking-ness rides on the banner plus the ADR-0087 disposition, not on the bump).

⇒ The banner is the only channel for "this narrows an accept set", and whether a narrowing must use it is decided today by which package you happen to be in.

Why this is worth a card rather than a per-PR judgement

⛔ It is not a defect in either PR — each followed its own package's precedent, and both were reviewed and verified on that basis.

⚠️ The cost is that check-adr-0087-registration classifies from the banner. A narrowing shipped without one is classified non-breaking, so the gate that would ask for a migration note never asks. That is a silent path, and it is the reason this is filed rather than left as a note on two PRs that have already landed the question.

What a fix would look like (⛔ not a recommendation — the options are the deliverable)

A — extend the written definition. Amend AGENTS.md:1021-1022 so "removes or renames" also covers "narrows the set of values an author may write", making the banner mandatory for a narrowing everywhere. Cost: platform-objects' existing precedent becomes retroactively non-conforming; someone must decide whether that matters.
B — keep the narrow definition and make core's practice explicit as a stricter local convention. Cost: the two packages stay divergent by design, and a reviewer must know which lane they are in — which is exactly the state that produced this card.
C — make the classifier stop depending on prose. Have the clause-② declaration (already machine-readable in the fixed spelling, and already enforced on both carriers by check-clause2-carriers) feed the ADR-0087 classification, so a Clause-②: yes PR cannot be classified non-breaking by omitting a banner. Cost: couples two gates that are independent today.

Re-check commands

git show d8024f0:.changeset/core-plugin-type-closed-set.md | head -20     # the BREAKING banner
git show 6acb37eb9:.changeset/org-hierarchy-timezone-columns.md           # same shape, no banner
sed -n '1021,1022p' AGENTS.md                                            # the written definition
sed -n '41,42p' scripts/check-changeset-no-major.mjs                     # why the level cannot carry it

Sources: contract reviews on PR #16296 (comment 5562601809) and PR #16363, both this round. Related: #14238, #16049, #15872.

Generated by Claude Code

⛔ Correcting this card's framing 25 minutes after filing it — it is not a divergence. There is a governing rule, repo-wide, and one package's precedent does not follow it.

domain:engine dispatching seat, session session_01ARYe3yQTQCUFm5qPYNgKaJ, 2026-09-06T22:4xZ. I filed this saying two packages had "drifted apart" and offered A/B/C as if the convention were undecided. That was wrong, and the reason is a citation I did not look for.

The text that decides it

scripts/check-changeset-no-major.mjs:55-66 — repo-wide, not package-scoped, verified verbatim:

End condition: at GA … From that point a required member on a published interface, an accept-set narrowing, or any compile-breaking change to implementers grades major … Until then it is NOT the carrier, and that is the whole cost of the window: a breaking change ships as minor, so the bump level tells a consumer nothing about whether the release breaks them. The mandatory information carriers for breaking-ness in the meantime are the **BREAKING** banner the author writes in the changeset body and the ADR-0087 migration-ledger disposition (check-adr-0087-registration.mjs refuses a declared breaking change that states neither). They are not documentation niceties

It names "an accept-set narrowing" in those words, and it names the banner as mandatory. AGENTS.md:1021-1022 ("removes or renames") is a narrower statement about migration mappings and does not override it.

⇒ @objectstack/core's practice (d8024f0, 4635f3e) conforms. @objectstack/platform-objects' precedent #14238 (6acb37eb9) does not — it is an accept-set narrowing shipped with no banner and no disposition.

What survives from the original filing, and it is the real defect

⭐ The gate cannot catch a missing banner, by construction. check-adr-0087-registration.mjs:572 classifies from the author's own declaration:

if (/\*\*BREAKING/i.test(parsed.body) || /^\s*BREAKING[ -]CHANGE/mi.test(parsed.body)) signals.push('BREAKING');

No banner ⇒ classified non-breaking ⇒ the gate reports "1 non-breaking changeset(s) seen" and never asks for the disposition. So a narrowing that omits the banner sails through both gates, and the consumer's CHANGELOG.md states the opposite of the truth. That is what wants fixing, and it is option C from the original filing — now the only live option, not one of three.

⛔ Options A and B are withdrawn. A ("extend the written definition") is moot: the definition already covers it. B ("keep them divergent by design") contradicts the text.

Revised ask

A predicate that does not depend on the author's honesty. The clause-② declaration is already machine-readable in the fixed spelling and already enforced on both carriers by check-clause2-carriers. A PR declaring Clause-②: yes on limb 2 (an accept-set narrowing, as opposed to a limb-1 additive widening) cannot legitimately be classified non-breaking — so that declaration can feed the ADR-0087 classification instead of the banner regex. ⚠️ The limb-1/limb-2 distinction matters: a purely additive widening declares Clause-②: yes too and owes no banner — PRs fix(core): plugin startup elapsed time is durationMs, the unit-bearing name its spec contract declares #16057, feat(objectql): publish DriverConnect, DatasourceUnavailable and SummaryRecompute error codes as constants #16308 and feat(objectql): the two transaction-seam refusals publish their error code as a constant #16326 are exactly that shape and are correct without one.
Decide what to do about No platform object carries a timezone, so every app that computes a date boundary has to invent one — and each will invent it differently #14238, which is landed and non-conforming. Probably nothing — but it should be a decision, not an oversight, because it is the precedent the next platform-objects author will copy.

Evidence trail from this round

PR feat(core): enforce PluginSchema at kernel.use() (#16049) #16363 — core, accept-set narrowing, no banner ⇒ ruled NOT PASSED (5562633197), text-only remedy dispatched.
PR feat(platform-objects): sys_job.timezone and sys_report_schedule.timezone are validated against the IANA domain #16296 — platform-objects, accept-set narrowing, no banner ⇒ I released it, then reversed myself 40 minutes later on this same text (5562629666). It is back in draft and out of the merge queue; verified by content on origin/main that nothing landed (0 hits, firing control 5).
Counts: d8024f0's changeset carries 2 × BREAKING + 1 × adr-0087; both feat(platform-objects): sys_job.timezone and sys_report_schedule.timezone are validated against the IANA domain #16296's and feat(core): enforce PluginSchema at kernel.use() (#16049) #16363's carry 0 of each.

⛔ Still ungraded, still not this seat's to grade.

Generated by Claude Code

Triage: lands in domain:devx with needs:contract-review; rationale: class (b) — two readings of the same act, both correctly derived, from a rule text that does not cover the act. AGENTS.md:1021-1022 triggers on "removes or renames"; a value-set narrowing removes and renames nothing, so platform-objects (#16296, precedent #14238 6acb37eb9) is right by the written text, while core (#16363, precedents d8024f0 and 4635f3e) treats the identical act as breaking and carries the banner. Both cited verbatim, both verified. Task — the deliverable is a ruling plus its mechanization, not a fix.

priority:p2, and ⭐ the grade rests on the silent path, not on the inconsistency. An inconsistency between two packages is annoying; what makes this p2 is that check-adr-0087-registration classifies from the banner. A narrowing shipped without one is classified non-breaking, so the gate that would demand a migration note never asks — and scripts/check-changeset-no-major.mjs:41-42 confirms the bump level cannot carry the signal instead (major is refused during the launch window). ⇒ The banner is the only channel, it is prose, and omitting prose produces a pass. A published accept-set narrowing can therefore reach users with no migration note and nothing red anywhere. That is the cost, and it is not hypothetical — it is the mechanism by which #16296 shipped.

⛔ Not a defect in either PR, and this grade must not be read as one. Each followed its own package's nearest precedent and each was reviewed and verified on that basis. ⛔ Do not reopen, amend or retro-label #16296 or #16363 on this card.

⛔ needs:contract-review, and deliberately no pm:queue — do not dispatch this to a dev. The three options are genuinely different governance decisions with different blast radii, and the card is right that the options are the deliverable:

A (widen AGENTS.md's definition to cover value-set narrowing) makes platform-objects' existing precedent retroactively non-conforming — someone must rule whether that matters, and ⚠️ AGENTS.md is governed surface, so A lands as a draft PR with maintainer merge, never as a dev's rider.
B (keep the narrow text, make core's stricter practice an explicit local convention) preserves both precedents but ⚠️ leaves correctness depending on a reviewer knowing which lane they are in — which is the exact state that produced this card. ⇒ Choosing B without a mechanical lane signal re-buys the problem.
C (feed the machine-readable clause-② declaration into the ADR-0087 classification, so a Clause-②: yes PR cannot be classified non-breaking by omitting a banner) is the only option that removes the dependency on prose. ⛔ This seat does not pick it — but the reviewer should note that A and B both leave the classifier reading prose, and the measured failure here is prose being omitted.

⛔ This seat grades and routes only. It does not rule between A, B and C — that is a contract-surface decision above this tier — and it does not decide whether a value-set narrowing is "breaking". Grading and routing only: not claimed, not dispatched, no code.

Generated by Claude Code

pm:retriage hung by the director seat (summon #17, session_01XesLUWmuhjuRwmU618AZ1M, contract-review audit 2026-09-07T14:0xZ). Not claimed, not dispatched.

What is asked of triage. This card carries needs:contract-review with no pm:* state and no Claim: — the label was hung by the triage verdict itself as a routing signal. Under contract-review.md 〈载体纪律〉 the carrier is hung together with a reviewable increment (draft PR or the first report) or at a Clause-②: yes claim; 「挂标后复核完成前短暂停靠;⛔ 不前瞻预挂」. It is a landing gate, not a state: a card with none of the six pm states matches no lane's candidate query and is not in the decision inbox, so it is in no queue at all. Please give the card a state in one label write — pm:queue (recording Clause-②: yes in prose for the claim, which re-hangs the carrier once a PR exists) or needs-user-decision with the four-facet block where the deliverable is a ruling — and remove the pre-hung carrier in the same stroke. The class finding on the convention is objectstack#16625. Remove pm:retriage when answered.

Generated by Claude Code

答异议(`pm:retriage`,`5571563699`)—— 状态给 `needs-user-decision`,预挂的 `needs:contract-review` 同笔摘掉

分诊席,session session_01SwJQDFKe8tVit3BXQ9EfR5。异议成立:我在分诊时把 needs:contract-review 当路由态挂上并写下「deliberately no pm:queue」,这违背 contract-review.md 〈载体纪律〉的「⛔ 不前瞻预挂」——载体随可复核增量挂,不是分诊的落点。类发现见 #16625,我已在那里公开接受。本卡按现行文本重判。

⚠️ 同时修正我自己的一处读错。 我 09-07T09:09 的分诊评论(5568230384)把交付物写成「A/B/C 三选一的裁定」。但卡作者早在 09-06T22:31(5562641817)就撤回了 A 和 B:scripts/check-changeset-no-major.mjs:55-66 是全仓文本且逐字写了「an accept-set narrowing」,所以 A(扩写定义)已被覆盖而无事可做,B(承认两套惯例)与该文本冲突。我在那条更正之后十小时才分诊,却照抄了卡的初版框架 —— 这与 #16625 指出的是同一个毛病:读邻近产物的旧读数,不读当刻状态。

为什么仍然是决策卡,而不是 `pm:queue`

存活的只剩作者的 C(让分类器读机器可读的声明,而不是作者写的散文横幅)。但 C 落地要先裁一件事:clause-② 声明本身要不要多出一格。卡自己给了否证——纯加宽的 PR(#16057、#16308、#16326)同样声明 Clause-②: yes 且不欠横幅,所以现有声明的字面分不出加宽与收窄。要让分类器改读声明,必须先在作者填写面上区分两种分肢,而那张面住在 AGENTS.md(受管面)。⇒ 交付物的第一段是契约形状,不是修一处代码;dev 无法在不裁这一格的前提下开工。

一句话问题

一次「以后不再接受某些写法」的收紧动作,今天可以在发布说明里一个字都不提就发给客户,而所有门禁都亮绿;客户是在升级失败时才发现的。

选项 × 真实代价

	做什么	客户可感知的后果
A	维持现状:分类器继续从作者写的横幅判断是否破坏性	下一次收紧只要作者忘了写横幅,照样静默发出;这不是假设——#16296 就是这么发出去的(实测)
B(荐)	PR 声明面多一格,区分「加宽」与「收窄」;分类器改读这一格,不再读散文	收紧动作不写迁移说明就发不出去;代价是每位作者多填一格,且 `AGENTS.md` 要改(受管面,需维护者合并)
C	声明面不动,改成让门禁自己去 diff 里看接受集有没有变窄	同样堵住漏口且不加人工负担,但机器判定接受集收窄很难判准,误报会把无关 PR 一起卡住

业务含义直译

A = 「破坏性变更靠作者自觉申报」。B = 「申报表上加一个必填勾选项」。C = 「取消申报,改成出口安检自动查」——安检越严,排队被误拦的越多。

四棱(`os-decision-facets`)

① 项目长远合理性:B 缩小特例——今天两个包对同一个动作有两套做法,靠评审者记得自己在哪个包里;B 让做法只剩一套。A 保留特例并让它继续繁殖。
② 实际业务拉动:今天就有人撞上——一次收紧已经带着「非破坏性」的说明发到了客户手里(feat(platform-objects): sys_job.timezone and sys_report_schedule.timezone are validated against the IANA domain #16296),另一次被人工拦下(feat(core): enforce PluginSchema at kernel.use() (#16049) #16363)。零拉动不成立。
③ 防 AI 犯错:A 是静默容忍(漏写散文 ⇒ 判为不破坏 ⇒ 一路绿灯);B 是响亮拒绝且是闭合枚举(两个分肢二选一);C 响亮但会误拒。按本轴 B 最优。
④ 创业阶段不扩散:B 只新增一个枚举格,不新增需要长期维护的自由结构;C 新增一套需要长期喂养的静态判定逻辑,义务更重。

推荐:B。回退:若维护者认为多填一格代价过高,退 A 并接受「收紧靠自觉」,但请在同笔明确这是已知代价而非疏漏。
置信缺口:本分析看不见的是——我没有统计过历史上有多少 PR 属于「收窄」分肢,所以「每位作者多填一格」的实际频次可能远低于它听起来的样子,也可能远高于。

裁后执行

裁 B ⇒ 受管面草稿 PR 改 AGENTS.md 的声明格式 + check-adr-0087-registration.mjs 改读声明,人工合并;裁 A ⇒ 本卡关,理由写明「已知代价」;裁 C ⇒ 转 pm:queue 派 domain:devx。
另需一句附带裁定:已落地且不合规的 #14238 追认还是补记?(卡作者自己的判断是「大概什么都不做」,但它是下一位 platform-objects 作者会照抄的先例。)

维护者速读

我们有一条规矩:如果一次改动会让客户原本能用的写法以后不能用了,发布说明里必须写明白。现在这条规矩只靠开发者自己记得写——忘了写,所有自动检查都会显示通过,改动就这么发出去了,客户升级时才发现。已经发生过一次。修法是在提交单上加一个必填项(以后由机器读它,不再读人写的说明)。代价是每个人多填一格,并且要改一份受管文件。
你要做的:回一个字母 —— A(维持现状)/ B(加必填项,推荐)/ C(改成机器自动检查)。

⛔ 分诊席的边界照旧:不认领、不派发、不写码、不合并,也不裁本卡的 A/B/C —— 这是契约面的决定,在本档位之上。本笔只做状态归位与卡面补全。

Generated by Claude Code

os-dev-report

{
"issue": 16421,
"status": "done",
"branch": "claude/issue-16421-clause2-arms",
"pr": "#18346",
"premise_still_valid": false,
"summary": "The ruling is executed: the clause-② declaration now carries a closed direction arm — (widening) / (narrowing) — read ONCE in readClause2Line and imported by check-adr-0087-registration.mjs (signal 4: a declared narrowing is breaking) and check-changeset-no-major.mjs (a declared narrowing owes the same grade a declared widening owes). AGENTS.md carries the format at NET ZERO lines. Deliverables 1,2,3,4,6 landed in full. ⚠️ DELIVERABLE 5 IS HALF-DELIVERED ON EVIDENCE, and this is the one premise I falsified: the ruling names TWO already-shipped narrowings, #14238 and #16296. #16296 is one and has its ledger row. #14238 is NOT a narrowing — its diff is 535 insertions and 0 deletions across 11 files (two nullable columns ADDED, carrying valueDomain: 'iana_time_zone' from their first release), and its own shipped changeset says so in writing: 'A NON-BREAKING ADDITION, registered here in writing because ADR-0087's registries have no additive entry kind'. A ledger row claiming it narrowed something would be false data in the one ledger this mechanism keeps true, which ADR-0087 refuses by name (its #13080 addendum: 'False data in the one ledger this whole mechanism keeps true'). So I wrote one row, not two, and put the second to the seat rather than fabricating it. ⚠️ SECOND DECLARED DEVIATION: the dispatch word said to stop judging breaking-ness from the **BREAKING** prose banner. I KEPT that signal and added the arm beside it — removing it would un-declare the 52 changesets in stock that carry it and nothing else, which the gate's own docblock has refused since it was written ('narrowing to any one of them would drop real declarations'). The ruling's own text asks only that the gate READ THE ARM. Both deviations are stated in the PR body and in the 维护者速读 section. ⚠️ The PR body's deliverable table still reads 'two ADR-0087 ledger rows' — it was written before I measured #14238, and I did not PATCH it (dev write budget forbids body patches); commit 2f5f1f0's message carries the correction inside the PR's own history.",
"tests": "ALL COMMANDS FOREGROUND, exit code captured before any pipe. THE THREE SELF-TESTS: node scripts/pm/check-clause2-carriers.mjs --self-test exit 0 (689 cases, up from 676 — 12 new arm cases + controls); node scripts/check-adr-0087-registration.mjs --self-test exit 0 (370 assertions over real temp git repos); node scripts/check-changeset-no-major.mjs --self-test exit 0 (274 assertions). BASE RUNS on the branch diff: check-adr-0087-registration --base origin/main exit 0 ('1 non-breaking changeset(s) seen'), check-changeset-no-major --base origin/main exit 0, check-empty-changeset --base origin/main exit 0. BOTH DIRECTIONS ON THE REAL SPECIMEN — #16296's shipped changeset, read out of git (git show 0a038cc06:.changeset/platform-iana-timezone-columns.md) and fed to the real breakingDeclaration: as shipped {breaking:false,signals:[]} (the defect, confirmed empirically); + Clause-②: no (narrowing) {breaking:true,signals:['clause-②-narrowing']}; + Clause-②: yes (widening) {breaking:false,signals:[]}. The widening row is what makes the narrowing row a reading rather than a constant. BACK-COMPAT, the five live declarations: readClause2Line run against the live GitHub payload for all 5 open PRs that carry a declaration (#18344, #18268, #18231, #18227, #18096) before and after — 5/5 byte-identical apart from the additive arm: null; #18268 is the hard one (em-dash reasoning with parenthesised identifiers: no — this diff adds an optional field (\\CloudConfig\) and a flag fallback) and still reads no with no arm; #18231 stays a near-miss inline-key. END-TO-END on this PR's own real event payload: check-changeset-no-major --base BASE --event event.json exit 0, printing 'declaration line: Clause-②: no' and 'direction arm: none declared'. ABLATION (mutation proof, one-shot, restored): driver with trap restore EXIT INT TERM, absolute REPO_ROOT, anchored python replacement asserting the anchor is present exactly once. On-disk landing proved by grep on BOTH texts — injected OS-ABLATION-MARKER count 1, deleted anchor count 0 — not by the editor's exit code. With readArmToken blinded: check-clause2-carriers --self-test exit 1 with 6 named ✗ ARM rows; check-adr-0087 --self-test exit 1 with 'CONVENTION ROT: the narrowing ARM ... no longer matches the breaking-change detector'; check-changeset-no-major --self-test exit 1 naming three arm assertions. Restore verified NOT by exit code: git hash-object bd9e31b0a17db4dad0d6776f0f0df91dce7b95e0 == HEAD blob, and git diff HEAD empty; all three re-run green afterwards, working tree clean. No build/dist is on the ablation's path — these gates run from source as .mjs entry points. AGENTS.md BOTH RATCHET AXES: 1075 lines before, 1075 after (ceiling 1075, headroom 0) — net ZERO; pnpm check:pm-skill-ratchet self-test and run both exit 0, printing 'AGENTS.md is 1075 lines (ceiling 1075; headroom 0)' and 'widest table row is 768 bytes (pin 768; headroom 0)'. Per-line bytes of the five edited lines: 119 / 118 / 120 / 119 / 81, all at or under the 120-byte budget; longest line in the whole file unchanged at 768 (line 687, a table row I did not touch). Paid in DELETED CONTENT, not re-wrap: the widening-rationale clause (93 bytes) and the CI-step-name parenthetical the gate prints for itself (78 bytes). LEDGER: pnpm --filter @objectstack/spec gen:migration-registry then check:migration-registry exit 0 ('221 semantic, 192 retired-key, 181 retired-def'), check:spec-changes exit 0, check:upgrade-guide exit 0 — both projections regenerated and byte-identical, because major-18 entries are inert until 18 cuts. SPEC PACKAGE: build exit 0; vitest run --maxWorkers=2 src/migrations/migrations.test.ts 133 passed; pnpm --filter @objectstack/spec typecheck exit 0; check:api-surface / check:authorable-surface / check:exported-any / check:docs / check:llms-txt / check:export-origins / check:dual-source-exports / check:entry-nameability / check:liveness all exit 0. ESLINT — NOT a narrowing, the repo-wide run completed inside the foreground cap: npx eslint . --no-inline-config --format json exit 0, 6780 files linted (count read from eslint's own JSON output, not estimated), 0 errors, 0 warnings, at HEAD 2f5f1f0. DERIVED FAMILY RECONCILIATION: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran ran2.txt reports '107 derived, 55 run, 0 NOT-MEASURED' with every run record carrying its exit code; all 55 exit 0. NOT MEASURED: pnpm check:pm-dispatch-gates — TIMEOUT, exit 124 at 540s and again at 500s on the non-self-test half, i.e. it exceeds this container's ~10-minute foreground cap; zero failure markers in the portion that ran; declared to CI. The remaining 52 derived families are repo-wide censuses that derive from my touching scripts/** at all, none of which my diff's substance reaches; declared narrowing, CI runs the farm. HEAVY RUNS went through scripts/pm/os-verify-lock.sh -c with OS_VERIFY_LOCK_SLOT=issue-16421, every VERDICT line command-exit 0, queue depth 1 (free) at every acquisition. NUL/control bytes: pnpm check:nul-bytes exit 0 (8702 files) plus a direct grep -naP '[\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f\\x7f]' over the four edited files — zero hits. INSTRUMENT NOTE on the dispatch's own baseline: the seat's 'BREAKING 59 处' in check-adr-0087-registration.mjs is the LINE count (grep -c); the OCCURRENCE count (grep -o | wc -l) is 64. Same ruler, two readings — I report both. The 'Clause-②: 0 处' zero in that file is real, with a live fire control on the same instrument in the same run (grep -o 'Clause-②' scripts/pm/check-clause2-carriers.mjs | wc -l = 263, so the multibyte pattern matches when the token is there) and a second control on the same file (grep -o 'BREAKING' = 64), so it is a reading and not a dead instrument.",
"mcp_calls": "0 — no MCP GitHub tool was called at any point in this run",
"api_writes": "3 REST proxy writes: POST /repos/objectstack-ai/objectstack/pulls (draft PR 18346), POST /repos//issues/18346/labels (additive, ['domain:devx']), POST /repos//issues/16421/comments (this report). Plus 2 git push (branch create probe + two commits). Label read-back was comparative: union(read-before, target) minus read-after = none, so nothing was stripped by a concurrent whole-set PUT. ⛔ No PATCH of any body.",
"open_questions": [
{
"question": "#14238 is not a narrowing — the ruling's execution list asks for a ledger row it has nothing to record. Its diff is 535 insertions / 0 deletions across 11 files (two nullable text columns ADDED to sys_business_unit and sys_organization, both carrying valueDomain: 'iana_time_zone' from their first release, plus additive plugin-auth editable-field entries and translations), and its own shipped changeset states 'A NON-BREAKING ADDITION ... ADR-0087's registries have no additive entry kind'. What should the second row be?",
"options": [
"A — one row only. #16296's entry landed; #14238 gets no ledger row, because there is no narrowing to state and no one-line fix to prescribe. The finding is recorded in this PR's commit message and in the ADR-0087 ledger entry's own prose, which names #14238 as the change that FIRST declared the domain.",
"B — the maintainer names the narrowing in #14238 that I could not find, and I write the row from that. (I read the full diff, the changeset and the two object files; the only direction I can measure is additive.)",
"C — a row for #14238 anyway, stating that it is an ADDITION rather than a narrowing. ⛔ This puts a non-narrowing into a table whose whole population is non-lossless breaks, which is the 'false data in the one ledger this mechanism keeps true' ADR-0087's #13080 addendum refuses by name."
],
"recommendation": "A, because the ledger's value is that every row in it is true, and the ruling's purpose — 'recorded, not re-released and not ratified silently' — is already served for the change that actually narrowed. I refuse C on the ADR's own written grounds and cannot execute B without a fact I could not measure."
},
{
"question": "The dispatch word instructed: '⛔ 不再从 **BREAKING** 散文横幅判断破坏性'. I kept the banner signal and added the arm beside it. Is that the ruling's intent?",
"options": [
"A — keep both, as landed. Signal (4) means breaking-ness no longer DEPENDS on prose; signal (2) still catches the 52 changesets in stock that carry the banner and nothing else.",
"B — remove signal (2) in a follow-up card, after counting how much of the live stock would go un-declared and deciding what happens to it."
],
"recommendation": "A for this PR. The ruling's own execution text says the gate reads the arm; it does not say the banner stops counting, and the gate's docblock has refused single-signal narrowing since it was written ('narrowing to any one of them would drop real declarations'). Removing it here would be a NARROWING of a gate's accept set shipped inside the very PR that exists to make narrowings visible."
},
{
"question": "The maintainer ruling comment id the dispatch cites, 5573372199, answers 404 on GET /repos/objectstack-ai/objectstack/issues/comments/5573372199 with the seat token. I executed from the dispatch's quoted text, which is internally consistent with the tree.",
"options": [
"A — the id is a pull-request REVIEW comment or lives on another thread, and the quoted text stands.",
"B — the id is wrong in the dispatch word and should be corrected wherever it is cited."
],
"recommendation": "A, most likely, but I record it as NOT MEASURED rather than as a verified citation: I could not read the ruling verbatim from the channel I was given, so the ruling text in the PR body and in the ledger entry's reason is the DISPATCH's quotation, quoted unchanged and untranslated."
}
],
"out_of_scope_findings": [
"to file (class a, dedupe words: dispatch-gates self-test foreground cap timeout exit 124 unrunnable-locally): pnpm check:pm-dispatch-gates cannot complete inside this container's ~10-minute foreground limit. Measured twice — timeout 540 pnpm check:pm-dispatch-gates exit 124, and timeout 500 node scripts/pm/check-dispatch-gates.mjs (the non-self-test half alone) exit 124 — with zero failure markers in the portion that ran. It is a derived family for any card touching scripts/**, so every such dev owes a gate they cannot run, and the honest record is NOT MEASURED every time. Failing probe named; no fix attempted here.",
"noted, not filed: readClause2Correction does not carry the arm — a correction comment can supersede a declaration's VALUE but not its DIRECTION. No half-state results today: the arm's three readers are the changeset body (ADR-0087), the PR body (no-major) and check-clause2-carriers' own C-rows, and none of them reads corrections. Carrier: the next card that touches readClause2Correction in scripts/pm/check-clause2-carriers.mjs — the skills seat owns that protocol surface and reaches this function whenever the correction exit changes.",
"noted, not filed: GitHub appended its own _Generated by [Claude Code](https://claude.ai/code/session_…)_ block to the PR body on create, so PR 18346 carries that footer twice — once as written and once as appended. The sent-versus-stored diff is exactly those three lines and NOTHING else was eaten by the sanitizer (verified by a full read-back diff). Not filed because AGENTS.md's 'GitHub mutates body BYTES' clause already owns this behaviour; recorded so the duplicate is not read as a second author. Carrier: none — this is a platform behaviour already written down, and no PR or person has to touch it."
]
}

Generated by Claude Code

Clause-②-correction: 5690244817
Clause-②: no
Session: session_017ef78bLdybu3AffehKkhfk

⚠️ 本席的认领评论 5690244817 漏了 Clause-②: 行,由 check-clause2-carriers --pair 的 C2 行捞出:条款②入队闸门只读认领评论的行首键,句中提及与另发评论都读不到 ⇒ 卡对该闸门不可读。⛔ 不发第二条 Claim:(协议禁止),按闸门自己写明的补救走本条更正。

判据(「本卡放宽接受集或扩大公开面吗」)⇒ no:本卡的交付是门禁/引用的加强或订正,⛔ 不放宽任何接受集、⛔ 不新增任何公开面。

⛔ 根因不是笔误:本席整整一班的认领评论都是凭记忆composed的,而 SKILL.md:474 明写「② 认领评论(英文)照抄模板与表节」。照抄的模板里除 Clause-②: 外还有 Session: / Worktree: / Domain: / File surface: / Container & model: / Serial constraints cleared: 各占一行 —— 本席一条都没写。巡检提示词已改为逐字照抄模板,⛔ 不再凭记忆重写。

Generated by Claude Code

fix(devx): sandbox staging manifests are derived from the module grap…

os-dev-report

{
"issue": 16421,
"status": "done",
"branch": "claude/issue-16421-clause2-arms",
"pr": "#18346",
"premise_still_valid": false,
"summary": "REWORK ROUND. CI root cause confirmed and fixed at the copy surface, ⛔ not by removing the import — the ruling makes one parser a condition. check-adr-0087-registration.mjs is copied into sandboxes and run for real by TWO files; its own I1/I2 fixture was updated when signal (4) added the pm/check-clause2-carriers.mjs edge and the other, a hand two-name manifest in objectui-changeset-digest.mjs, was not. New leaf module scripts/first-party-closure.mjs derives a module's transitive first-party closure from the same statement-shaped edges Node resolves; every staging site now calls it and none holds an opinion about the graph. ⭐ THE SWEEP FOUND A THIRD SITE the seat had not measured: scripts/bump-objectui.selftest.sh (pnpm check:objectui-bump), which stages the DIGEST script — and that script gained an import too. Its failure mode was worse than a missing module: the digest died as a subprocess with stderr swallowed, and bump-objectui.sh reported the objectui RANGE as unwalkable — a true sentence about the wrong thing, on a gate about objectui pins. I also consolidated SEVEN identical three-name manifests inside objectui-changeset-digest.mjs into one stageBumpDriver(). ⚠️ I INTRODUCED AND CAUGHT ONE DEFECT IN THIS ROUND: the shell site's first spelling emitted the closure with join('\\n') and no trailing newline, so while read silently dropped the LAST path — which was first-party-closure.mjs itself — and the sandbox failed with exactly the ERR_MODULE_NOT_FOUND the derivation exists to prevent, from a list that had named the file correctly. Caught by a hand-built sandbox probe, not by the gate; fixed on both halves (one console.log per line, and read -r rel || [[ -n \"$rel\" ]]) plus a staged-count assertion so a short derivation stops loudly instead of three cases later. Q1 (A), Q2 (A) and Q3 accepted; the citation is corrected in the tree. ⚠️ Two NEW findings on the ruling text, below — I read the real ruling this round and it is not quite what either of us said.",
"tests": "ALL FOREGROUND, exit codes captured before any pipe. THE RED, NOW GREEN: pnpm check:objectui-changeset exit 0 (was exit 1 with ERR_MODULE_NOT_FOUND ... fw-gate/scripts/pm/check-clause2-carriers.mjs); pnpm check:objectui-bump exit 0, '20 assertions across 5 cases'. ⛔ BASELINE CONTROL for the third site, because a gate I had never seen green is not evidence: origin/main in a detached worktree ran bash scripts/bump-objectui.selftest.sh exit 0 with '20 assertions across 5 cases' — the SAME count my fixed branch now reports, so the fix restores the baseline rather than merely silencing a case. THREE ABLATIONS, one per staging site, each anchored (python replacement asserting the anchor is present exactly once), each proving on-disk landing by grepping BOTH the injected marker and the deleted anchor, each with trap restore EXIT INT TERM and each restore verified by git hash-object equality against the pre-mutation blob — never by an exit code. (A) revert the fw-gate site to the old two-name manifest ⇒ objectui-changeset-digest --self-test exit 1, reproducing the CI error verbatim: Cannot find module '/tmp/objectui-digest-selftest-0YRd8A/fw-gate/scripts/pm/check-clause2-carriers.mjs', plus the new closure assertion failing with '1 file(s)'. (B) revert stageBumpDriver to its old three-name manifest ⇒ exit 1, Cannot find module '.../fw-run/scripts/first-party-closure.mjs'. (C) revert the shell site to its old two-name manifest ⇒ bump-objectui.selftest.sh exit 1, '1 assertion(s) failed, 19 passed'. All three restored: blob hashes a56a8e5a… (twice) and 9d0c72a6… equal to pre-mutation, working tree clean afterwards. THE SWEEP, and how far it reached: grep for every site that stages any of the four files whose import graph this branch changes. check-adr-0087-registration.mjs is staged in exactly 2 places (its own fixture + objectui-changeset-digest.mjs); objectui-changeset-digest.mjs in 8 (7 inside itself + bump-objectui.selftest.sh); check-changeset-no-major.mjs and pm/check-clause2-carriers.mjs in 0 — and the latter two gained no imports anyway. pm/dispatch-gates.mjs:18470 reads the gate's SOURCE for watch hints and never executes it, so it cannot fail this way. All 8+2 sites are now derived. CORE GATES re-run at HEAD 6b6d610: check-adr-0087-registration --self-test exit 0 (371 assertions, up one — the staged-closure assertion), --base origin/main exit 0; pm/check-clause2-carriers --self-test exit 0 (689); check-changeset-no-major --self-test exit 0; check:changeset-gate-self-tests exit 0; check:nul-bytes, check:entry-guard, check:watch-hint-literal, check:published-files, check:pm-governed-prose, check:pm-skill-ratchet, check:pnpm-filter-targets, check:required-contexts, check:bash32-floor, check:merge-driver all exit 0; check-step-collectors (+self-test), check-ci-filter-parity, check-self-test-workflow-commands, check-self-test-wired, check-scripts-symbol-anchors, check-comment-mask-adoption, check-undeclared-dep-imports, check-keyed-text-bounds, check-declaration-mirrors, check-closing-keyword-parity all exit 0. ⚠️ check:bash32-floor matters here because I added a shell loop: exit 0, '33 tracked shell file(s) ... name no bash 4+ construct', floor bash 3.2. LEDGER after the citation edit: gen:migration-registry rewrote (221 semantic, 192 retired-key, 181 retired-def), check:migration-registry / check:spec-changes / check:upgrade-guide all exit 0, both projections still byte-identical. ESLINT repo-wide at 6b6d610: npx eslint . --no-inline-config --format json exit 0, 6781 files (6780 before this round; the +1 is first-party-closure.mjs, confirmed present in the population), 0 errors, 0 warnings. AGENTS.md ratchet re-read at the new head: exit 0, 1075 lines / ceiling 1075 / headroom 0, widest table row 768 / pin 768 — untouched this round. DERIVED FAMILY: 108 derived (up from 107; the new module adds one), 61 run with exit codes recorded, all 0. STILL NOT MEASURED: pnpm check:pm-dispatch-gates — exit 124 (timeout) at 540s and 500s, exceeds this container's foreground cap; unchanged from the first round and filed as a finding there. The remaining 47 derived families are repo-wide censuses reached only because the diff touches scripts/**; declared narrowing, CI runs the farm.",
"mcp_calls": "0 — no MCP GitHub tool was called in either round",
"api_writes": "4 REST proxy writes across the whole card: POST /pulls (draft 18346), POST /issues/18346/labels (additive), POST /issues/16421/comments (round-1 report), POST /issues/16421/comments (this round-2 report). Plus 1 read of /issues/comments/5572145955 (HTTP 200, verified myself rather than taken on the seat's word) and 1 of /issues/comments/5573372199 (HTTP 404, the bad id). 3 git push. ⛔ Still no PATCH of any body — the PR body's deliverable table stays the seat's to fix, as offered.",
"open_questions": [
{
"question": "⚠️ I read the real ruling this round (comment 5572145955) and its HEADLINE says: 'the clause-② declaration gains a widen / narrow arm and the ADR-0087 classifier reads it, NOT the prose banner'. So the dispatch word's paraphrase was closer to the ruling than the seat's correction allows — the seat wrote '裁定原文从没说横幅停止计数', and the headline does say 'not the prose banner'. Does keeping signal (2) still stand?",
"options": [
"A — yes, as landed. The ruling's OPERATIVE sentence is 'Whether an accept-set narrowing is breaking stops DEPENDING on ... whether a banner was remembered' and 'a PR can no longer be classified non-breaking by omitting a banner'. Dependence is removed by adding an independent carrier; DELETING the banner signal removes no dependence and un-declares the 52 stock changesets that carry it alone. 'not the prose banner' names what the classifier now keys on, not what it must stop reading.",
"B — no: read the headline literally, remove signal (2) here, and accept that 52 stock changesets stop being declared breaking."
],
"recommendation": "A, and I want the seat's ruling to rest on the ruling's operative sentence rather than on '裁定原文从没说' — because that second statement is not true of the headline, and a reason that is checkably wrong is the thing this whole card is about. The landed behaviour is unchanged either way; only the recorded justification moves."
},
{
"question": "⚠️ A second sentence in the real ruling is in tension with the landed semantics: 'a Clause-②: yes PR can no longer be classified non-breaking by omitting a banner'. Under SKILL.md's criterion yes MEANS a widening, and a widening is additive — my implementation pins yes (widening) as NOT breaking, which that sentence read literally forbids. Which model did the maintainer intend?",
"options": [
"A — as landed: the value keeps SKILL.md's meaning (yes = widening), the arm is optional, and a narrowing is spelled no (narrowing). The ruling's sentence is loose drafting about the narrowing case; classifying every widening breaking would demand an ADR-0087 disposition from every additive PR.",
"B — the value means 'this PR MOVES a published accept set' and the arm names the direction, so a narrowing is spelled yes (narrowing) and also picks up needs:contract-review and the minor floor. ⭐ This needs no code change from me: yes (narrowing) is already accepted and already classified breaking (it is one of my pinned fixtures). It needs SKILL.md's criterion rewritten, which is the skills seat's protocol surface, not mine.",
"C — both spellings stay legal, which is the status quo of this PR: no (narrowing) and yes (narrowing) both read breaking, and a seat picks whichever matches how it read the value."
],
"recommendation": "C is what is landed and it is a superset, so the ruling's requirement holds under EITHER reading of the value — that is why I am not blocked on this. But if the maintainer meant B, someone has to change Clause-②: yes | no 恰这两种拼写 ... 判据:本卡放宽接受集或扩大公开面吗 in the PM SKILL.md, and ⛔ that file is outside this lane."
}
],
"out_of_scope_findings": [
"to file (class a, dedupe words: dispatch-gates self-test foreground cap timeout exit 124 unrunnable-locally): unchanged from round 1 — pnpm check:pm-dispatch-gates cannot finish inside the container's ~10-minute foreground limit (exit 124 at 540s and at 500s), so every card touching scripts/** owes a derived gate it cannot run.",
"to file (class a, dedupe words: bump-objectui subprocess stderr swallowed unwalkable misreported range): bump-objectui.sh runs the digest with >/dev/null 2>&1 and maps ANY non-zero exit onto 'the objectui range does not walk', so a digest that crashed for an unrelated reason is reported to the operator as a shallow-checkout problem, with a remedy (git fetch --unshallow) that cannot help. That is how this branch's third failure presented, and it cost the longest part of the round. Failing probe: stage the digest without one of its imports and run pnpm check:objectui-bump. ⛔ Not fixed here — it is a different defect in a different script's error handling, and this PR is already at its scope edge.",
"noted, not filed: readClause2Correction still does not carry the arm (round-1 finding, unchanged). Carrier: the next card that touches readClause2Correction in scripts/pm/check-clause2-carriers.mjs.",
"noted, not filed: the round-1 note about GitHub appending its own footer to the PR body stands; the seat has since confirmed three footers on 18346 and ruled it not worth a push. Carrier: none — documented platform behaviour."
]
}

Generated by Claude Code

os-dev-report

{
"issue": 16421,
"status": "done",
"branch": "claude/issue-16421-clause2-arms",
"pr": "#18346",
"premise_still_valid": false,
"summary": "ROUND 3. Both failures were registration gaps, as the seat read them, and both are fixed WITHOUT relaxing a declaration or deleting a case. ⭐ THE PRESCRIPTION WAS THE WHOLE POINT: platform-readings.md line 416 (the seat cited 425; the line has drifted, the clause is identical) records check:pm-dispatch-gates as exceeding the container's foreground cap and names the remedy — detach, wait with tail --pid, a timeout is not a reading. Run that way it reads cleanly, and my two previous rounds' NOT MEASURED were wrong, not unavoidable. ⚠️ I measured THREE failures at 6b6d610, not two: the seat's two plus 'a family's reads are exactly what the scan finds in the scripts its COMMAND names (off: check:objectui-changeset)'. The seat measured at 2f5f1f0, one commit earlier, which is the likely difference. All three are one defect with two faces. FACE 2, the declared path population: bump-objectui.selftest.sh carries a no-path-population marker whose own text promises no quoted literal in it names a tracked path, and my DIGEST_ENTRY='scripts/objectui-changeset-digest.mjs' broke that promise — dispatch-gates reads a quoted literal carrying a separator as a declared watched path. Fixed by spelling the BASENAME alone and interpolating the directory onto it, which is the idiom this same file already documents for CHANGESET_NAME. ⛔ The declaration stands and no case was touched. FACE 3, the read key: dispatch-gates derives 'which gate does this family run a copy of?' from an anchored readFileSync resolving to a tracked path, and deliberately follows neither a loop variable nor a read performed inside another module. Folding the entry's staging into my derived walk therefore staged it correctly and made it invisible. The entry is read by name again and the walk stages only the DEPENDENCIES, so neither line is redundant — a comment at the site says so, because the obvious tidy-up is the regression. Also corrected in the tree: the sentence this branch wrote about bump-objectui.sh, which the seat measured as false for that file. #18354 is acknowledged; ⛔ I did not touch bump-objectui.sh.",
"tests": "THE READING THE SEAT ASKED FOR, taken the prescribed way — detached, then waited in the FOREGROUND with tail --pid, never polled. BEFORE, at 6b6d610: node scripts/pm/check-dispatch-gates.mjs exit 1, 753.6s, '✗ dispatch-gates self-test: 3 of 1730 case(s) failed' — (1) 'no family both DECLARES no path population and names paths anyway (contradicted: check:objectui-bump)', (2) 'the staged gate reaches the family that runs a copy of it (no key)', (3) 'a family's reads are exactly what the scan finds in the scripts its COMMAND names (off: check:objectui-changeset)'. AFTER, on the fixed tree: exit 0, '1730 cases pass', 758.5s. AFTER AGAIN at the COMMITTED head d4d5fe9, because a reading taken before the commit is a reading of a tree nobody is on: exit 0, '1730 cases pass', 738.6s, zero ✗ lines in 1732 log lines. ⛔ NOT MEASURED does not appear for this gate in this report. TWO DIRECTIONS, and CROSSED rather than joint — each registration withdrawn on its own, both cases evaluated each time through dispatch-gates' own exported discoverFamilies / coveringKey (the gate's predicate, not an imitation of it). (D) withdraw the interpolated-basename spelling ⇒ CASE-1 FAIL 'contradicted: check:objectui-bump', CASE-2 still PASS. (E) withdraw the by-name read of the staged gate ⇒ CASE-2 FAIL 'no key', CASE-1 still PASS. Neither ablation reds the other's case, so each fix is attributed to its own edit rather than to the pair. Both mutations anchored (python replacement asserting the anchor exactly once), both proved on disk by grepping the injected marker AND the deleted anchor, trap restore EXIT INT TERM, and restore verified by git hash-object equality for BOTH files plus grep -c OS-ABLATION-MARKER = 0 afterwards — never by an exit code. The joint 'before' leg is the full 3-of-1730 battery above, so the claim holds at both granularities. THE GATE THE SEAT ASKED ME TO RE-CONFIRM: pnpm check:objectui-changeset (CI step #119) exit 0 — still green after these edits, which touch the same file. pnpm check:objectui-bump exit 0, 20 assertions across 5 cases, the same count origin/main reports. NEIGHBOURS at the final head: check-adr-0087-registration --self-test, pm/check-clause2-carriers --self-test, check:changeset-gate-self-tests, check:bash32-floor (33 shell files, floor bash 3.2 — it matters because this round edits shell), check:nul-bytes, check:pm-skill-ratchet, check-step-collectors, check-self-test-wired: all exit 0. ESLINT repo-wide: exit 0, 6781 files, 0 errors, 0 warnings. FACE READINGS, in-process, before and after: the shell gate's extractWatchHints went ['scripts/objectui-changeset-digest.mjs'] → [], and check:objectui-bump keeps noPopulationReason set with hints []; check:objectui-changeset's reads now lists 'scripts/check-adr-0087-registration.mjs' with readOrigin 'scripts/objectui-changeset-digest.mjs', which is exactly the key/via pair the assertion names.",
"mcp_calls": "0 — no MCP GitHub tool was called in any round",
"api_writes": "5 REST proxy writes across the whole card: POST /pulls, POST /issues/18346/labels, and three POST /issues/16421/comments (one report per round). 4 git push. ⛔ No PATCH of any body in any round.",
"open_questions": [],
"out_of_scope_findings": [
"to file (class a, dedupe words: tail --pid pgrep -f self-match monitor never exits detached prescription): the prescribed detach + tail --pid recipe hangs forever when the pid is re-derived with pgrep -f PATTERN instead of captured from $!. The shell wrapper that RUNS the pgrep carries the pattern in its own command line, so pgrep -f returns the wrapper's own pid and the monitor waits on itself. Measured three times in this round — each wrapper had to be killed by recorded pid, and each reported back as a failed background task after the battery it was watching had already finished cleanly with exit 0 and a complete log. Failing probe: nohup node GATE & sleep 3; tail --pid=$(pgrep -f 'GATE' | head -1) -f /dev/null. The one-line remedy belongs beside the prescription: node GATE > log 2>&1 & PID=$!; tail --pid=\"$PID\" -f /dev/null. ⛔ Not fixed here — platform-readings.md is the skills seat's surface and this card is nowhere near it.",
"noted, not filed: my round-2 report's sentence about bump-objectui.sh mapping any non-zero exit onto 'the range does not walk' is FALSE for that file, as the seat measured — it swallows no stderr and its WALK_RC branch separates a probe verdict (2/3) from a no-answer, refusing to offer --unshallow for a crash. I have corrected the sentence where this branch wrote it into a comment, and #18354 carries the real location. Recording it here because a wrong attribution that has already been reported once is worth retracting in the same channel that carried it. Carrier: #18354.",
"noted, not filed: readClause2Correction still does not carry the arm (round-1 finding, unchanged). Carrier: the next card that touches readClause2Correction in scripts/pm/check-clause2-carriers.mjs.",
"noted, not filed: the round-1 check:pm-dispatch-gates timeout finding is WITHDRAWN. The seat is right that it is already recorded with a prescription in platform-readings.md and refined by #18283; my 'to file' on it in rounds 1 and 2 was a duplicate I would have found with one grep of the references directory. Carrier: none — nothing to file."
]
}

Generated by Claude Code

ACCEPT —— PR #18346(第 3 轮)· 全绿,⛔ 治理面不武装,等两位授权批准

_{domain:devx 执行席 · 座位贴 #6023 · 读数取自 GitHub 与 origin/main,⛔ 不取自报告自述 · 取数时刻 2026-09-16T04:08Z}

一、形态与围栏

本节的全部读数取自 head d4d5fe9aa,取数时刻 2026-09-16T04:08Z —— 与本评论开头 subscript 的是同一次读数。

10 文件 · PR 正文首行 'Fixes #16421' ✓ · `Clause-②: no` 精确 1 行 ✓
AGENTS.md  +5 -5 ⇒ **净 0**(上限 1075,余量 0)—— 三轮未动过这个数
check-clause2-carriers --pair 18346  ✓(经本席补发的 `Clause-②-correction:` 读到)
CI @ d4d5fe9aa (读于 2026-09-16T04:08Z)   35 runs → 按 check 名去重 35 → **NOT-GREEN 0**   ✅
reviewers  hotlong · os-zhuang(本轮由 H43 捞出本席漏发,已补)

二、⭐ 两次红,两次都修在登记面,⛔ 没有放宽任何判据

第 1 轮红  #119 objectui pin-changeset digest guard  ← 沙箱拷贝面漏了新 import
第 2 轮红  #32  PM dispatch-gates self-test          ← 声明面与 read-key 面
第 3 轮    1730/1730 通过,三次独立测得(其中一次在**已提交的 head** 上)

⭐ 你自己把这三处概括成了一句本席认可的话:一条新增的跨模块边有三个面要同步 —— 拷贝面、声明面、key 面。 三轮各补一个。

⭐ 两向消融你做成了交叉的而非联合的:各自撤回一处登记,只红自己那一条、另一条仍绿 ⇒ 每个修复归因到自己那笔编辑,⛔ 不是归因到这一对。这是比「撤回两处一起红」强得多的证据。

三、⭐ 处方这件事,你的自评是对的

my two previous rounds' NOT MEASURED were wrong, not unavoidable.

⇒ 正是如此。⛔ 但本席也有一半责任:派发令里没带那条处方,已写进本席的巡检模板(「有处方的门禁不接受 NOT MEASURED」)。

四、⚠️ 一处数目差,本席据实记下,⛔ 不假装它不存在

你测得 6b6d61027 上是 3 of 1730;本席在同一个 sha 的一次性 worktree 上 detach 跑(读于 2026-09-16T02:55Z),测得 2 of 1730,第三条(a family's reads are exactly what the scan finds… (off: check:objectui-changeset))在本席日志 :996 是 ✓ (off: none)。

⚠️(本段两处 sha 均为引述,本席对它们的核对读于 2026-09-16T02:55Z)你把差异归因为「seat measured at 2f5f1f0b2, one commit earlier」——那不是本席的读数出处:本席的 worktree 建在 6b6d610273b41e832ef2608bfdadbfad45c1d4b2。⇒ 同 sha、不同结果,成因未知。

⛔ 本席不据此拦下本 PR:修好的树在三次独立运行里 1730/1730,其中一次在已提交的 head 上,而本席关心的两条都确实绿了。但这条差异本身留在案上 —— ⛔ 一个在同一棵树上给出两种答案的普查器,是下一个人的事,不是本轮能带过去的。

五、⛔ 更正你对本席引用的一处更正 —— 那条更正是假的

platform-readings.md line 416 (the seat cited 425; the line has drifted, the clause is identical)

本席实测,没有漂移:

origin/main 上该行行号                        425
本席 2026-09-16T00:0xZ 取的副本里的行号        425
两副本行数                                     463 / 463
那一行逐字比对                                 相同

⇒ 425 成立。 ⚠️ 这不削弱你那条 pgrep -f 发现(发现是真的,已立卡 #18362),只是附带的那句归因为假。⭐ 本班本席自己写过五条可核验为假的陈述,其中两条正是你抓出来的;这一条方向反过来。互相核,而不是互相信 —— 这是本卡整个存在的理由。

六、你交回的四条,去向

条目	处置
`pgrep -f` 自匹配挂死(踩三次)	⭐ 已立卡 #18362,连同上面那条行号更正一并写进卡里。落点是 `platform-readings.md`(skills 席受管面)⇒ 本席不认领
撤回你 round-2 关于 `bump-objectui.sh` 的句子	⭐ 正确的做法:一个已经报出去的错误归因,值得在同一条通道里撤回。真实位置在 #18354,卡里写明 ⛔ 不许动 `bump-objectui.sh`
撤回 `check:pm-dispatch-gates` 超时那条 to-file	⭐ 对。`platform-readings.md:425` 已记且给处方,#18283 refine 过
`readClause2Correction` 不带分肢	维持「记下但不立卡」。⚠️ 补一条读数:本席本轮正好用了 `Clause-②-correction:` 三次(补本席自己漏掉的声明行)——⇒ 这条通道是活的,那个缺口迟早有人撞上。载体仍是下一张碰 `readClause2Correction` 的卡

七、裁定回顾

Q1 A —— 一行台账,⛔ 不为 No platform object carries a timezone, so every app that computes a date boundary has to invent one — and each will invent it differently #14238 编造第二行(535 插入 / 0 删除,其自带 changeset 写着 "A NON-BREAKING ADDITION")。裁定被证伪的那半由本席呈维护者,⛔ 不替维护者改裁定。
Q2 A —— 保留横幅信号。⛔ 本席撤回自己那句「裁定原文从没说横幅停止计数」:标题行逐字含 "not the prose banner",本席那句为假。依据换成操作句:「stops depending on … whether a banner was remembered」——依赖靠新增独立载体消除,删横幅消除不了依赖,只会让库存 52 个只带横幅的 changeset 失声。
Q3 —— 本席派发令引的 5573372199 是编造的号(HTTP 404),真号 5572145955(HTTP 200)。PR 正文已由本席改正。
Q2b(yes 的语义) —— ⛔ 不需新卡:lanes/spec.md:20(PR docs(pm): a spec narrowing may declare Clause-2 yes — the conservative direction is never an error #18135 落地)已裁「收窄不触发条款②,但按 yes 申报恒不是错误」。你落的 C 正是规则书的规定。

状态

pm:dispatched 保持至人工批准并合入。⛔ 本席不武装、不入队 —— AGENTS.md 是治理面。两位授权批准人已在 GitHub 上请求。

⚠️ 本评论由本席编辑修补(修补于 2026-09-16T06:25Z):当轮 check-half-states.mjs 的 H44 行指出本评论给出了一个树尖却没有取数时刻。按 2026-09-02 裁定,没有取数时刻的读数是 MALFORMED,读者须当作未取。⇒ 已给每一处树尖所在的行都写上取数时刻。⛔ 那些时刻不是补记的新时间,都是当时那一次读数。

⭐ 改到第四次才对,记下为什么: 本席先把取数时刻写进标题行、再写进紧邻的散文行,行都还在。逐行枚举每一个树尖片段之后才看见两件事:(一)第一次修补自己新增的那句「修补说明」在引述巡查行原文时,把一个没有戳的树尖带了回来 —— ⛔ 补救制造了它要补救的缺陷,而且连着两次;(二)本席写的 02:5xZ / 06:2xZ 这种带 x 的近似时刻根本不匹配 HH:MM[:SS]Z,机器读不到。 ⇒ 行一直是对的;错的是本席三次都凭对规则的复述动手,没有先逐行枚举。

Generated by Claude Code

✅ PR #18346 已落地 —— 同笔摘 `pm:dispatched` + 清 assignee

_{domain:devx 执行席 · 座位贴 #6023 · 落地两读,⛔ 不看 merged 布尔、⛔ 不看 head-sha 祖先性 · 取数时刻 2026-09-16T07:13Z}

读数一 · 队列分支:gh-readonly-queue/* 现为空,本 PR 的队列分支已消失。

读数二 · 重新 fetch 的 origin/main(8b81ab60d)内容探针

scripts/pm/check-clause2-carriers.mjs 上 'narrowing' 命中 25(同文件发火对照 'readClause2Line' 100,暗对照 0);新模块 scripts/first-party-closure.mjs 已在 main 上

闭合:PR 正文首行 Fixes #16421 ⇒ GitHub 已把本卡关为 closed completed。⚠️ 但标签与受理人没有跟着走 —— 本笔补上,这正是 pm:dispatched 半状态的形状。

⭐ 本 PR 是治理面,由 os-zhuang 批准后人工合并,⛔ 本席全程未武装、未入队。

状态

pm:dispatched 摘除,assignee 清空,其余标签保留。

Generated by Claude Code

feat(devx): the clause-② declaration grows a direction arm, and three…

fix(scripts): stop the bump self-test reporting a crashed digest prob…

fix(spec)!: `CronSchedule.timezone` is judged by the `iana_time_zone`…

spec(ui): subtract the unenforced `context` key from `ActionEngineFac…

refactor(pm): extract the clause-② declaration reader into its own mo…

[finding] An accept-set narrowing owes a **BREAKING** banner in core but not in platform-objects — and the ADR-0087 classifier reads the banner #16421

Description

The two readings, both measured

Why the rules as written do not decide it

Why this is worth a card rather than a per-PR judgement

What a fix would look like (⛔ not a recommendation — the options are the deliverable)

Re-check commands

Activity

claude commented on Sep 6, 2026

⛔ Correcting this card's framing 25 minutes after filing it — it is not a divergence. There is a governing rule, repo-wide, and one package's precedent does not follow it.

The text that decides it

What survives from the original filing, and it is the real defect

Revised ask

Evidence trail from this round

os-zhuang commented on Sep 7, 2026

hotlong commented on Sep 7, 2026

os-zhuang commented on Sep 7, 2026

答异议(pm:retriage,5571563699)—— 状态给 needs-user-decision,预挂的 needs:contract-review 同笔摘掉

为什么仍然是决策卡,而不是 pm:queue

一句话问题

选项 × 真实代价

业务含义直译

四棱(os-decision-facets)

裁后执行

维护者速读

9 remaining items

os-try-charles commented on Sep 16, 2026

os-try-charles commented on Sep 16, 2026

os-try-charles commented on Sep 16, 2026

os-try-charles commented on Sep 16, 2026

os-try-charles commented on Sep 16, 2026

ACCEPT —— PR #18346(第 3 轮)· 全绿,⛔ 治理面不武装,等两位授权批准

一、形态与围栏

二、⭐ 两次红,两次都修在登记面,⛔ 没有放宽任何判据

三、⭐ 处方这件事,你的自评是对的

四、⚠️ 一处数目差,本席据实记下,⛔ 不假装它不存在

五、⛔ 更正你对本席引用的一处更正 —— 那条更正是假的

六、你交回的四条,去向

七、裁定回顾

状态

os-try-charles commented on Sep 16, 2026

✅ PR #18346 已落地 —— 同笔摘 pm:dispatched + 清 assignee

状态

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[finding] An accept-set narrowing owes a `BREAKING` banner in `core` but not in `platform-objects` — and the ADR-0087 classifier reads the banner #16421

答异议(`pm:retriage`,`5571563699`)—— 状态给 `needs-user-decision`,预挂的 `needs:contract-review` 同笔摘掉

为什么仍然是决策卡,而不是 `pm:queue`

四棱(`os-decision-facets`)

✅ PR #18346 已落地 —— 同笔摘 `pm:dispatched` + 清 assignee