feat(pm): check-clause2-carriers emits the contract-review record as a copyable template

[claude]

Fixes #18042

The contract-review record is the one machine-read artefact this skill described only in
prose. references/contract-review.md names its shape (:28), its Served-tier: first line
(:29) and the machine-read authorship pair (:35, :37) — and nothing in the tree could be
copied. Four in-seat records in one session composed the pair from memory and put a word in
front of the value; C4 refused all four as HALF WRITTEN, and two reached main, where C6
then reads「no review of record on that head」. The standing remedy this family prescribes
everywhere else — COPY the template's line rather than composing one — was unfollowable for
exactly this artefact, because nothing existed to copy.

The measured instance (⛔ read only; not edited, not re-posted)

Comment 5652813288 on PR #17986 carries the pair as:

Implemented-by: branch claude/issue-17780-plugin-lifecycle-duration-units
Reviewed-by: session_015c5G6TmpMKgnusmTpD7Ntt

The leading word is the entire defect. readImplementerToken strips DECORATION (spaces,
**, backticks) and never a word, so the token has to be the first thing after the colon —
「值紧跟冒号,前置词即不可读」. Both directions are now pinned: the specimen verbatim reads
malformed, and the same record with that one word removed reads pair.

What landed

The checker that ENFORCES the shape now EMITS it:

node scripts/pm/check-clause2-carriers.mjs --template   # exit 0, no board is read

It prints the record fenced between two markers, with every value directly after its colon,
followed by a per-key legend. The record block (its last line, the verdict line in caps, is
omitted HERE on purpose — a body carrying it would be readable as a verdict comment by any
reader handed this body, and this PR is not a review of record):

## Contract review

Served-tier: `CONTRACT_REVIEW_TIER`
Head-sha: `0000000000000000000000000000000000000000`

### ① Derived judgments

### ② Semver level

### ③ Boundary flags

Implemented-by: `claude/issue-NNNN-slug`
Reviewed-by: `session_SEATSESSIONID`

Three properties the placeholders are chosen for, each pinned by a self-test case:

• They parse. An unedited paste still reads as a pair, so what an unreplaced placeholder
  changes is WHOSE record it is, never whether it reads at all.
• The head placeholder is git's null oid, so the shape is a recognised hex span (the
  template is provably round-trippable) while prefixing NO real head — a record pasted
  unedited is refused by C6, never silently adopted. Fail-closed in the one direction that
  matters.
• No angle brackets anywhere. The body sanitizer eats tag-shaped fragments, backticked
  ones included; a placeholder spelled that way would be eaten out of the very comment a seat
  pastes it into. This is the same fact CLAUSE2_CORRECTION_KEY_LINE already states for the
  correction carrier, and it is why the card's suggested issue-(n)-(slug) spelling is NOT
  what shipped.

Two shape corrections the template carries by construction, both measured on the specimen:

1. The head sha gets a code span of its OWN. H51_SHA_SPAN matches a span that is hex
   and nothing else, so the corpus spelling — the whole Head-sha: … pair inside ONE span,
   which is what comment 5652813288 writes — matches nothing, and that record names no head
   at all. A self-test CONTROL pins the difference.
2. The verdict word is in caps. VERDICT_MARKER is case-sensitive, so the capitalised
   spelling is recognised by the marker alone, without depending on the head match.

c4VerdictSelfReview's own HALF WRITTEN refusal now names the flag, which closes the loop:
the row a seat lands on when it gets the pair wrong tells it what to copy.

The route taken, and why

The seat's suggested route, and measurement agreed with it: the checker emits the template
rather than the doc carrying a literal block. contract-review.md is 60/60 with zero
headroom, so a literal block would have had to be funded by deleting five or six rule lines.
⛔ Re-wrap is not currency and ⛔ no ceiling was raised.

One detail of the suggested route was falsified by measurement and is reported rather than
followed: the pointer could not land on :35, which is already at exactly 120 bytes — the
cap — and :29 held only 10 bytes of headroom, less than any pointer spelling costs.

Line budget — net 0, paid by density INSIDE the file

:29 before  110 B  - 同形含首行 `Served-tier:`:值写常量名 `CONTRACT_REVIEW_TIER`,可前置 N/N;无此行不成裁决。
:29 after   119 B  - 同形含首行 `Served-tier:`:值写常量名 `CONTRACT_REVIEW_TIER`;无此行不成裁决,模板见 `--template`。

Paid by dropping 「,可前置 N/N」 (16 B) to fund 「,模板见 --template」 (25 B): 110 − 16 + 25 = 119 B,
under the 120-byte cap, and the file stays at 60 lines with no line added or removed.

Where the dropped clause survives — named, as the ruling requires. The stamp control moves
into the printed legend, where the author actually copies from:
· Served-tier … an at-tier/total stamp control may precede it — 75/75, then the constant,
pinned by a self-test case so it cannot silently vanish. Its ENFORCEMENT never lived in the
doc at all: STAMP_CONTROL and servedStampsHold carry it, unchanged by this PR. C7's rule
string, which mirrors :29 verbatim, is updated in the same edit so the quote cannot go stale.

Acceptance greps, both directions

node scripts/pm/check-clause2-carriers.mjs --template   :: exit 0
  prints  Implemented-by: `claude/issue-NNNN-slug`     (value directly after the colon)

pointer phrase 「模板见 `--template`」   base 0  ->  head 1
lit control 「值紧跟冒号」               head 1  (still hits)
contract-review.md line count           base 60 ->  head 60
LC_ALL=C awk 'length($0)>120'           prints nothing
git diff --stat origin/main -- .claude/skills/pm-dispatch/SKILL.md   empty
check-skill-line-ratchet                 60 lines (ceiling 60; headroom 0)  :: exit 0

Reverse verification (one-off, nothing left in the tree)

Committed first, then the template's Implemented-by: value was mutated to carry the
measured leading word, on disk and proven there (clean anchor 1 → 0, mutated anchor 0 → 1;
blob cb3c41f79 → 50c4ed175):

node scripts/pm/check-clause2-carriers.mjs --self-test  ::  exit 1, 5 case(s) ✗
  ✗ ⭐ the PRINTED template round-trips through the reader that judges the real thing
  ✗ …reading the BRANCH placeholder as the implementer, never the prose around it

Restored with git checkout HEAD -- (⛔ not the bare form, which restores from the polluted
index): git diff HEAD --stat empty, blob back to cb3c41f79, byte-identical to HEAD.

Gates — 42 derived, 42 run, 0 NOT-MEASURED, 0 UNRUN

Derived with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack
(no paths), every command run in the foreground with $? captured before any pipe, then
reconciled with --ran carrying each exit code:

✓ dispatch-gates --ran: 42 derived famil(ies) accounted for — 42 run, 0 NOT-MEASURED
  (a DERIVED zero — all 42 recorded an exit code and none of them is 3).

All 42 exit 0, including check:pm-clause2-carriers (628 self-test cases, 23 of them this
card's), check:pm-skill-ratchet, check:pm-skill-id-lint, check:pm-governed-merges,
check:nul-bytes and check:pm-dispatch-gates. Two ran outside the derivation and also pass:
check:pm-governed-prose and node scripts/check-skills-token-ratchet.mjs.

check:doc-formula-expressions first exited 3 — PREREQUISITE NOT MET (a workspace package
was unbuilt). That is not a verdict: the two packages were built under
scripts/pm/os-verify-lock.sh and it was re-run to exit 0.

Changeset

None. .claude/** and scripts/pm/** publish nothing — no package files[] ships either
path — so this carries the skip-changeset label instead.

Out of scope — reported to the PM rather than filed

The write budget for this dispatch is git push + one POST /pulls + the label + one report
comment, so these are handed to the PM to file rather than filed here:

• (a) A record written in the corpus's own head-sha spelling names no head. Comment
  5652813288 writes Head-sha: … and the sha INSIDE one code span; H51_SHA_SPAN needs a
  span that is hex and nothing else, so contractReviewHeadMatch answers null and C6 reads
  no review of record on that head even where a correct record exists. Probe: the CONTROL case
  in this PR's own battery. contract-review.md :28 says 「所审 head sha 码段」 without saying
  the span holds the sha ALONE, which is the authoring trap behind it. The template closes it
  for every record written from here on; it does not touch the ones already on the board.
• noted, not filed: comment 5652813288 also carries no Served-tier: line at all, so
  under C7 it would not stand as a verdict today. Successor: whoever next touches the record
  shape — this PR does not, and ⛔ a merged record is not edited.

维护者速读(草稿)

改了什么 — 契约复核记录第一次有了可照抄的模板:执行形状的那个检查器现在自己打印它
(--template),值一律紧跟冒号;contract-review.md :29 加一句指针,行数不变。

为什么改 — 一个会话里四份席内记录都把 Implemented-by: 写成「前置一个词」,四份全被 C4
判 HALF WRITTEN,其中两份已经进了 main,那两条 head 上等于「没有复核记录」。规则一直写在散文里,
四个连续的读者都没读出来;本仓其他机读字段的标准解法是「照抄模板」,唯独这一份没有模板可抄。

风险与代价(含回滚) — 只动两个文件,都不发布,不影响任何运行时;新增的是一个只打印、不读板子的
flag,和 23 条自测。代价是规则行里 「可前置 N/N」 换成了模板指针 —— 该条的强制逻辑在检查器里没动,
说明移进了模板的图例并被自测钉住。回滚 = revert 本 PR,没有迁移、没有数据、没有下游依赖。

席位意见 —

你要做的 — 确认这条取舍:规则层用 16 字节的「可前置 N/N」换 25 字节的模板指针,是否接受。
若接受,本 PR 无其他待决项;另有一条超范围发现(记录里 head sha 的码段拼法)已写在上一节,请代立卡。

Clause-②: no — the diff adds no key, arm, export or registration on any declared surface;
check-widening-tells --declaration no judged 2 changed file(s), 0 against a declared surface.

Generated by Claude Code

---

Generated by Claude Code

[claude]

• Served-tier: 2214/2214 CONTRACT_REVIEW_TIER — harness model stamp counted over this seat's own transcript (non-sidechain assistant messages a model served; <synthetic> harness notices excluded) at 2026-09-14T06:04Z and compared to the constant's value outside the repository; get_session external_metadata.last_served_model read equal to the constant at 2026-09-14T00:20Z.

Contract review

Head: d8afc33b (PR #18138, card #18042) — reviewed at 2026-09-14T06:05Z by the skills seat at the contract-review tier. GOVERNED references tier (references/contract-review.md) plus non-governed scripts/pm/check-clause2-carriers.mjs; no rules-layer file ⇒ this in-seat record is the landing record at the tier PR #18036 enforces: the seat readies and arms auto-merge after it; no approval is owed.

① derived judgments (seat-measured on the fetched head d8afc33b against merge-base a90a9f26, ⛔ not taken from the report):

1. The doc line: contract-review.md :29 「- 同形含首行 Served-tier::值写常量名 CONTRACT_REVIEW_TIER;无此行不成裁决,模板见 --template。」 — 119 B under the 120 cap, 60/60, ratchet exit 0 (seat-run in a worktree). The dropped clause 「可前置 N/N」 is a reader fact, not a rule the prose enforced: the optional stamp control lives in the reader (STAMP_CONTROL / servedStampsHold, unchanged) and is stated in the printed legend, pinned by a self-test case.
2. The template: node scripts/pm/check-clause2-carriers.mjs --template exits 0 on the head and prints the fenced record — Served-tier: naming the constant, Head-sha: with git's null oid in a span of its own, the ① ② ③ headings, Implemented-by: / Reviewed-by: placeholders with the value directly after the colon, **VERDICT: PASS** — followed by a per-key legend and the two ⛔ notes (replace every placeholder; no angle brackets, the sanitizer eats them). Seat-run; no board is read.
3. The pins: self-test 628 cases exit 0 on the head (23 new: the template round-trips through the reader; an unedited paste parses but names no head, so it is refused rather than adopted; the measured specimen — comment 5652813288 on PR feat(spec)!: the three kernel/plugin-lifecycle-advanced.zod.ts duration keys carry their unit in the key name #17986, Implemented-by: branch … — reads malformed, the same record without the word reads pair); the dev's reverse verification (the placeholder mutated to carry a leading word → 5 failing cases, restored, blob hash back) shows the pins bite. C7's rule string and the C4 HALF WRITTEN remedy now name --template.
4. Gates: 42 derived / 42 run / 0 NOT-MEASURED / 0 UNRUN (including check:pm-dispatch-gates), plus check:pm-governed-prose and the skills token ratchet outside the derivation, all exit 0; one exit-3 prerequisite built under the verify lock and re-run to 0. Checks on the head at 2026-09-14T06:02Z: 0 red (13 in progress at read time).
5. Scope held: two files, +193/−5; SKILL.md untouched; no model identifier anywhere (the template names the constant); skip-changeset is the declaration; Clause-②: no holds — no contract path; --pair 18138 on origin/main's reader → exit 0 before this record; 3 REST writes, 0 MCP calls per the report.

② semver: unchanged — .claude/** and scripts/pm/** publish nothing.

③ boundary flags: the dev's out-of-scope finding (a) is real and this seat files it as a bare finding after this landing — a record whose head sha shares one code span with its key names NO head under H51_SHA_SPAN, so C6 reads no review of record even where one exists (measured on 5652813288), and contract-review.md :28 never says the span must hold the sha alone; the template closes it for records written from here on and does not touch the board's existing ones. This seat's own record spelling (Head: \sha`+Verdict:`) has been read by the pair and guard readers on every landing this shift and stays valid; the seat adopts the printed template from its next record.

Implemented-by: claude/issue-18042-contract-review-record-template
Reviewed-by: session_01DAcomhvR9kKizeYgg89Vo8

Verdict: PASS — references tier ⇒ this seat lands: ready through POST …/pulls/18138/ccr/ready_for_review with read-back, then PUT …/ccr/auto_merge; Fixes #18042 closes the card on landing.

维护者速读(终稿)

契约复审记录以前只有散文描述、没有可照抄的模板,一轮里四份记录把 Implemented-by: 写坏、两份已合入。现在检查器自己打印模板(--template):值紧跟冒号、head 用空 oid 占位、判词大写,自测 23 例钉住「照抄能读、加前置词被拒、不改占位符不被采信」;contract-review.md :29 只改一句指向它。references + 脚本层,本席自审自落地,不需要你批。

---

Generated by Claude Code

[claude]

CI red on d8afc33b — this PR's own, fix in flight — skills seat, 2026-09-14T06:21Z. Lint & Repo Gates failed at step 「A declared gate population reaches the tree」 (pnpm check:declared-population-live), reproduced by the seat on the head and green on origin/main 739ab526d as the control: the derivation reads the template's claude/issue-NNNN-slug placeholder in scripts/pm/check-clause2-carriers.mjs as a path-shaped literal declaring a population that reaches nothing in the tree. Remedy (b) from the gate's own message: stop spelling the path-shaped literal in the source (assemble the placeholder at runtime, or spell it so it is not read as a declaration) — the printed template stays byte-identical. The dev is resumed on the same claim to push that fix; auto-merge is disarmed until the seat re-issues its record on the new head (DELETE …/ccr/auto_merge at 2026-09-14T06:21Z, read back), then re-armed.

---

Generated by Claude Code

[claude]

• Served-tier: 2300/2300 CONTRACT_REVIEW_TIER — harness model stamp counted over this seat's own transcript (non-sidechain assistant messages a model served; <synthetic> harness notices excluded) at 2026-09-14T06:46Z and compared to the constant's value outside the repository; get_session external_metadata.last_served_model read equal to the constant at 2026-09-14T00:20Z.

Contract review

Head: 97e30bbb (PR #18138, card #18042 — the rework head after the CI red on d8afc33b) — reviewed at 2026-09-14T06:47Z by the skills seat at the contract-review tier; this record supersedes 5659726296 for the current head. GOVERNED references tier (references/contract-review.md, unchanged by the rework) plus non-governed scripts/pm/check-clause2-carriers.mjs ⇒ this in-seat record is the landing record at the tier PR #18036 enforces: the seat re-arms auto-merge after it; no approval is owed.

① derived judgments (seat-measured on the fetched head 97e30bbb against d8afc33b and merge-base a90a9f26, ⛔ not taken from the report):

1. The fix: one file, +20/−2 — the branch placeholder is assembled at runtime (['claude', 'issue-NNNN-slug'].join('/')) with the reason in a comment, so no path-shaped literal remains in the module body; the derivation admits a quoted literal only when it carries a separator or opens a known root (extractWatchHints, read by the dev), and neither half does. Remedy (a) correctly refused (the checker reads no file in the tree); no marker added (a standing claim outside this card).
2. The gate that was red is green on the head: node scripts/check-declared-population-live.mjs → 「251 of 307 famil(ies) declare a path population, and every one of them reaches this tree's 8659 tracked file(s)」, exit 0 (seat-run in a worktree); it was exit 1 on d8afc33b naming this family — the before/after pair on committed states is the reverse verification.
3. The template is byte-identical: --template output md5 d88c2fa561629e9ef8f91049aa50c7cc on d8afc33b and on 97e30bbb (seat-run); the self-test is 629 cases (628 + one pin that spells the printed placeholder out literally inside the self-test body, where the derivation's scan does not reach, so a later re-join is caught by check:declared-population-live), exit 0; battery floor 23 → 24. contract-review.md 60/60, ratchet exit 0.
4. Gates: 42 derived / 42 run / 0 NOT-MEASURED / 0 UNRUN, all exit 0, plus check:declared-population-live (not derived for this path — run anyway, exit 0), check:pm-governed-prose and the skills token ratchet. Checks on the head at 2026-09-14T06:46Z: 22 success / 8 skipped / 1 in progress (Lint & Repo Gates) / 0 red — auto-merge waits on it.
5. Scope held: the rework touched only the checker; one commit, no rebase / amend / force-push; Clause-②: no holds; --pair 18138 on origin/main's reader → exit 0 at 2026-09-14T06:46Z before this record; 1 push + 1 REST write this rework, 0 MCP calls.

② semver: unchanged.

③ boundary flags: the dev notes the family could honestly carry a dispatch-gates: no-path-population marker (its header says it reads no file in the tree) — not written because an inherited population would contradict it; #17991 (queued, the inherited-population finding on the same two files) is where that measurement belongs. The out-of-scope finding (a) of the first round is filed as #18141.

Implemented-by: claude/issue-18042-contract-review-record-template
Reviewed-by: session_01DAcomhvR9kKizeYgg89Vo8

Verdict: PASS — references tier ⇒ this seat lands: the PR is already ready; auto-merge re-armed through PUT …/pulls/18138/ccr/auto_merge with read-back; Fixes #18042 closes the card on landing.

维护者速读(终稿)

上一版 CI 红是模板里的分支占位符被派发推导当成了一个"声明了却不存在"的路径群;返工后占位符改为运行时拼接,打印出来的模板一个字节没变,原来红的检查在新 head 上绿了,自测 629 例。references + 脚本层,本席自审自落地,不需要你批。

---

Generated by Claude Code