pm-dispatch: restore needs:contract-review as a marker for a PR awaiting its at-tier review

[objectstack-fleet]

Fixes #19973
Clause-②: no

维护者速读(草稿)

改了什么:把 needs:contract-review 恢复为「PR 在等达档契约复核」的可见标记。规则落在 contract-review.md 新增的一节(何时挂、何时摘、谁读,并写明没有任何检查读取它);landing-operations.md 里「子代理起不来」那一行原地改写,点名这个标记(行数不变);ensure-pm-labels.sh 加回这个标签的定义(新颜色,说明写明「只是标记,没有检查读它」)。

为什么改:您的原话「恢复 needs:contract-review，把这句原话写进一张 skills 车道的卡」,回答的是「只作等复核标记，不作闸门」那一问。上一班达档复核子代理连续被限流,12 个 CI 全绿的 PR 在等达档复核记录,只能靠翻座位贴才看得到;现在一个过滤 is:pr is:open label:needs:contract-review 就能列出来,交接也不必先读座位贴。

风险与代价(含回滚):不新增任何门禁:没有 check、workflow、队列守卫或巡查脚本读它,落地仍只认 ## Contract review 记录,标记丢了或多挂了都不会放行或拦下任何 PR。代价是派发席每个条款② PR 多两次标签写(ACCEPT 时挂,PASS 时摘)。已逐个核对本仓会写 PR 标签的 workflow:今天没有任何自动机制会摘掉手挂的 PR 标签。回滚 = revert 本 PR;GitHub 上的标签对象不受影响。

席位意见:(留空,待席位填写)

你要做的:合并后请持有 gh 的人跑一次 bash scripts/pm/ensure-pm-labels.sh --reconcile,把现存标签对象的颜色与说明对齐(它现在是 GitHub 自动建的灰色、说明为空)。本 PR 的受管路径全在 .claude/**(Tier S),由席位在达档复核 PASS 后落地,不等您点合并。

Summary

The maintainer's instruction recorded on #19973 — 「恢复 needs:contract-review，把这句原话写进一张 skills 车道的卡」, answering a question that proposed 「只作等复核标记，不作闸门」 — brings needs:contract-review back as a visibility marker, never a gate. Every layer that ruling record 5770886272 (letter B) retired stays retired: no queue-guard refusal, no --pair, no double carrier, no independence pair. The enqueue gate still decides on the ## Contract review record alone, and nothing in this diff reads the label.

What changed — 3 files, +28 / -2

path	change
.claude/skills/pm-dispatch/references/contract-review.md	a new section, heading plus 5 rule lines (:30-:36); the :3 pointer now lists it. 28 → 36 lines, ceiling 60
.claude/skills/pm-dispatch/references/landing-operations.md	:13 rewritten in place to name the marker. 101 / 101 lines; that line goes 113 → 119 bytes
scripts/pm/ensure-pm-labels.sh	one main-repo row after needs:pack-smoke: colour bfdadc, a 95-character -d, and a comment block naming the label's readers

The rule as landed (contract-review.md :32-:36):

• it is only a marker, not a gate. The PR is the single carrier; a copy on the card is outside the rule and not required.
• hang: at ACCEPT, if either clause-② limb hits and no same-form PASS is on file for the current head, the dispatching seat hangs it on the PR in the same stroke.
• clear: when a same-form PASS is on file for the current head, the seat that posts it clears the marker in the same stroke. When the PR merges or closes, the dispatching seat clears it. A FAIL does not clear it.
• readers: the maintainer's filter is:pr is:open label:needs:contract-review, and each seat's patrol and handover.
• ⛔ no check, workflow, queue guard or patrol script reads it. Enqueue recognises only the same-form record, and the marker being present or absent changes no verdict.

landing-operations.md :13, before and after:

- 子代理起不来 ⇒ 复核缺席,PR 留 draft 队列外等档;唯一旁路是维护者亲审,逐次为准。
- 子代理起不来 ⇒ 复核缺席,PR 带 `needs:contract-review` 留 draft 队列外;旁路仅维护者逐次亲审

The line keeps three facts: the review is absent; the PR stays draft, outside the queue; and the maintainer's own review is the only bypass, per instance (唯一 … 逐次为准 → 仅 … 逐次). 「等档」 is carried by the marker itself, which already says the PR awaits its at-tier review. Keeping 「等档」 as well measured 125 bytes, over the 120-byte cap.

Durability — what removes a PR label on this repo today (read at base ba77509eee)

• pr-automation.yml job pr-size → scripts/pr-labels.mjs --size. It POSTs the computed size/* label, then sends a targeted DELETE only for stale size/* labels (planSizeWrites loops over the size family and nothing else). The job is skipped on labeled / unlabeled / edited.
• pr-automation.yml job auto-label → scripts/pr-labels.mjs --paths. It only POSTs: 「Path labels are ADD-ONLY … So this half issues POST and has no DELETE at all」 (:225-:227). The keys in .github/labeler.yml are documentation, protocol:*, ci/cd, dependencies, tests and tooling; none is a needs:* label.
• lint.yml runs node scripts/pr-labels.mjs --self-test, which pins that no write plan emits a PUT. It also runs node scripts/check-whole-set-label-write.mjs, which reds on a whole-set PUT /issues/{n}/labels in any spelling anywhere in the repo. That verb (third-party labelers, and a labels field written through MCP) is what removed this label in the gate era.
• stale.yml (actions/stale) removes only its own stale label. It closes a PR after 37 idle days, and a close is already a clear trigger in the rule.
• half-state-patrol.yml runs sweep-closed-cards.mjs --write, which strips PM_RESIDUE_LABELS (the pm:* state labels) from closed cards only.
• merge-queue-triage.yml adds labels to its anchor issues only. fleet-write.yml runs only the ops a seat names.
• objectui's labeler runs with sync-labels: true, but that is objectui's. This label is created in this repo only.

⇒ Today no mechanism on this repo removes a PR label that a seat hung by hand. The live carriers' event history agrees. Every labeled or unlabeled event for needs:contract-review on PR #19962, PR #19968, #19955 and #19953 is by objectstack-fleet[bot], that is, by a seat. The only removal pair (PR #19962 at 11:27:07Z, #19953 at 11:27:41Z) was the spec seat's own stroke after an at-tier FAIL (comment 5813182458, 「Carriers stripped on the PR and on this card」), and both were hung again at 12:14Z. Losing a marker is also the safe failure: a waiting PR drops out of the filter, but nothing is released, because the queue guard reads the record.

Live carriers at dispatch (read 2026-09-24T14:46Z) — ⛔ this PR changes no label on any of them

carrier	kind	what the rule says
#19962	PR, draft, head 22c9473c86	path limb hits (packages/spec/src/security/rls.zod.ts). The marker stays until a same-form PASS is on file for its current head; whoever posts that PASS clears it. Under the rule, the 11:27Z clear after the FAIL would not happen: a FAIL leaves the marker on.
#19968	PR, draft, head b05a88136d	path limb hits (packages/spec/src/ui/view.form.ts). Same as above.
#19955	card	a card copy is outside the rule and not required. What happens to it is for the spec seat that hung it.
#19953	card	same as #19955.

Aligning these four carriers is the dispatching seat's closeout step once the rule is on main, as the claim amendment on the card says. It is not part of this PR.

Four scripts that still name the label as retired — unchanged, on purpose

scripts/pm/check-half-states.mjs :11927 and :18308, scripts/pm/check-skill-line-ratchet.mjs :448 and :830, scripts/pm/check-widening-tells.mjs :673, and scripts/pm/clause2-line.mjs :11 and :306. Each one describes the gate role (a half-state row that patrolled it, a raise provenance, a dated census line, the ruling's summary, a measured incident). That role is still retired, so every sentence stays true. None of them reads the label, and this PR does not make any of them a reader. AGENTS.md, SKILL.md, state-machine.md and .claude/agents/os-dev.md are untouched too; the claim excluded them.

Acceptance notes

• The filer's reading on the card calls view.columns / view.sort / view.tabs repeater row properties show English column heads in every locale — the #17508 ruling-A landing for the three view repeaters #19955 and spec(security): RLS check defaults to using per policy in the contract, but the write check ignores a USING-only policy when a sibling declares check — state the composition, or rule OR semantics #19953 PRs. The REST objects carry no pull_request key, so they are cards; the claim amendment already reads them that way.
• 40 cards and PRs that are no longer open still carry the label from the gate era (for example PR feat(spec)!: a multi-package artifact carries its metadata once, in packages[] (#14512) #19666 and PR fix(spec): retire tenancy.organizationField from the authorable surface (#19054) #19618; 44 items in all, 4 of them open). The filter reads is:open and no script reads the label, so they are inert. Nothing in this PR touches them.
• Governed PRs on either landing tier, this one included, also wait on an at-tier ## Contract review record. They are outside the restored marker's population, which is only the two clause-② limbs, the population the retired label had. Whether to widen it is left to the seat as an open question in the report.
• SKILL.md's state-model table does not list the marker. It is a PR label, not a card state; its rule lives in contract-review.md; and SKILL.md is outside this PR's surface.

Pending after merge — the seat's, not this PR's

• Someone holding gh runs bash scripts/pm/ensure-pm-labels.sh --reconcile once. The live object is ededed with an empty description (read 2026-09-24T14:46Z), and create-if-missing never changes an object that already exists.

Tests — on 84f4580e

• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths; three-dot vs merge base ba77509ee) derived 32 commands. The dispatch named four more: node scripts/check-skills-token-ratchet.mjs, node scripts/pm/check-governed-queue-guard.mjs --self-test, pnpm check:pm-expected-skips and pnpm check:pm-governed-prose. All 36 exit 0, each exit code captured before any pipe. --ran reconciliation: 「32 derived, 32 run, 0 NOT-MEASURED, 0 UNRUN」.
  • pnpm check:pm-label-desc-cap: 「39 label descriptions … all ≤100 characters (longest: 100, tooling)」 (38 on base).
  • pnpm check:pm-skill-ratchet: 「contract-review.md is 36 lines (ceiling 60; headroom 24)」 and 「landing-operations.md is 101 lines (ceiling 101; headroom 0)」. All lines are ≤120 bytes; :3 is at exactly 120.
  • pnpm check:pm-skill-id-lint: 「34 file(s) clean」. pnpm check:skill-frame-sync, pnpm check:doc-authoring, pnpm check:pm-governed-prose and pnpm check:nul-bytes are green.
  • pnpm --filter @objectstack/lint run check:doc-formula-expressions first exited 3 (PREREQUISITE NOT MET: @objectstack/formula / @objectstack/lint not built). That run measured nothing. After pnpm exec turbo run build --filter=@objectstack/formula --filter=@objectstack/lint under scripts/pm/os-verify-lock.sh (VERDICT command-exit 0), the rerun exited 0.
• bash -n scripts/pm/ensure-pm-labels.sh exits 0. A fake gh on PATH ran ensure-pm-labels.sh --reconcile, exit 0: the new row issued label create needs:contract-review -R objectstack-ai/objectstack -c bfdadc -d … and the matching label edit … --color bfdadc --description … with the same string.
• node scripts/pm/check-governed-merges.mjs --test on the three paths returns GOVERNED, Tier S (.claude/** ×2); scripts/pm/ensure-pm-labels.sh is not on the register.
• A self-scan for control bytes on the three files finds none.
• Not run locally: no package is touched, so there is no build closure and no package test or typecheck. pnpm lint and the CI-only families (the shard attestation, the test-completeness reader and the type-check lanes) are left to CI.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 84f4580e8a674f868d70a95c045f11ac4f4d34d6

Rendered in-seat by the domain:skills#1 seat at 2026-09-24T15:18Z on the diff of head 84f4580e (3 files, +28/−2; check-governed-merges --pr 19993: GOVERNED, Tier S, .claude/** ×2, scripts/pm/ensure-pm-labels.sh not on the register), the card #19973 with the maintainer's verbatim instruction, ruling record 5770886272 on #19061, and the dev report 5816859484 (2026-09-24T15:14Z). Adversarial brief: does any line of this diff make the label a gate again, restore a layer ruling B retired, or say something a seat cannot act on?

① Derived judgments

1. Scope against the maintainer's words 「恢复 needs:contract-review，把这句原话写进一张 skills 车道的卡」, answering 「只作等复核标记，不作闸门」. The diff restores the label as a marker and nothing else: the contract-review.md section :30–:36 says 「只作等复核标记,⛔ 不是闸门」 and 「⛔ 无 check、workflow、队列守卫或巡查脚本读它;入队只认同形记录,标记有无不改判」; the roster comment repeats it in English. No script, workflow or gate changes; the diff's only non-prose line is a gh label create row. Correct.
2. Ruling B layers (gate role and double-carrier discipline, --pair, independence pair): grep of the diff for --pair, 双载体, 独立性 finds them only in the roster comment's sentence naming them as staying retired. 「单载体 = PR,卡上副本在规则外、不是要求」 is the opposite of the retired double-carrier discipline. Correct, none returns.
3. Hang rule :33 「ACCEPT 时条款②任一肢命中而现 head 无同形 PASS 在案 ⇒ 派发席同笔挂于 PR」: keys on the two limbs landing-operations.md :10–:11 already define (path limb, declaration limb), so the limbs are not restated in a second file — the dev's deviation 4, accepted. One hang point (ACCEPT), one actor (the dispatching seat), one carrier (the PR). Actionable by a seat.
4. Clear rule :34 「现 head 同形 PASS 在案 ⇒ 写记录的席同笔摘;PR 合并或关闭 ⇒ 派发席摘;FAIL 不摘」: the seat that posts (or adopts) the PASS clears, the dispatching seat clears on merge/close, a FAIL leaves it on. 「FAIL 不摘」 is the dev's deviation 3 — it makes the implied answer explicit and is grounded in a measured event (the spec seat cleared on FAIL at 11:27Z and re-hung at 12:14Z). Consistent with the marker's meaning (still awaiting a PASS). Correct.
5. Readers :35: the maintainer's filter is:pr is:open label:needs:contract-review and each seat's patrol and handover — the named readers the card asked for; ensure-pm-labels.sh :37–:38 (every label has a named query) is satisfied by the roster comment. Correct.
6. landing-operations.md :13 in place, 101 / 101 lines, 119 bytes: keeps 复核缺席 · 留 draft 队列外 · 旁路仅维护者逐次亲审, names the marker; drops 「等档」 (carried by the marker) and the trailing 。 to stay under the 120-byte cap (125 with both). The missing full stop is the one stylistic cost in the diff; the ratchet's own rule (a wrap it cannot produce is never demanded) makes it acceptable, and no gate pins it. Accepted; noted.
7. Roster row: -c bfdadc (outside the state and red families), -d 97 characters ≤ 100 (check:pm-label-desc-cap reports 39 descriptions all ≤ 100), 2>/dev/null || true in the file's shape, placed after needs:pack-smoke, main repo only. The comment block (16 lines, deviation 1) names the rule's home, hang/clear, readers, no-reader-in-any-check, the verbatim words, the retired layers and the colour rationale — longer than suggested, all of it load-bearing for the file's reader. Correct.
8. contract-review.md :3 pointer rewritten to 「…复核归属、资格与等复核标记」, exactly 120 bytes. 28 → 36 lines under a ceiling of 60. Correct.
9. Population (the dev's open question): A — the two clause-② limbs, the population the retired label had. 「恢复」 restores that label; governed Tier S PRs get their in-seat record in the same seat's ACCEPT stroke and show no waiting state to mark; B would key the rule on the governed register with no measured stall. A, as landed.
10. Durability: the PR body's per-workflow reading (pr-labels.mjs --size DELETEs only stale size/*; --paths POST-only; stale.yml removes only stale; sweep-closed-cards.mjs strips pm:* residue from closed cards only) agrees with this seat's own read of pr-automation.yml :225 at dispatch; the live carriers' events are all seat strokes. Accepted as reported; a lost marker releases nothing, since the queue reads the record.
11. Untouched on purpose: SKILL.md (fable-mandated path, PR docs(pm-dispatch): name objectstack-fleet[bot] as the write identity #19890 in flight), AGENTS.md (Tier H), state-machine.md, os-dev.md, and the four scripts whose comments describe the retired gate role — every one of those sentences stays true. Correct.

② Semver level

No published package touched (.claude/** and scripts/pm/** ship in no files[]); skip-changeset is the correct form on this repo and is on the PR; no content/docs/releases/ change. None owed; consistent.

③ Boundary flags

• Dev deviations 1–6: 1 (comment length) accepted, see ①7; 2 (:13 wording) accepted, see ①6; 3 (FAIL 不摘) accepted, see ①4; 4 (limbs by reference) accepted, see ①3; 5 (three extra gate families run) noted, all exit 0; 6 no refused write, no other carrier touched — as dispatched.
• Open question A/B → A (①9).
• Out-of-scope findings: the four live carriers' alignment is this seat's closeout step (claim amendment 5816285505); the 40 non-open gate-era carriers are inert under an is:open filter; the filer's "PR" wording for view.columns / view.sort / view.tabs repeater row properties show English column heads in every locale — the #17508 ruling-A landing for the three view repeaters #19955 / spec(security): RLS check defaults to using per policy in the contract, but the write check ignores a USING-only policy when a sibling declares check — state the composition, or rule OR semantics #19953 already corrected on the card.
• Check-runs on 84f4580e at this record: the Lint & Repo Gates job and the type-check lanes were still in progress at the last read; the ready flip waits for every check on this head to complete green (the rostered skips read with check-expected-skips.mjs), ⛔ not on this record alone.

Implemented-by: claude/issue-19973-contract-review-marker
Reviewed-by: session_01A22sUB3mUWs6M36VgfijBq

VERDICT: PASS

---

Generated by Claude Code