[objectstack-fleet]

Fixes #27345
Fixes #27363
Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:把「PR 推给人审」的时点改为 席位 ACCEPT + 现 head 契约复核 PASS 俱在案之后:请审成为席位的交棒动作(中继 pr_request_reviewers;作者是审批人时 assign),dev 开 draft PR 不再带 assignees,中继 pr_create 不再在开 PR 那一刻请审;落地时仍欠复核的 PR 在落地 head 上复审,发现逐条立新卡;巡查 H43 只在交棒已到期而无人被请时才报。
• 为什么改:您的 GitHub 指派清单被没人复核过的 draft 填满,请审在席位审完之前就发出(「这个是技能的bug,应该是开发完了你审核通过才会推送给我审核」);三张 PR 在 PASS 之前或缺席时就被推到您面前并挂了 auto-merge(「没有完成复审就推送给我审核了」)。
• 风险与回滚:只改技能文本、中继表的一个标记位(pr_create 的 governedReview)与一条只报不拦的巡查行;不新增门禁、不碰 workflow。回滚 = revert 本 PR 的三个 commit;中继 pr_ready 仍保留受管请审兜底(Tier H 的 ready 本就在批准之后),Tier H 的批准与合并仍是您的点击。
• 先看:① scripts/pm/fleet-write/ops.mjs 的 pr_create 行(governedReview: true 移除)与头部「The governed-review follow-up」节;② .claude/skills/pm-dispatch/SKILL.md L198–201(规则唯一一份);③ scripts/pm/check-half-states.mjs 的 h43HandoffReading 与 h43GovernedReviewRequestGap(新的 handoff 门;unread 不判、before 不报、due 才报)。
• 两分钟验证:node scripts/pm/fleet-write/execute.mjs --self-test && node scripts/pm/check-half-states.mjs --self-test,预期尾行 209 cases pass across 20 batteries 与 5066 cases pass … H43 hand-off timing 89/80;本 PR 自身就是首个样本:draft 开出时 assignees 与 requested_reviewers 皆空(见 Verification 的回读)。
• 需要你做的:无,席位落地(路径面 .claude/** + scripts/pm/**,Tier S:席位跑契约复审,PASS 后 ready → 入队)。

What changes

The two cards are one rule at two points, so the rule is written once — SKILL.md 〈路径分叉〉 ③ — and the other files point at it: a PR reaches a human only when development is done AND the seat's ACCEPT (## 席位核对) AND, where clause ② applies (every governed path is the review's rules face, so on every governed PR), a ## Contract review PASS on the CURRENT head are on the PR; then, and only for Tier H, the seat requests review from GOVERNED_APPROVERS (os-zhuang, hotlong). The seat's own account is never assigned to or requested on a PR; a Tier S PR goes to no human; a head that moves after the PASS goes back to waiting.

Card 27345 — the same-head PASS gates the ask, and a PR that landed owing a review is re-reviewed

• .claude/skills/pm-dispatch/SKILL.md 〈路径分叉〉 L198–201, rewritten in place (four lines, same count): ③ the request IS the seat's hand-off after ACCEPT + same-head PASS, through pr_request_reviewers; the author-is-approver fallback stays (assign the author, request the others; never the seat's own account; Tier S hands off to nobody); pr_create/pr_ready request and assign nobody, a head that moves after the PASS goes back to waiting, an off-relay PR has the seat read its reviewers and assignees itself; the 速读 「需要你做的」 line that asks for approval names the PASS comment id and its Head-sha, and with no PASS says "contract review owed" and does not ask.
• references/contract-review.md L47 (was L49): the two pre-landing checks now gate the request and the ask as well — ① a same-head, same-shape, at-tier PASS on the current head. New L52–53 (item 2): a PR that lands while still owing a review is re-reviewed on its landed head by the lane seat or by triage under the gap rule (a)(b)(c); a FAIL is not repaired on the closed PR — each must-fix is filed as a NEW card citing the record, graded on its own; a revert only for a main red (p0, main-red 约定①) or a security boundary. Paid by folding the two wrapped pairs L34–35 (Local-runs:) and L43–44 (--brief-template) into one line each — every clause kept; the script path is spelled in full on L33 already.
• references/landing-operations.md L12: PASS ⇒ Tier S ready + auto-merge, Tier H hands off per SKILL.md ③; L13 points at the post-landing rule. Paid by deleting old L54, whose content (a contract-review-PASS PR arrives at the landing window already ready and armed) is L12's own statement.
• references/lanes/director.md L57: five checks in order before a governed PR waits for a human — seat record, 速读, same-head PASS, pr_request_reviewers, green head.

Card 27363 — no seat assignee at the draft open; the approver request is the seat's hand-off

• .claude/agents/os-dev.md L37/L60: a dev's pr_create carries no assignees (labels only — skip-changeset still rides the create); a human sees the PR at the seat's hand-off.
• references/execution-duties.md L63: 「PR assignee = 卡的」 and the takeover swap are gone; the in-flight-PR reader is head:claude/ open PRs plus the card their body names (Fixes/Part of) — no PR assignee anywhere in it. The card's assignee and the Claim: Branch: still own the work.
• references/dispatch-runbook.md 〈卡线程〉 L140 (item 4): a project thread does not perform the harness's post-create assign / request-review step; the request is the seat's hand-off — citing 「审核通过才会推送给我审核」. Paid by deleting old L136, whose three clauses (p1 first; the project-wide cap is the maintainer's; queue when full) are coordinator.md 三 L23–L25 verbatim, which the deleted line itself pointed at.
• scripts/pm/fleet-write/ops.mjs: governedReview: true leaves the pr_create row — the draft open summons nobody; GOVERNED_REVIEW_OPS derives to ['pr_ready']. The assignees leg stays optional on the row for the author-is-approver fallback and other callers; a dev simply stops sending it. Hypothesis 1 measured: the relay already has pr_request_reviewers (ops.mjs L1050: pull required, reviewers/team_reviewers with atLeastOne), so the hand-off is ONE seat stroke after ACCEPT + PASS; pr_ready keeps its follow-up as a backstop — a Tier H pull is readied only after an approver approved it, so there it costs zero writes when the hand-off was made and names the one approver still uncovered when it was not. Header sections rewritten accordingly (the maintainer's words quoted once).
• scripts/pm/fleet-write/execute.mjs / validate.mjs: headers and self-tests pin the derived op list as pr_ready alone and that a pr_create on a Tier H diff reads no file list, re-reads no pull or reviews, sends no request and no assignee (an approver-authored pull included), and that a create answering no number owes no follow-up (the stroke no longer fails on its account). The governed battery's create-side runs became pr_ready runs; three create NEGATIVE pins replace them (pin 29 → 30).
• scripts/pm/check-half-states.mjs H43 (item 5): before judging 「asked neither approver」 the row reads the PR's own issue-comment thread — H48's fetch class, cached so H48/H69 pay nothing — for the seat's ACCEPT (SEAT_RECORD_MARKER + seatRecordAccepts, seat-record.mjs) and a ## Contract review naming the current head whose verdict word is PASS (latestContractReviewOnHead, widened with verdict; contractReviewVerdictOf is the one reader of the word, three measured dialects). Three states: unread ⇒ UNJUDGED (quiet, disclosed), before ⇒ not a half state (quiet), due ⇒ the existing coverage judgment. Only DUE buys the submitted-review page. Summary clause and two count keys (governedHandoffRead, governedHandoffDue) disclose the reading; drafts still neither fire nor silence it. Bound stated in the header: the PR thread is the one thread read — a PASS on the card alone reads as BEFORE (under-report only); the ACCEPT's freshness against the head stays H69's question. H69's header and sentence stopped saying 「the relay summons at pr_create」 (made false by this PR; its self-test pin moved with it).
• Hypothesis 2 measured (patrols reading PR assignees as ownership): none. check-handover.mjs (a) reads CARD assignees and puts pull requests out of its population (its self-test pins it); check-half-states.mjs reads a PR's assignees only as H43's approver-coverage fallback, kept on purpose (the fallback assigns an approver, never a seat). project-forms.md L31–32: the ledger is labels + the card's assignee + Claim: + head:claude/ PRs — already assignee-free on the PR side, no edit.
• Hypothesis 3: confirmed with one adjustment — locateReviewOfRecord itself is not called: it requires BOTH threads (PR and card) or answers unreadable, and reads no verdict word; H43 reuses its building blocks (latestContractReviewOnHead, the one head-sha recogniser record-recognisers.mjs imports) and adds the verdict word beside them.
• Hypothesis 4: the Regen-provenance pair (contract-review L50–51) does not compress under 120 B; the Local-runs: and --brief-template pairs do, so they paid; landing-operations L7–8 kept, old L54 paid instead.

Line budget — every .claude file at its ceiling (headroom 0, prose ≤120 B)

.claude/skills/pm-dispatch/SKILL.md — 319 → 319 lines

• L198 (107 B) - ③ 中继 ˋpr_createˋ/ˋpr_readyˋ 命中 Tier H 即向 ˋGOVERNED_APPROVERSˋ 中未请/派/审者请审。
• L199 (117 B) - 作者是审批人 ⇒ 指派它、请其余(请它必 422),否则请全员;速读只点非作者审批人去批。
• L200 (119 B) - 脱中继开的 PR 无 run 行:交速读前席位恒自读 ˋrequested_reviewersˋ/ˋassigneesˋ,⛔ 不只看 run 行。
• L201 (115 B) - 缺口经中继 ˋpr_request_reviewersˋ/ˋassignˋ 补,⛔ 不碰 draft 位;ACCEPT 与轮报点名脱中继作者。

• L198 (117 B) - ③ 请审 = 席位交棒:ACCEPT 与现 head 同形 PASS 俱在案后,中继 ˋpr_request_reviewersˋ 请审批人。
• L199 (120 B) - 作者是审批人 ⇒ ˋassignˋ 它、请其余(请它必 422);⛔ 永不派/请席位自身账号;Tier S 不交人。
• L200 (119 B) - ˋpr_createˋ/ˋpr_readyˋ 不请审不指派;PASS 后 head 移 ⇒ 回等复核;脱中继 PR 自读请审人与指派。
• L201 (118 B) - 速读「需要你做的」求批点名 PASS 评论 id+ˋHead-shaˋ;无 PASS ⇒ 写 contract review owed 不求批。

.claude/agents/os-dev.md — 402 → 402 lines

• L37 (118 B) - 恒不写卡的 assignee(空也开工,报 ˋsummaryˋ);PR assignee = 卡的:ˋpr_createˋ 带 ˋassignees: [LOGIN]ˋ。

• L37 (114 B) - 恒不写卡的 assignee(空也开工,报 ˋsummaryˋ);PR ⛔ 不带 ˋassigneesˋ,人经席位交棒才见 PR。

• L60 (104 B) - 写预算三笔:ˋgit pushˋ、ˋpr_createˋ(draft,含 assignee 与 labels)、ˋos-dev-reportˋ 评论。

• L60 (111 B) - 写预算三笔:ˋgit pushˋ、ˋpr_createˋ(draft,含 labels、⛔ 无 assignees)、ˋos-dev-reportˋ 评论。

.claude/skills/pm-dispatch/references/execution-duties.md — 188 → 188 lines

• L63 (118 B) - 卡 assignee 归 PM,dev 恒不写;PR assignee = 卡的,接管 ② 同笔换;读者 ˋis:pr is:open assignee:LOGINˋ。

• L63 (119 B) - 卡 assignee 归 PM,dev 恒不写;PR ⛔ 不派席位账号;在飞 PR 读 ˋhead:claude/ˋ 开 PR 正文点名的卡。

.claude/skills/pm-dispatch/references/contract-review.md — 60 → 60 lines

• L34 (88 B) - 同形另带 ˋLocal-runs:ˋ 行:ˋnoneˋ,或 ˋprobe — REASONˋ 具名唯一本地探针;
• L35 (42 B) 有行必校,缺行旧记录不改判。

• L34 (119 B) - 同形带 ˋLocal-runs:ˋ 行:ˋnoneˋ 或 ˋprobe — REASONˋ 具名唯一探针;有行必校,缺行旧记录不改判。

• L43 (77 B) - 简报从 ˋnode scripts/pm/record-recognisers.mjs --brief-templateˋ 起稿:
• L44 (54 B) 只读条款与输入集内建,⛔ 不删 ⛔ 行。

• L42 (113 B) - 简报从 ˋrecord-recognisers.mjs --brief-templateˋ 起稿:只读条款与输入集内建,⛔ 不删 ⛔ 行。

• L49 (115 B) - 落地前检两条,过则 Tier S 入队、Tier H 等人批:① 达档条款②复核 PASS 在案(同形记录)。

• L47 (117 B) - 请审/求批与落地前检两条,过则 Tier S 入队、Tier H 等人批:① 现 head 同形达档 PASS 在案。
• L52 (115 B) - 落地时仍欠复核的 PR 在落地 head 复审,车道席或分诊按 (a)(b)(c) 接;FAIL ⛔ 不修已关 PR。
• L53 (120 B) - 每条 must-fix 引该记录立新卡、按发现定级;回退仅限主干红(p0,main-red 约定①)或安全边界。

.claude/skills/pm-dispatch/references/landing-operations.md — 101 → 101 lines

• L12 (74 B) - PASS ⇒ ready、auto-merge;FAIL ⇒ 补丁轮;⛔ 免复核不放行。

• L12 (118 B) - PASS ⇒ Tier S ready、auto-merge;Tier H 经 SKILL.md ③ 交棒请审;FAIL ⇒ 补丁轮;⛔ 免复核不放行。
• L13 (114 B) - 落地后才见欠复核 ⇒ 按 ˋcontract-review.mdˋ 复审落地 head、发现立新卡,⛔ 不修已关 PR。

• L54 (104 B) - 契约复核 PASS 落地的 PR 到窗口时已 ready 且 auto-merge 在挂,见 ˋcontract-review.mdˋ。

.claude/skills/pm-dispatch/references/lanes/director.md — 86 → 86 lines

• L57 (117 B) - 受管 PR 待人批前核四件:席位记录、维护者速读、中继 ˋpr_request_reviewersˋ 请审、绿 head。

• L57 (117 B) - 受管 PR 待人批前核五件:席位记录、速读、现 head PASS、ˋpr_request_reviewersˋ 请审、绿 head。

.claude/skills/pm-dispatch/references/dispatch-runbook.md — 245 → 245 lines

• L136 (116 B) - coordinator 按优先级开线程,p1 先;全项目上限由维护者按项目定(ˋcoordinator.mdˋ),满即排队。

• L140 (119 B) - 线程 ⛔ 不做 harness 开 PR 后指派/请审:「审核通过才会推送给我审核」,请审是席位交棒。

Tests

Self-tests, before (origin/main 28872e6) → after (50118ff), exits captured before any pipe

suite	before	after
fleet-write/validate.mjs --self-test	216 cases / 13 batteries, exit 0	216 / 13, exit 0 (pin content changed, count unchanged)
fleet-write/execute.mjs --self-test	208 / 20, exit 0	209 / 20, exit 0 (governed battery 29 → 30)
fleet-write/dispatch.mjs --self-test	265 / 24, exit 0	265 / 24, exit 0 (unchanged file; imports the new table)
check-half-states.mjs --self-test	5034 cases, exit 0	5066 cases, exit 0; new battery H43 hand-off timing 89/80 (57 legacy coverage cases driven with the hand-off DUE + 32 timing cases)
record-recognisers.mjs --self-test	297, exit 0	297, exit 0
check-owed-reviews.mjs --self-test	49 / 8, exit 0	49 / 8, exit 0
check-governed-queue-guard.mjs --self-test	401, exit 0	401, exit 0
check-handover.mjs / fleet-roster.mjs / seat-record.mjs / check-governed-merges.mjs --self-test	46 / 78 / ok / 537	unchanged, exit 0

Ablations — one per changed script, committed state first, restore hash-proven by scripts/ablation-replace.mjs (blob == HEAD, git diff HEAD empty), whole tree clean after

Expected direction for every leg: turn red (常态). Observed:

1. ops.mjs — governedReview: true planted back on pr_create (anchor hit 1 → 0, blob 2abc5979 → f52678f1, restored to 2abc5979). validate.mjs --self-test exit 1 with the named pin red: 「the governed-review follow-up runs after exactly pr_ready … 1 of 216 case(s) failed」. execute.mjs --self-test exit 1 by a TypeError at L1303 (the requests battery's pr_create + issue_create stroke stopped after the create — the re-enabled follow-up asked for GET …/pulls/9/files, which the fixtures no longer prime — so the second write never happened): red by crash at the first create-side case the mutation reaches, before the ⭐ negative pin itself was evaluated.
   • A first attempt of this leg was a NO-OP and is recorded as such: the replacement text re-contained the anchor, the tool refused (anchor count 1 → 1, not the declared drop), the child never ran, nothing was written. Re-anchored on the row's unique comment line and re-run as above.
2. execute.mjs — the follow-up forced to run after pr_create again (action.op === 'pr_create' ||). execute.mjs --self-test exit 1, same TypeError at L1303 for the same reason (a follow-up after the create), red by crash. Restored to ddd1bfaa == HEAD.
3. check-half-states.mjs — the hand-off gate if (handoff?.state !== 'due') return null; deleted. --self-test exit 1 by a TypeError at h43GovernedReviewRequestGap (handoff.record on an undefined hand-off, reached from the 「an UNREAD thread is UNJUDGED」 pin): red by crash at exactly the pin the gate protects. Restored to f5c5c23f == HEAD.
4. check-half-states.mjs — contractReviewVerdictOf answering PASS for every explicit VERDICT: line. --self-test exit 1 with 6 named ✗ cases, among them 「a FAIL on the current head is BEFORE (got "due,PASS", want "before,FAIL")」, 「the newest PASS on the head decides, and a FAIL after it withdraws the hand-off」, 「**VERDICT: PASS** reads PASS, and FAIL reads FAIL」, 「the explicit VERDICT line wins over prose」. Restored to f5c5c23f == HEAD.
5. check-half-states.mjs (3b, the non-crash reading of leg 3) — the gate narrowed to unread/undefined only, so BEFORE is no longer quiet. --self-test exit 1 with ONE named ✗ case out of 5066: 「H43 row: ⛔ BEFORE the hand-off, nobody asked is NOT a half state — quiet」 (it got the finding sentence, wanted null); every DUE case stayed green, so the mutation moved exactly the predicate the card asks for. Restored to f5c5c23f == HEAD; git status --porcelain empty after every leg.

Acceptance notes

• AGENTS.md (Tier H, outside this dispatch's file list and not edited here) still says in 〈Multi-agent working discipline〉 「the PR's assignee mirrors the card's, set by the executor at pr_create」 — contradicted by os-dev.md L37 after this PR. One sentence to retire; it needs the maintainer's hand on a Tier H file. carrier: the seat (domain:skills#2) files it or hands it to triage; noted here, not filed by the dev.
• Card 26617 is untouched and stays pm:on-hold: its shape 1 (the approver request moves off pr_create) is implemented here; triage decides its disposition after landing.
• PRs already in flight with a person assigned are not unassigned here (card 27363 item 6).
• The claude.ai project-harness step itself is outside this repo; only the thread line (dispatch-runbook.md L140) tells a thread not to perform it.
• In-file adjacency edited: H69's header and sentence in check-half-states.mjs claimed the relay summons at pr_create; this PR makes that false, so the two spots (and the one self-test pin on the words) now describe the hand-off. No row semantics changed for H69.
• latestContractReviewOnHead now returns verdict beside id and sha (additive; record-recognisers.mjs does not import it).
• This PR is the first to follow the rule it writes: its pr_create carried no assignees while os-dev.md L37 on main still said to send one — the seat ruled the omission for this PR on both claims.
• Not run locally: test:repo (CI's Test Core), the lint sweep, dogfood (no ! in the title, no (narrowing) arm); every CI family is read from the PR's check-runs by the seat.
• No .github/workflows/** line was needed; no new gate, script or workflow.

Verification

Local subset = the derived union, run on the final head 50118ffc (node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, no paths, change set from the merge base 28872e68; 11 paths, +461/−199 lines, under the 3000-line threshold). 67 families, every exit captured before any pipe (cmd > log 2>&1; status=$?), reconciled with --ran: 67 derived, 67 run, 0 NOT-MEASURED, 0 UNRUN (✓ dispatch-gates --ran: 67 derived famil(ies) accounted for). One family first answered exit 3 (check:doc-formula-expressions, PREREQUISITE NOT MET — its dist/ inputs were not built in this worktree); after turbo run build --filter=@objectstack/formula --filter=@objectstack/lint under the shared verify lock (VERDICT command-exit 0 · held the lock 2s · waited 0s, a full cache replay) it was re-run and answered exit 0. Non-zero exits remaining in the record: 0.

The 67 commands and their exits (the `--ran` record)

node scripts/check-closing-keyword-parity.mjs :: exit 0
node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0
node scripts/check-comment-mask-corpus.mjs :: exit 0
node scripts/check-declaration-mirrors.mjs :: exit 0
node scripts/check-declaration-mirrors.mjs --self-test :: exit 0
node scripts/check-issue-citations.mjs :: exit 0
node scripts/check-platform-checklist-watchdog.mjs :: exit 0
node scripts/check-platform-checklist-watchdog.mjs --self-test :: exit 0
node scripts/check-release-section-coverage.mjs :: exit 0
node scripts/check-release-section-coverage.mjs --strict :: exit 0
node scripts/check-self-test-wired.mjs :: exit 0
node scripts/check-self-test-wired.mjs --self-test :: exit 0
node scripts/check-self-test-workflow-commands.mjs :: exit 0
node scripts/check-self-test-workflow-commands.mjs --self-test :: exit 0
node scripts/check-whole-set-label-write.mjs :: exit 0
node scripts/check-whole-set-label-write.mjs --self-test :: exit 0
node scripts/ci/plan-test-core-shards.mjs --self-test :: exit 0
node scripts/ci/scheduled-full-run.mjs --self-test :: exit 0
node scripts/pm/bare-root-worklist.mjs --self-test :: exit 0
node scripts/pm/board-snapshot.mjs --self-test :: exit 0
node scripts/pm/check-governed-queue-guard.mjs --self-test :: exit 0
node scripts/pm/check-harness-current.mjs --self-test :: exit 0
node scripts/pm/sweep-closed-cards.mjs --self-test :: exit 0
node scripts/render-release-coverage-anchor.mjs --self-test :: exit 0
pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 0
pnpm check:agent-model-declared :: exit 0
pnpm check:agent-test-spelling :: exit 0
pnpm check:bash32-floor :: exit 0
pnpm check:ci-filter-parity :: exit 0
pnpm check:cli-command-ids :: exit 0
pnpm check:closing-target-claim :: exit 0
pnpm check:commit-card-trailers :: exit 0
pnpm check:cross-package-test-inputs :: exit 0
pnpm check:doc-authoring :: exit 0
pnpm check:driver-memory-census :: exit 0
pnpm check:entry-guard :: exit 0
pnpm check:gitlink-declared :: exit 0
pnpm check:issue-citations :: exit 0
pnpm check:nul-bytes :: exit 0
pnpm check:parse-guard :: exit 0
pnpm check:partof-closing-keyword :: exit 0
pnpm check:platform-checklist :: exit 0
pnpm check:pm-close-cards :: exit 0
pnpm check:pm-dispatch-gates :: exit 0
pnpm check:pm-expected-skips :: exit 0
pnpm check:pm-fleet-write-dispatch :: exit 0
pnpm check:pm-fleet-write-execute :: exit 0
pnpm check:pm-fleet-write-validate :: exit 0
pnpm check:pm-governed-merges :: exit 0
pnpm check:pm-governed-prose :: exit 0
pnpm check:pm-half-states :: exit 0
pnpm check:pm-issue-create :: exit 0
pnpm check:pm-issue-transfer :: exit 0
pnpm check:pm-label-write :: exit 0
pnpm check:pm-post-stamped :: exit 0
pnpm check:pm-record-recognisers :: exit 0
pnpm check:pm-skill-id-lint :: exit 0
pnpm check:pm-skill-ratchet :: exit 0
pnpm check:pm-write-pace :: exit 0
pnpm check:pnpm-filter-targets :: exit 0
pnpm check:pnpm-flag-spellings :: exit 0
pnpm check:ratchet-remedy-authority :: exit 0
pnpm check:refd-timer-probe :: exit 0
pnpm check:scripts-symbol-anchors :: exit 0
pnpm check:single-claim-paths :: exit 0
pnpm check:skill-frame-sync :: exit 0
pnpm check:watch-hint-literal :: exit 0

Local-only readings (CI runs their --self-test only): check:pm-skill-ratchet — every ceilinged file at its landed count (SKILL.md 319/319 with the widest-row pin 341 B untouched; os-dev.md 402/402; execution-duties 188/188; contract-review 60/60; landing-operations 101/101; director 86/86; dispatch-runbook 245/245), every edited line ≤120 B; check:pm-skill-id-lint 105 files clean; check:nul-bytes clean over 22172 files; check:dev-prereqs / check:skill-frame-freshness not applicable (no packages/spec or four-axis frame edit; the frame's md5 at L242–262 is unchanged, abff5f852c8fd09b79ec0623439aa4f0).

CI families (Lint & Repo Gates, TypeScript Type Check, Test Core incl. test:repo, Governed Surface Queue Guard, the UI four) are read from this PR's check-runs by the seat; nothing of them was re-run locally beyond the derived subset above.

This PR's own open through the relay carried no assignees key; the stroke's --json read-back (assignees and requested reviewers as the platform lists them) is quoted in the os-dev report comment on card 27345.

---

Generated by Claude Code

[objectstack-fleet]

domain:skills#2 · os-justin · session_01QSeKYmhU5KEj1nukYhp1Tg

Contract-review-claim: session_01QSeKYmhU5KEj1nukYhp1Tg · head 50118ff · 2026-10-29T04:47Z

[objectstack-fleet]

domain:skills#2 · os-justin · session_01QSeKYmhU5KEj1nukYhp1Tg

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 50118ffcff6fff491191057f02197254f04c5207
Local-runs: probe — the seat ran, in a detached read-only worktree of the head (no edit, no network write): check-skill-line-ratchet.mjs --self-test 164 + live ✓ (3 declared moves, ceilings down 494), check-skill-id-lint.mjs ✓ 105, check-governed-prose.mjs ✓ 31 + live, check-skill-frame-sync.mjs ✓ 14 + live (frame unchanged), fleet-write/validate.mjs 216/13 ✓, fleet-write/execute.mjs 209/20 ✓, fleet-write/dispatch.mjs 265/24 ✓, check-half-states.mjs 5066 ✓ (battery H43 hand-off timing present), record-recognisers.mjs 297 ✓, check-owed-reviews.mjs 49/8 ✓, check-governed-queue-guard.mjs 401 ✓, check-handover.mjs 46 ✓; check-governed-merges.mjs --self-test answered exit 3 PREREQUISITE NOT MET in that worktree (no tsx installed there — the probe's environment, not the head; the dev's 537 under a full install is taken); SKILL.md L198–201 measured 117 / 120 / 119 / 118 B
Scope: .claude/agents/os-dev.md (L37, L60) + .claude/skills/pm-dispatch/SKILL.md (L198–201) + references/contract-review.md (L34, L42 folds; L47; new L52–53) + references/dispatch-runbook.md (old L136 → new L140) + references/execution-duties.md (L63) + references/landing-operations.md (L12–13; old L54 deleted) + references/lanes/director.md (L57) + scripts/pm/fleet-write/ops.mjs (pr_create row loses governedReview; pr_ready L1094 keeps it; GOVERNED_REVIEW_OPS derives to ['pr_ready']) + execute.mjs (governed battery 29 → 30, create-side runs → pr_ready runs, three create NEGATIVE pins) + validate.mjs (two pins) + scripts/pm/check-half-states.mjs (h43HandoffReading, h43NeedsThreadRead, h43NeedsReviewProbe/h43GovernedReviewRequestGap gated on handoff.state === 'due', contractReviewVerdictOf, latestContractReviewOnHead + verdict, count keys governedHandoffRead/governedHandoffDue, H69 wording, battery 80) + cited homes read on the head: contract-review.md L23–25 (the (a)(b)(c) that L52 cites — resolves), coordinator.md 三 L22–L24 (the clauses old runbook L136 duplicated — resolves), prCommentRowsFor L22544 (cached Map, H48's walk, null on an unread thread)

Claim line 6488220465 on this head (2026-10-29T04:54Z); no earlier record on it. Read at 2026-10-29T04:54Z by the domain:skills#2 seat on the fetched head (three commits on merge-base 28872e68; origin/main has moved to 7e200b4a, the PR is mergeable: true): 11 files, +461/−199 (660 ≤ 3000; paths .claude/** ×7 ⇒ Tier S, scripts/pm/** ×4 off the register). The claims 6487416968 / 6487404806 served CONTRACT_REVIEW_TIER; this review is served at CONTRACT_REVIEW_TIER (governed rules text).

① Derived judgments

• Card 27345 item 1 (a human only after ACCEPT + same-head PASS): SKILL.md L198 「③ 请审 = 席位交棒:ACCEPT 与现 head 同形 PASS 俱在案后,中继 pr_request_reviewers 请审批人。」, L201 (速读 「需要你做的」 names the PASS id + Head-sha, or says contract review owed and does not ask), contract-review L47 (① 现 head 同形达档 PASS 在案 gates the ask as well as the landing), director L57 (five checks, PASS before the request), landing-operations L12. One rule, written once, pointed at from the four homes. Holds.
• Item 2 (a PR landed owing a review): contract-review L52–53 — re-review on the landed head by the lane seat or triage under (a)(b)(c) (L23–25 on the same file, resolves); each must-fix a new card citing the record; revert only for main red (p0) or a security boundary; ⛔ no repair on the closed PR; landing-operations L13 points at it. Holds.
• Card 27363 item 1 (no seat assignee at pr_create): os-dev.md L37 「PR ⛔ 不带 assignees,人经席位交棒才见 PR」, L60 (写预算: labels, ⛔ 无 assignees); ops.mjs pr_create row keeps assignees optional for the author-is-approver fallback; execute.mjs pins that a Tier H create reads no file list, sends no request and no assignee (approver-authored included). This PR's own open is the first instance (assignees: [], requested_reviewers: [] read back by the dev and by the seat). Holds.
• Item 2 (in-flight PR reader): execution-duties L63 reads head:claude/ open PRs + the card the body names; the dev measured no patrol reading PR assignees as ownership (check-handover: card assignees, pulls excluded; check-half-states: PR assignees only as H43's approver-coverage fallback). Holds.
• Item 4 (project thread does not perform the harness's post-create step): dispatch-runbook L140, quoting 「审核通过才会推送给我审核」; paid by old L136 whose clauses live at coordinator.md 三 L22–L24 (read: present). Holds.
• Item 5 (H43 timing): h43HandoffReading — unread (thread null) ⇒ UNJUDGED and quiet, before (no ACCEPT or no same-head PASS) ⇒ quiet, due ⇒ the existing coverage judgment; only due buys the review page; the summary line discloses read/due counts; a PASS whose head moved reads before (回等复核). The verdict word has one reader, explicit VERDICT: line first. Holds.
• Must-fix (governed rule text ≠ the mechanism it describes): SKILL.md L200 「pr_create/pr_ready 不请审不指派」 — but ops.mjs L1094 keeps governedReview: true on pr_ready, GOVERNED_REVIEW_OPS derives to ['pr_ready'], and execute.mjs's battery pins that a pr_ready on a Tier H diff requests every uncovered GOVERNED_APPROVERS account (and assigns an approver-author). The PR body's 速读 「风险与回滚」 says the opposite of L200 (「pr_ready 仍保留受管请审兜底」) and matches the code. One of the two must give; the seat rules text follows code: the backstop at pr_ready fires only when the hand-off was not made (a Tier H pr_ready comes after approval, so with the hand-off made the union already covers both and it costs zero writes), it is the regime's safety net against a seat that readies without the hand-off, and removing it would widen this PR. L200 must say that pr_create requests and assigns nobody while pr_ready only fills what the hand-off left uncovered — in ≤120 B, net 0 lines (the four clauses of L200 kept or re-homed on L198–201, a dropped clause named in the report).

② Semver level

• None owed: .claude/** + scripts/pm/** publish nothing; skip-changeset correct; Clause-②: no, Metadata-protocol: none line-initial, matching both claims.

③ Boundary flags

• The order's hypothesis 1 held (the hand-off is the existing pr_request_reviewers op); hypothesis 3 adjusted by measurement (locateReviewOfRecord needs both threads; H43 reads the PR thread alone — a PASS on the card alone reads as BEFORE, under-report only, disclosed in the header). Accepted.
• Deviation 1 (H69 wording in the same file, made false by this PR) and deviation 2 (latestContractReviewOnHead returns verdict, additive) — in-file adjacency, accepted.
• Out-of-scope class b: AGENTS.md 〈Multi-agent working discipline〉 「the PR's assignee mirrors the card's, set by the executor at pr_create」 contradicted by os-dev.md L37 — Tier H, the maintainer's hand; the seat carries it (ACCEPT names the carrier).
• test:repo / lint / dogfood left to CI; check-runs on this head: 29 success, 20 skipped, Test Core (1/8) in progress at the reading — the skip judgement is read when the set is final.
• Author objectstack-fleet[bot] through the relay; mcp_calls: 0; api_writes 4 (3 pushes, 1 relay create, 2 post-stamped); draft, assignees [], requested_reviewers [], no flip by anyone.

④ Design judgment

• Against the maintainer's 「应该是开发完了你审核通过才会推送给我审核」 and the four-axis frame: a human's inbox sees a PR only once the seat has reviewed it on the head they would read — the ask becomes the seat's own stroke after ACCEPT + PASS, the draft open summons nobody, the dev's PR carries no seat account, and the patrol row is re-timed so it reports the gap exactly when the hand-off is owed and not before (AI-error: the timing is read off the thread's records, not assumed; focus: no new gate, no workflow, one flag removed from one row; long-run: one rule in SKILL.md ③, five homes point at it). Holds, save the one text/mechanism contradiction above, which is exactly the kind of declared≠enforced sentence the regime refuses in governed text.

Implemented-by: claude/issue-27345-human-sees-pr-after-pass
Reviewed-by: session_01QSeKYmhU5KEj1nukYhp1Tg

VERDICT: FAIL — one must-fix (SKILL.md L200 vs ops.mjs pr_ready); a delta review by this seat on the fixing commit follows.

[objectstack-fleet]

domain:skills#2 · os-justin · session_01QSeKYmhU5KEj1nukYhp1Tg

Contract-review-claim: session_01QSeKYmhU5KEj1nukYhp1Tg · head 3e2b20c · 2026-10-29T05:42Z

[objectstack-fleet]

domain:skills#2 · os-justin · session_01QSeKYmhU5KEj1nukYhp1Tg

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 3e2b20cc110264f5de051b6b70aa5990beeb6c20
Local-runs: probe — the seat ran, in a detached read-only worktree of the head (no edit, no network write): git diff 50118ffc 3e2b20cc --stat → one file, +1/−1 (.claude/skills/pm-dispatch/SKILL.md L200 only; L198 / L199 / L201 byte-identical); L200 measured 118 B; file 319 lines; check-skill-line-ratchet.mjs ✓ (ceilings down 494), check-skill-id-lint.mjs ✓ 105, check-governed-prose.mjs ✓, check-skill-frame-sync.mjs ✓; check-expected-skips.mjs --pr 27385 from a worktree at origin/main 7f17135 → exit 0 (every skipped check-run rostered)
Scope: delta review of the rework commit 3e2b20c on the record 6488313163 (FAIL on 50118ff, one must-fix); the rest of the diff is unchanged from that record and is not re-read here

Claim line 6489001909 on this head (2026-10-29T05:44Z); the earlier record 6488313163 stands for the other ten files. Read at 2026-10-29T05:44Z by the domain:skills#2 seat on the fetched head (four commits on merge-base 28872e68; origin/main now 7f17135; PR mergeable_state: clean): 11 files, +461/−199 (660 ≤ 3000; Tier S by path).

① Derived judgments

• The must-fix: L200 now reads 「pr_create 不请不派;pr_ready 只补交棒漏;PASS 后 head 移 ⇒ 回等复核;脱中继 PR 自读请/派。」 — pr_create requests and assigns nobody (ops.mjs pr_create row: no governedReview); pr_ready only fills what the hand-off (交棒, defined on L198) left uncovered (ops.mjs L1094 governedReview: true on pr_ready, zero writes once the hand-off covered both approvers — execute.mjs's idempotent pin); a head that moves after the PASS goes back to waiting; an off-relay PR has the seat read its requested reviewers and assignees. The four clauses of the old L200 kept at their home; nothing dropped; 「请/派」 is the shorthand L199 already uses. Text and mechanism now agree. Holds.
• Byte and line budget: 118 B ≤ 120; 319 / 319; the dev's rejected spellings (129 / 130 / 124 B, and the two re-homings at 134 / 130 B) measured, not guessed. Holds.
• Consistency read on the head: ops.mjs header (「The one follow-up left is pr_ready … The row pr_ready therefore carries governedReview: true」), landing-operations.md L12, director.md L57 — none states the contrary. Holds.
• No script, test or workflow touched in the delta; the self-tests re-run by the dev on the head (validate 216, execute 209, dispatch 265, half-states 5066, ratchet 164) match the seat's readings on 50118ff, whose code is byte-identical on this head.

② Semver level

• Unchanged from 6488313163: none owed; skip-changeset correct; Clause-②: no, Metadata-protocol: none line-initial.

③ Boundary flags

• The PR body's B21 「pr_create/pr_ready request and assign nobody」 and B47 (the old L200 at 119 B) are stale against the new L200; B10 / B31 already describe the backstop. The dev did not PATCH the body (as ordered); the seat's ACCEPT corrects the two sentences. Accepted.
• Gate derivation ran on a tree six commits behind origin/main (dispatch-gates STALE TREE warning; five derivation files moved on main); main not merged on purpose (one commit, mergeable_state: clean); CI on the head is the authority for those families — check-runs on 3e2b20c read by the dev at 05:38Z: 46 total, 30 success, 16 skipped, 0 failure, 0 in progress; the seat's check-expected-skips exit 0 above.
• Author objectstack-fleet[bot] through the relay; mcp_calls: 0; api_writes this round 1 (post-stamped) + 1 git push; draft, assignees [], requested_reviewers []; no flip by anyone.

④ Design judgment

• Unchanged from 6488313163, with the one declared≠enforced sentence now closed: the governed text says exactly what the relay does, the backstop stays as the regime's safety net against a seat that readies a Tier H PR without the hand-off, and the rule remains written once (SKILL.md ③) with five homes pointing at it.

Implemented-by: claude/issue-27345-human-sees-pr-after-pass
Reviewed-by: session_01QSeKYmhU5KEj1nukYhp1Tg

VERDICT: PASS — delta on 6488313163's must-fix; the full record for the other ten files is 6488313163.

[objectstack-fleet]

domain:skills#2 · os-justin · session_01QSeKYmhU5KEj1nukYhp1Tg

维护者速读

• 改了什么:把「PR 推给人审」的时点改为 席位 ACCEPT + 现 head 契约复核 PASS 俱在案之后:请审成为席位的交棒动作(中继 pr_request_reviewers;作者是审批人时 assign),dev 开 draft PR 不带 assignees,中继 pr_create 不再在开 PR 那一刻请审或指派(pr_ready 保留受管请审兜底,只补交棒漏下的审批人,交棒已做则零写);落地时仍欠复核的 PR 在落地 head 复审、发现逐条立新卡;巡查 H43 只在交棒已到期而无人被请时才报。
• 为什么改:您的指派清单被没人复核过的 draft 填满,请审在席位审完之前就发出(「这个是技能的bug,应该是开发完了你审核通过才会推送给我审核」);三张 PR 在 PASS 之前或缺席时就被推到您面前并挂了 auto-merge(「没有完成复审就推送给我审核了」)。
• 风险与回滚:只改技能文本(7 个 .claude 文件,行数与字节均在天花板内)、中继表的一个标记位(pr_create 行的 governedReview 移除)与一条只报不拦的巡查行;不新增门禁、不碰 workflow。回滚 = revert 本 PR 的四个 commit。Tier H 的批准与合并仍是您的点击。
• 先看:① scripts/pm/fleet-write/ops.mjs 的 pr_create 行与头部「The governed-review follow-up」节;② .claude/skills/pm-dispatch/SKILL.md L198–201(规则唯一一份;L200 已在返工轮改为「pr_create 不请不派;pr_ready 只补交棒漏」);③ scripts/pm/check-half-states.mjs 的 h43HandoffReading(unread 不判、before 不报、due 才报)。
• 两分钟验证:node scripts/pm/fleet-write/execute.mjs --self-test && node scripts/pm/check-half-states.mjs --self-test,预期尾行 209 cases pass across 20 batteries 与 5066 cases pass … H43 hand-off timing 89/80;本 PR 自身即首个样本:draft 开出时 assignees 与 requested_reviewers 皆空。
• 需要你做的:无。路径面 .claude/** ×7 + scripts/pm/** ×4 ⇒ Tier S,席位按您的落地授权「你应该按照 pm-dispatch 技能审核并落地pr」ready → auto-merge。遗留一句归您的手:AGENTS.md 〈Multi-agent working discipline〉「the PR's assignee mirrors the card's, set by the executor at pr_create」 与本 PR 后的 os-dev.md L37 相反(Tier H 文件,席位不改;见 Acceptance notes)。
• 席位意见:ACCEPT。PR 正文两处过时句(What changes 的「pr_create/pr_ready request and assign nobody」与 Line budget 引用的旧 L200 119 B)以本记录为准:pr_ready 的兜底保留,L200 现为 118 B。

席位核对

1. 形态:11 个文件 +461/−199(660 ≤ 3000);四个 commit,最后一个 3e2b20c 为返工(SKILL.md L200 一行);draft,作者 objectstack-fleet[bot](经中继),assignees []、requested_reviewers [](本 PR 开出即遵守其所写规则);mergeable_state: clean。
2. 前提实测:两卡的维护者原话均在;pr_create 行无 governedReview、GOVERNED_REVIEW_OPS === ['pr_ready'](ops.mjs L1094 保留兜底);H43 三态读 PR 线程的 ## 席位核对 ACCEPT + 同 head ## Contract review PASS;contract-review.md L52–53 落地后复审规则引 L23–25 的 (a)(b)(c);dispatch-runbook 删行的三条款在 coordinator.md 三 L22–24;AGENTS.md L401 相反句未改(Tier H,范围外)。
3. 门禁 check-runs(head 3e2b20c):46 个,30 success、16 skipped、0 失败、0 在跑;check-expected-skips.mjs --pr 27385(roster 取自 origin/main 7f17135)→ exit 0,16 个 skip 皆在名册;席位本地探针(分离 worktree):ratchet / id-lint / governed-prose / frame-sync / fleet-write ×3 / half-states 5066 / recognisers / owed-reviews / queue-guard / handover 全绿;check-governed-merges --self-test 在该 worktree 缺 tsx 为 PREREQUISITE NOT MET(环境),采 dev 全装下的 537。
4. 接受的偏差:H69 同文件措辞随之改(本 PR 使其为假);latestContractReviewOnHead 增 verdict 字段(加性);locateReviewOfRecord 未直调(需双线程),H43 只读 PR 线程(卡上单独的 PASS 读作 before,只会少报,头部已声明);dispatch-gates 在落后 main 六个 commit 的树上推导(CI 为权威,已全绿);PR 正文两处过时句由本记录更正、不 PATCH。
5. 范围外去向 + Skills-docs::class b — AGENTS.md L401 「PR assignee mirrors the card … at pr_create」 vs os-dev.md L37:Tier H,维护者的手;本席携带(本条即 Acceptance note,维护者一句话或一张 Tier H 卡)。fleet-write: relay pr_create asks the governed approvers to review a Tier H draft before any contract review exists, so an approver can approve and merge it unreviewed (#26566, #26570) #26617 保持 pm:on-hold(其 shape 1 已由本 PR 实现,分诊落地后定去向)。在飞 PR 上已指派的人本 PR 不摘(skills(os-dev, pm-dispatch): a seat-driven PR is not assigned to the seat's account at the draft open; it reaches a human only after ACCEPT + contract PASS, as a review request to os-zhuang/hotlong when Tier H #27363 第 6 项,卡上原话)。Skills-docs: none(Metadata-protocol: none)。
6. 落地条款:Tier S(check-governed-merges --pr 27385:7/11 路径命中,全在 Tier S 面);契约复核 PASS 在案 — 全量记录 6488313163(FAIL → 一处 must-fix)+ delta PASS 6489025774(head 3e2b20c);Clause-②: no、Metadata-protocol: none 行首在 PR 正文;skip-changeset 正确(.claude/** + scripts/pm/** 不发布)。落地笔 = pr_ready + automerge_enable,授权原话「你应该按照 pm-dispatch 技能审核并落地pr」。

ACCEPT · head 3e2b20cc110264f5de051b6b70aa5990beeb6c20 · 2026-10-29T05:45Z