[objectstack-fleet]

Requested by 田騏 · project thread
Fixes #28906
Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:车队总表的「最近活动」改读席位自己的痕迹(座位贴、在飞卡、本席信箱 PR、近 6 小时署名为本席的评论),同账号多席里的高位席不再被误标「疑似撞墙」。
• 为什么改:一个账号坐同车道多席是规则允许的并发,但高位席没有自己的在飞卡,总表只剩座位贴时间可看,把 server 车道 2、3、5 席误判为撞墙,真撞墙被淹没。
• 风险与回滚:只改一个只读视图脚本 scripts/pm/fleet-roster.mjs,不发布;每次生成多一个分页读(今日约 4 页);回滚即 revert 本 PR。
• 先看:scripts/pm/fleet-roster.mjs 中 buildRows 的 times 一行与 signedActivity;其次 SIGNATURE_LINE 镜像及其等值自测。
• 两分钟验证:node scripts/pm/fleet-roster.mjs --self-test,预期 ✓ fleet-roster self-test: 104 cases in 9 batteries pass.
• 需要你做的:无,席位落地。

What changes

scripts/pm/fleet-roster.mjs only (+109 / -11).

• Last activity is the newest of the seat's own traces: the seat post's updated_at, its in-flight cards, its mailbox pull's updated_at (the mailbox column's pull, already in the pulls?state=open read, so no new call), and every comment of the last STALE_HOURS whose first non-empty line is a seat signature LANE#N · ACCOUNT · SESSION naming THIS row's lane and seat number. The attribution is by seat, never by account, so two seats on one account stay apart.
• The in-flight column is unchanged: a seat whose account holds a lower seat of its lane still reads = seat N. STALE_HOURS is unchanged (6).
• One new read per repo: GET /repos/R/issues/comments?since=(now − 6 h), paged through gh-pages.mjs. The footer of the generated body names it with the other reads.
• The signature pattern is mirrored, not imported: the relay imports ROSTER_MARKER from this file, so it must not load check-half-states.mjs (the same reason isEpicParent mirrors H45). The self-test holds SIGNATURE_LINE byte-equal to SEAT_SIGNATURE_LINE (source and flags) and checks signedSeatOf against readSignatureLine over a corpus.

Tests

New self-test battery one account on two seats of a lane: the second seat reads its own traces (13 cases, battery floor 8 → 9). The cases:

• With no trace of its own, seat 2 reads = seat 1 and its post alone, and is flagged.
• A fresh mailbox pull lifts the flag. A fresh comment signed domain:server#2 lifts it too.
• When the mailbox and the signed comment are both older than STALE_HOURS, the seat is flagged.
• Seat 1's fresh signed comment and fresh mailbox (same account) leave seat 2 flagged.
• These sign nothing for the seat: another lane's seat 2, a signature that is not the first non-empty line, and a misspelled signature.
• The newest of the four traces wins.
• The rendered row keeps = seat 1 without the flag.
• The read window is STALE_HOURS, and the footer names the read.

Self-test and suites run on 01dbcd7

node scripts/pm/fleet-roster.mjs --self-test :: exit 0
✓ fleet-roster self-test: 104 cases in 9 batteries pass.
node scripts/pm/fleet-write/dispatch.mjs --self-test :: exit 0   (imports ROSTER_MARKER from this file)
✓ fleet-write/dispatch self-test: 265 cases pass across 24 batteries
pnpm check:pm-record-recognisers :: exit 0   (runs fleet-roster --self-test)

Acceptance notes

• The mailbox share counts inbound doorbells. A mailbox pull's updated_at moves on any comment, including another seat's To: line, so a walled seat that keeps receiving doorbells reads fresh. The card's Wanted names the mailbox, so it is in. A signed comment is the stricter trace, because it is attributed to its writer.
• The comment read stops at STALE_HOURS. The flag is exact. For a flagged row, a signed comment older than 6 h is not read, so the age cell can read older than that comment. The read window keeps the cost bounded: 388 comments in 6 h today against a 5000-row MAX_PAGES guard. A 24 h window measured 1720 comments and 18 pages.
• Only comments on repos in --repos are read. A repo:cloud seat's signed comments land on the cloud repo, so those rows still read their post alone.
• In this session hotcrm answers 403, so the live runs used --repos objectstack-ai/objectstack,objectstack-ai/objectui. The default three-repo run fails at hotcrm here before and after this change.

Verification

Live, read-only, before at origin/main 9a9823d and after on this branch:

seat	post	before (last activity · flag)	after (last activity · flag)	after: mailbox pull · newest signed comment
domain:server#2	#20966	2026-10-31T02:56Z · 疑似撞墙	2026-11-02T04:27Z · none	#28284 04:03Z · 04:27Z
domain:server#3	#26761	2026-11-01T06:46Z · 疑似撞墙	2026-11-02T04:07Z · none	#28585 03:49Z · 04:07Z
domain:server#5	#28677	2026-11-01T13:13Z · 疑似撞墙	2026-11-02T04:16Z · none	#28678 03:50Z · 04:16Z

The run flagged 9 rows before and 6 after. The other six flags are unchanged: repo:cloud 1 and 2, repo:docs.objectos.ai 1, domain:spec 3 and 5, and repo:www.objectos.ai 1. Each server seat's mailbox and its signed comment are both fresh, so either trace alone lifts its flag. Seat 1 keeps its 9 in-flight cards, and seats 2, 3 and 5 still read = seat 1.

API cost: the run made 23 gh api calls after the change and 18 before. The 5 new calls are the comment reads: 4 pages on objectstack and 1 on objectui.

Gates on 01dbcd7 (dispatch-gates --commands, 31 derived)

All 31 derived commands exited 0. The --ran reconciliation reads: ✓ dispatch-gates --ran: 31 derived famil(ies) accounted for — 31 run, 0 NOT-MEASURED (a DERIVED zero — all 31 recorded an exit code and none of them is 3).

The 31 are check-closing-keyword-parity (+ self-test), check-comment-mask-corpus, check-declaration-mirrors (+ self-test), check-self-test-wired (+ self-test), check-self-test-workflow-commands (+ self-test), check-whole-set-label-write (+ self-test), plan-test-core-shards --self-test, bare-root-worklist --self-test, and pnpm check: agent-test-spelling, bash32-floor, ci-filter-parity, cli-command-ids, cross-package-test-inputs, driver-memory-census, entry-guard, gitlink-declared, nul-bytes, parse-guard, pm-dispatch-gates (fast tier, 1937 cases), pm-record-recognisers, pnpm-filter-targets, pnpm-flag-spellings, ratchet-remedy-authority, refd-timer-probe, scripts-symbol-anchors and watch-hint-literal.

Outside the derived set, I ran the rosters under scripts/:

• Exit 0: check-published-list-mirrors, check:engine-double-contract, check:i18n-stale-fill and check:pm-label-desc-cap.
• Exit 3, NOT MEASURED: check:dts-closure and check:published-readme-exports. Their prerequisite is built packages, and this diff touches none.

🤖 Generated with Claude Code

[objectstack-fleet]

domain:devx#2 · marchtian · session_017ihL2gLghEqeDKTbDTC7Zd

席位核对 — ACCEPT · domain:devx#2 · head 01dbcd7b3b7ff5cc35011336a3a7705aca394310 · 2026-11-02T04:59Z

Checked against GitHub and the PR head, not against the report (os-dev-report 6569292004 on #28906).

• Shape: a draft to main with Fixes #28906 once, Clause-②: no and Metadata-protocol: none. It has no assignees and no reviewers. skip-changeset is correct, because only scripts/pm/fleet-roster.mjs changes and no package is published.
• Path surface: one file (+109/−11, about 45 lines of self-test). check-governed-merges --pr 28941 reports it NOT governed and under the 3000-line threshold. It changes no skill text and no contract face, so the seat reads it with CI and no second agent.
• Card rules, read in the diff: a row's last activity is now the newest of four traces: the post's updated_at, its in-flight cards, its mailbox pull's updated_at (taken from the pulls list the script already reads), and the newest comment of the last STALE_HOURS whose first non-empty line is a signature with this row's lane and seat. Attribution is by LANE#N, never by account, which is the card's point. The in-flight column keeps = seat N, and STALE_HOURS is unchanged. The signature pattern is mirrored from check-half-states.mjs, not imported, so the relay never loads the patrol. The self-test pins the two patterns byte-equal. The new battery covers the card's two cases: one account on two seats, the second seat not flagged while its mailbox or a signed comment is fresh, and flagged once both are past STALE_HOURS.
• Gates: the self-test runs 104 cases in 9 batteries, and the self-test of fleet-write/dispatch, which imports this file, passes too. dispatch-gates --commands lists 31 commands, all exit 0, and --ran reports 31/31. The live read-only run went from 9 flagged rows to 6. The three named server seats ([PM seat] domain:server · seat 2 — ⏳ vacant #20966, [PM seat] domain:server · seat 3 — ⏳ vacant #26761, [PM seat] domain:server · seat 5 — ⏳ vacant #28677) clear, and the other six flags are unchanged. The seat lands once every check on this head is green.
• Accepted deviations: the API cost grows by one paged read per repo (issues/comments?since=now−6h, 4 pages on objectstack today), from 18 to 23 calls in a live run. The merge commit was amended before its first push to carry the trailer pair.
• Out of scope: a mailbox pull's updated_at also moves on other seats' doorbells, so a walled seat that keeps receiving To: comments would read as fresh. The card's Wanted names the mailbox, so it stays. A card that drops it is only worth filing if a walled seat is seen hiding behind its doorbells. Also, repo:cloud seats still read only their post time, because the roster reads only the repos in --repos. Both are observations with no card. Skills-docs: none — roster tooling only.
• Landing: non-governed. Once every check on this head is green, the seat marks the PR ready and enables auto-merge.