[objectstack-fleet]

Requested by Yibo Wang · project thread

Fixes #29682

维护者速读

• 改了什么: 车道席遇到「有标签、无分诊审计评论」的排队卡,当轮用既有门铃键 Request: triage · #n · first-touch audit 敲分诊信箱,分诊空席改敲总监(execution-duties.md 候选节);分诊席章程加一条:每轮 sweep 推导这类卡并照首触补审计、报数(lanes/triage.md);半状态巡查 check-half-states.mjs 加一行只报告的 H74,从正文与评论两个通道推导同一集合,豁免 SKILL.md 的三类免审计卡(非车队卡、main-red 锚卡、承父卡域/级的子卡)与机器锚卡的身份标签。
• 为什么改: 您 11-03 的原话「他在等,为什么没有用邮箱提醒你,是否应该立卡改进技能」。立卡席把域、级与 pm:queue 一笔挂齐,分诊 sweep 的五个析取都按「缺标签」找卡,看不见它;车道一侧读到「无分诊审计评论 ⛔ 不得认领」就停着等。两边互等,没人被提醒;当日实测 15 张,含两张 p1。
• 风险与回滚: 文本两处各净零行(新增一行以删一行重复内容付账,两文件仍在棘轮上限,行宽 ≤120 字节);H74 只报告、不写标签不拦落地,每轮对正文无记录的排队/阻塞卡各买一次评论首页,对两个通道都干净的卡再买一次父卡读(当前 open pm:queue 33 张 + pm:blocked 23 张为上界)。回滚 = revert 本 PR,无数据与门禁副作用。
• 先看: ① scripts/pm/check-half-states.mjs 的 H74 节(isTriageAuditRecord 两种记录形状、isFleetCard、H74_MAIN_RED_ANCHOR_TITLE、h74InheritsFromParent 与 H74_EXEMPT_LABELS);② execution-duties.md 第 63 行门铃句、第 121 行降档理由并入与删掉的旧第 120 行;③ lanes/triage.md 第 16 行 sweep 句与删掉的末行。
• 两分钟验证: node scripts/pm/check-half-states.mjs --self-test,预期末行 5222 cases pass,电池清单含 H74 first-touch audit 60/46。
• 需要你做的: 无,席位落地(.claude/** 为 Tier S,席内达档复核后由席位入队)。

Clause-②: no
Metadata-protocol: none

What changes

Lane side — references/execution-duties.md, 候选与批次 section (net 0 lines, 188/188). One line added directly under the generic doorbell line 「⛔ 不静默等分诊」: a candidate with no triage audit comment is knocked in the same round with the existing key Request: triage · #n · first-touch audit; when the triage seat is vacant the knock goes to the director (project-forms.md routes a vacant triage to the director only on its Request: main-red row, so the route is spelled here for this key); and ⛔ the gap is never reported to the maintainer in the mailbox's place. The rule sits here rather than beside SKILL.md line 171 (where 「无分诊审计评论 ⛔ 不得认领」 lives) because this file is where the execution seat's candidate definition and its generic knock already live, SKILL.md is at its ceiling with no restated line to pay with, and the card asked for one place only. Paid by deleting the line 「降档的档位与理由记入认领评论 Container & model 行;档位逐次派发显式传参,永不省略」 — and because its first half (the downgraded tier AND its reason go on the claim comment) was stated nowhere else, that half is folded into the effort line below (now 「effort 按卡难度定,与档位、降档理由写进 Container & model 行与派发令,显式传参,⛔ 不留空」); its second half (the tier passed explicitly at every dispatch) was already carried by that same line.

One thing the card said that the text does not spell, on purpose: "one doorbell per card or one listing several" — the request:triage reader (record-recognisers.mjs) takes exactly one #n, so the line says one knock per card.

Triage side — references/lanes/triage.md (net 0 lines, 20/20). One line added under the push list: the sweep also derives pm:queue / pm:blocked cards with no audit comment (exemptions as the H74 row lists them), audits each as an ungraded first touch and reports the count. Paid by deleting the last line 「security#1 空缺时沿用 security-findings.md 第 7 节处置,⛔ 不代席、不追加细节」, which restates security-findings.md §7 (no details, hand to the maintainer) and §9 (a vacant security#1 seat hands to the maintainer) — and §8 of that file forbids a second copy outright. The line above it still points at security.md.

Tooling — scripts/pm/check-half-states.mjs, H74 (report-only). The triage sweep's disjunct derivations do live in this script (H13 mirrors disjunct ③), so the card's "if a script owns the sweep" arm applies. H74 speaks about open issues carrying pm:queue or pm:blocked, minus:

• the card's exempt labels (tracking, pm:epic, pm:seat, qa-run, status:parked, queue-flake-anchor — the label merge-queue-triage.yml stamps on its anchors) plus platform-checklist-watchdog, the identity label of the one in-tree anchor template fleet-patrols.yml files AS pm:queue,tooling (title check:platform-checklist is red on main, which the main-red title reading below does not open; the identity label is the machine's and is never graded off, so it is the right key). A census of every .github/workflows/** template that files a card found no other that applies pm:queue on create;
• SKILL.md's three audit-exempt classes: a non-fleet card (the card's "[maintainer] cards", read as 「非车队卡:作者非 Bot 且首行非席位签名」 through one shared isFleetCard — an App author or a seat-signed body is the fleet's, an unreadable author is never promoted to a human's — which H67's read order now uses in place of its inline copy); a main-red anchor card, by its measured title openings (main red: / main red (…) / main red since … as seats file them, and : red on main as the scheduled-run cards file them; a card about main-red such as pm-dispatch(main-red): … stays in); and a sub-issue inheriting its parent's domain or grade, read through the sub-issues parent fetch class H45 already takes (subIssueParentPath, same documented-404 reading), bought only for a card whose thread was READ and found clean — a non-404 failure fires the card's own UNJUDGED row through a sentinel, never silence.

A triage audit record is either a text whose first line is a triage#N signature and which carries a ## Triage heading (fences stripped), or one of the older openings isTriageRulingComment already reads for H33 (Triage:, Grading, …, signature-tolerant). The body is read first; a body-clean member buys one comment-page read off the shared cache (H55's gated-fetch pattern, needsTriageAuditComments), so a card H2 or H4 already fetched costs nothing. Three thread states: unconsulted ⇒ silent (never a fabricated row); unreadable ⇒ an UNJUDGED row; read ⇒ fires when neither channel carries a record. Band state (H13's), a coverage pair in the summary sentence (First-touch audits (H74): comment threads read on X of Y …), two count keys on the forwarding contract, no label, no exit code, no gate.

Not changed: SKILL.md (untouched; line 171 stays the lane's ⛔ line), triage-duties.md (held by #29445's dispatch), record-recognisers.mjs (the request:triage key is reused as is), no new key, label, gate or ceiling raise. The line ratchet's raise rule asks for a ruling comment id; the maintainer's word on this card is a session sentence with no comment id, so every added line is paid by deletion.

Why

Both sides had a rule that read 「not mine」: triage's sweep derived cards by missing labels and this shape has every label; the lane read the audit-less card as non-candidate and waited. The maintainer's own word is on the card. The fix is the smallest pair that converges: the lane rings the existing bell in the round it notices, and the sweep lists the same set so the first triage round after landing finds nothing a lane has not also knocked about.

Tests

• node scripts/pm/check-half-states.mjs --self-test — ✓ check-half-states self-test: 5222 cases pass, battery H74 first-touch audit 60/46 (frozen roster, pin under the count). The battery drives: a card with an audit comment and one without (the card's acceptance pin), each record shape as its own positive control (signed ## Triage, ### Triage, the older Triage: opening, a lane-signed self-triage Triage: record), the controls that must still fire (a triage-signed comment with no heading, a lane-signed heading below prose, a fenced ## Triage citation), the body channel (clean and buys no thread), the three thread states, every exempt label beside a non-exempt twin, the watchdog anchor as fleet-patrols.yml files it beside the same card without its identity label (fires — the title alone does not exempt it), the non-fleet card beside its three fleet twins (seat-signed body under the same human account, App author, unreadable author) and the isFleetCard leg of H67's order, six measured main-red anchor titles beside a card about main-red and a mid-title red on main, the sub-issue exemption by domain and by grade beside a parent sharing neither, a parentless 404, an unread parent, the unreadable-parent UNJUDGED row, the parent-read gating policy, the population edges (closed, PR row, unreadable labels, missing row, null body), the row text (no angle bracket, no tracker number, both remedies named), the summary pair and its shortfall clause, the two count keys on the contract, the band and the emitted-code coverage.
• npx eslint scripts/pm/check-half-states.mjs — exit 0.
• pnpm check:pm-half-states, pnpm check:pm-skill-ratchet (both edited files at their ceilings, widest line 120 bytes), pnpm check:pm-skill-id-lint (109 files clean) — exit 0 on the final head.

Acceptance notes

• The audit-record reader is deliberately the union of the card's two shapes, not a new vocabulary: isTriageRulingComment is reused unchanged, so a ## Triage heading as a comment's FIRST line reads as a record under the older anchor whatever the signature (H33's reading, pinned as kept); the signed shape only adds the case where the heading sits below prose.
• A [maintainer] title prefix has no spelling in the protocol text or scripts on origin/main, so the card's "[maintainer] cards" are read as SKILL.md's 非车队卡 (a human author with no seat signature) rather than as a title test that would never match.
• Cost: at most one comment-page request per body-clean member per sweep, plus one sub-issues parent read per card whose thread was read and found clean (the set that would otherwise fire — fifteen the day the word was given); measured population at dispatch 33 open pm:queue + 23 open pm:blocked cards, less exemptions and cards H2/H4 already fetch. No cap was added because H2, H4 and H45 buy the same way without one; the summary pair reports any thread shortfall, and an unreadable parent is its own UNJUDGED row.
• Deviation from the card's letter, declared: the lane line spells one knock per card (reason under What changes).
• Writes: git push ×4 (WIP, final, patch round 1, patch round 2), relay pr_create ×1 (draft, labels: ["skip-changeset"], no assignees), post-stamped.mjs --comment ×1 for the os-dev-report. mcp_calls: GitHub MCP reads only (issue_read ×6, list_issues ×2); no MCP write.

Verification

Final head 1281c79a (three commits on the branch: the change, contract review r0's four should-fixes, contract review r1's one). On the first head 197f87e0, derived with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack against merge base 21510bba (3 paths), 54 commands run serially in the worktree with each exit code captured before any pipe, then reconciled: ✓ dispatch-gates --ran: 54 derived famil(ies) accounted for — 53 run, 1 NOT-MEASURED (1 DERIVED from a recorded exit 3). The two later heads touch the same three paths and re-ran the gates the diff can move: pnpm check:pm-half-states, pnpm check:pm-skill-ratchet, pnpm check:pm-skill-id-lint and npx eslint on the script, all exit 0.

• 52 of 54 exit 0 on 197f87e0, among them pnpm check:pm-half-states (the H74 battery), pnpm check:pm-skill-ratchet, pnpm check:pm-skill-id-lint, pnpm check:pm-dispatch-gates, pnpm check:pm-governed-merges, pnpm check:pm-post-stamped, pnpm check:skill-frame-sync, pnpm check:single-claim-paths, pnpm check:nul-bytes, pnpm check:doc-authoring, pnpm check:platform-checklist.
• node scripts/check-release-section-coverage.mjs --strict :: exit 1 — the same finding, byte for byte, on the primary checkout at origin/main 21510bba (content/docs/releases/v18/ has no heading for the published spec 18.3 series). A release-owned page this diff does not touch; out of scope, not fixed here.
• pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 3 — PREREQUISITE NOT MET (the lint package's built output is absent in a fresh worktree; --ran classifies the recorded exit 3 as NOT MEASURED). CI builds it; read the PR's Lint & Repo Gates check-run for the verdict.
• Not run locally, by the derivation's own account: the 43 artifact-roster families, 11 wide-population families, 10 changeset-pending families (no changeset: the diff publishes nothing), the Type Check lanes and the Plan Test Core shards step — CI's runs on this PR are the readings for those. No package test or typecheck is owed: the diff touches no package.
• git merge-tree --write-tree HEAD origin/main clean at every push; origin/main has not moved any of the three paths since the branch point.

Repeat the two-minute check: node scripts/pm/check-half-states.mjs --self-test → ✓ check-half-states self-test: 5222 cases pass … H74 first-touch audit 60/46.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (no spec change)
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; eslint passes on the edited script.
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset — this diff publishes nothing (.claude/**, scripts/pm/**), so skip-changeset; both declaration lines are above.
• 6. packages/spec not touched.
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English (the maintainer's ruling is quoted verbatim, untranslated).
• The Before Submitting list in CONTRIBUTING.md is done.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WGufzgjcGBFsSmg6tHbbJq

---

Generated by Claude Code

[objectstack-fleet]

domain:skills#3 · os-support-ai · session_01WGufzhd2Ad9ANGTyAMW7pH

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 197f87e09e9bedb5deaa9de96d64f5a508265795
Local-runs: none
Scope: .claude/skills/pm-dispatch/references/execution-duties.md,.claude/skills/pm-dispatch/references/lanes/triage.md,scripts/pm/check-half-states.mjs + .claude/skills/pm-dispatch/SKILL.md (L86, L170–171, L311), .claude/skills/pm-dispatch/references/project-forms.md (L41–43), .claude/skills/pm-dispatch/references/lanes/security.md (L17, L49), .claude/skills/pm-dispatch/references/security-findings.md (§7–9), .claude/skills/pm-dispatch/references/triage-duties.md (L25, L27, L67), .claude/skills/pm-dispatch/references/instrument-discipline.md (L6–9), .claude/skills/pm-dispatch/references/cross-repo-coordination.md (L36), scripts/pm/record-recognisers.mjs (request:triage, L1280/L1391), scripts/pm/check-skill-line-ratchet.mjs (ceiling and 120-byte rule), .github/workflows/merge-queue-triage.yml (L730)

Inputs read: card #29682 body and both comments (the claim and the os-dev-report); PR #29940 body, file list (3 files, +245/−2) and the net diff against main at merge base 21510bba; the check-runs on the head. The diff is one commit; the three hits paths are the whole diff, so there is no TIER_DEFAULT remainder.

Check-runs on the head at the time of writing: every completed non-skipped run is success — Lint · PM dispatch-gates, Lint · ESLint, Lint · scoped · tooling self-tests, Lint · docs & code guards, Lint · CI, release & engine gates, Type Check · workspace/source gates/consumer gates/debt ledger, TypeScript Type Check, Governed Surface Queue Guard, Check Changeset, Check PR Size, PR-body guards, Live required-set sweep, Platform checklist gate sweep, Release section-coverage sweep, Test Core (2/8), Test UI, Dogfood Regression Gate. Still in_progress: Test Core (1/8), Lint · repo & tooling gates, Live half-state sweep. Recorded as they are; none has concluded red.

① Derived judgments

• No accept-set or public-surface change. The diff touches .claude/** and scripts/pm/** only; nothing under packages/, no schema, no error code, no CLI flag. Right.
• Lane rule (execution-duties.md L63). Adds an obligation on the execution seat: a candidate with no triage audit comment is knocked in the same round with the existing Request: triage · #n · first-touch audit, and the gap is never reported to the maintainer in the mailbox's place. Reuses the request:triage key (record-recognisers.mjs L1280; the template is Request: triage · #n · ONE-LINE-QUESTION, and the reader at L1391 accepts any one-line tail with one #n). No new key, no new label. Right.
• Placement, not SKILL.md L171. Judged and holds: SKILL.md L86 names references/execution-duties.md as what the execution seat reads every fire (候选与批次 · 认领 · …); the generic doorbell line 「⛔ 不静默等分诊:敲信箱键」 sits at L62 of that file, so the specific knock lands directly under the generic one, where the actor reads it; SKILL.md L171 keeps the ⛔ (no claim without audit) and the new line adds only the remedy. One place, as the card asked. Right.
• Triage rule (lanes/triage.md L16). Adds a sweep derivation (pm:queue/pm:blocked with no audit comment) and the duty to audit each as an ungraded first touch and report the count. The exemption list is delegated to the script row by pointer (「豁免照 H74 行」); the vocabulary 「H 行」 exists on main (execution-duties.md L4 「H 行是读数不是前提」), so the pointer is readable. Right, with one caveat under ④ (the row's exempt list is narrower than SKILL.md L170's).
• Two paid deletions. lanes/triage.md L20 (vacant security#1 → §7): restated on main by lanes/security.md L17 「中继拒或本席空缺照第 3、9 节」 and L49 「本席空缺时分诊照第 7 节处置」, and security-findings.md §8 forbids a second copy. Right. execution-duties.md L120 (downgrade tier and reason on the claim comment; tier passed explicitly every dispatch): the second half is restated by L121 (effort 与档位并列 … 派发显式传参,⛔ 不留空); the first half is only partly restated — SKILL.md L311's model: field asks for the tier word and a reason: for the ceiling tier, not for a downgrade. Wrong in part — ④ names it should-fix.
• H74 row. Report-only: no label write, no comment, no exit code, band state; two new keys on SWEEP_COUNT_KEYS (forwarded by Object.fromEntries(SWEEP_COUNT_KEYS.map(…)) at L21140, so the pair reaches the summary); one summary clause anchor placed in rendered order (after H55's sentence, before H19's — matches the self-test's order pin); one battery on the frozen roster. The maintainer's verbatim word is quoted in the row's header comment and on the card, as instrument-discipline.md L9 asks of a new patrol row. Right.
• Changeset. skip-changeset label, Check Changeset green, nothing published. Right.

② Semver level

Nothing published: no package path in the diff. skip-changeset is correct and the Check Changeset run is green. Clause-②: no is on the PR body with no (narrowing) arm — right: no published accept-set is narrowed, no declared contract is touched; the rules text and a report-only sweep row carry no clause-② surface. The Metadata-protocol: none line is right for the same reason.

③ Boundary flags

The dev declared four deviations on the os-dev-report, one acceptance-note flag and one out-of-scope finding; open_questions is empty. Each answered:

1. One knock per card (card: "one doorbell per card or one listing several"). Holds. record-recognisers.mjs L1391 reads exactly one #n on request:triage (self-test at L2830 pins numbers.join() === '27123'); a listing knock would be a half-state under the mailbox line rule (one event, one line). Accepted.
2. Vacant triage → director not restated. Does not hold as justified. The PR body says the mailbox table "already routes a vacant triage to the director"; on main that routing exists only on the Request: main-red row (project-forms.md L42 「分诊(缺则总监)」) — the Request: triage row (L43) has no vacancy clause, and no general vacant-seat rule exists in SKILL.md, seat-lifecycle.md, project-forms.md or lanes/director.md (grep 空缺 is empty on all four; cross-repo-coordination.md L36 covers only a session-type execution PM sweeping as triage in a multi-lane repo). The new lane line is 108 bytes, so the 120-byte cap left room for a short clause, and project-forms.md L42 shows the four-character idiom. Net effect: a lane facing a vacant triage is told ⛔ not to report to the maintainer and given no route — the shape the card was filed against. Should-fix (④ item 1).
3. No PR subscription; worktree detached. Procedural per os-dev.md; no bearing on the tree. Accepted.
4. [maintainer] title prefix has no spelling on main (acceptance note). The dev flagged it honestly. On main there is no [maintainer] title convention in .claude/**, scripts/** or AGENTS.md; the repo's reading of a maintainer-filed card is SKILL.md's 非车队卡 (author not Bot and first line not a seat signature, execution-duties.md L55). As committed, the exemption matches nothing, so it is a no-op and the card's intent (a card the maintainer filed with labels by hand is not an unaudited queue card) is unmet. Escalated to the card's author for the intended spelling; should-fix (④ item 4).
5. Cost: no cap on the H74 thread buy. The dev measured 33 + 23 as the ceiling and the buy rides the shared commentsFor cache (one page per body-clean member, free when H2/H4 already fetched). H55 buys the same way without a cap; the summary pair reports any shortfall and an unread thread fires its own UNJUDGED row. Accepted.
6. Out-of-scope finding (release-section-coverage --strict red on main for the v18 page). Not this diff's; the Release section-coverage sweep run on the head is green. Noted, not reviewed.

④ Design judgment

.claude/skills/pm-dispatch/references/execution-duties.md — judged against SKILL.md L170–171 (the rule it remedies), L62 (the generic knock), project-forms.md L41–43 (the mailbox table), the request:triage reader, and the ratchet (188/188, widest line 120 bytes on main and on the head).

1. Should-fix — the vacant-triage route is missing and the reason given for dropping it is wrong. See ③ item 2. The fix is one of: add 「(分诊缺则总监)」 or the L42 idiom to the new line (rewording within 120 bytes), or add the vacancy clause to project-forms.md L43 where the generic knock line already points (that row is at 120 bytes and the file at 58 lines, so it would need its own reword or a paid line).
2. Should-fix — the paid deletion drops a rule that is only half restated. L120 on main required the downgraded tier and its reason on the claim comment's Container & model line. SKILL.md L311 asks for the tier word and a reason: only when the ceiling tier is served; L118–119 name the two downgrade exits and the seat-post note for a temporary deviation but do not require the reason on the claim comment; no instrument reads it (H65 judges triage-round tier naming, not claims). The downgrade itself stays controlled by L105–106 (contract-review-tier review as the compensating control), so this is a lost audit trail, not a lost gate. Pay the new line with a different deletion, or keep the reason clause by folding it into L118.
3. Holds — the line sits under the generic knock, reuses the existing key with a one-line tail the reader accepts, keeps the ⛔ against reporting to the maintainer in the mailbox's place (the maintainer's word), is 108 bytes, and the file count is unchanged. The 「候选缺审计评论」 wording leaves SKILL.md L170's two exemptions (sub-issue inheriting the parent's domain; main-red anchor) to be read from SKILL.md, which the seat reads first; acceptable as one place.

.claude/skills/pm-dispatch/references/lanes/triage.md — judged against triage-duties.md L19/L25/L27/L67 (first touch and the audit comment), lanes/security.md L17/L49 and security-findings.md §7–9 (the deleted line), and the ratchet (20/20, widest 120 bytes).

4. Holds — the sweep line adds the derivation the card asked for, names the first-touch remedy (triage-duties.md L67 is the audit-comment shape the row reads) and the round-record count, and delegates the exempt list to the row by pointer. The deleted security#1 line is a true restatement (lanes/security.md L49 already tells the triage seat what to do when security#1 is vacant, and the surviving line above it still points at security.md). The new line is exactly 120 bytes — at the cap, not over.
5. Caveat, carried by the script finding below — because the exempt list lives only in the row, every gap in the row's list becomes a triage duty (「照未定级首触补审计」) on a card the protocol says needs no audit.

scripts/pm/check-half-states.mjs — judged against the card's Change 2–3 and Acceptance, SKILL.md L170 (the audit-exempt classes on main), isTriageRulingComment/TRIAGE_RULING_ANCHORS (L8107–8130), readSignatureLine/stripSignatureLine (the signature-tolerant read), SEEN_LABEL_PAGES (L22550: pm:queue and pm:blocked are both pages the loop consumes, so membership is free and by construction), the H55 gated-fetch pattern it copies, SWEEP_COUNT_KEYS forwarding (L21140), SUMMARY_CLAUSE_ANCHORS order pins (L29149–29151), familyBand/familyRegistryCoverage, the frozen SELF_TEST_BATTERIES roster, and merge-queue-triage.yml L730 (queue-flake-anchor is the anchor label it stamps).

6. Should-fix — the exempt list omits the protocol's own audit-exempt classes. SKILL.md L170: 「两例外:sub-issue 承父卡域、main-red 锚卡,免审计评论」. H74 exempts the card's six labels plus a title prefix, none of which names a sub-issue. A sub-issue filed under a parent with its inherited domain, grade and pm:queue — the protocol-blessed shape — fires H74 every sweep, and the row's text asserts it is "invisible to both sides" and tells triage to audit it in this round, which the protocol says is not owed. For the main-red anchor, triage-duties.md L25 says the first-touch record is owed after the fact, so a firing until it lands is defensible. The sub-issue case is the gap. The list payload carries no free parent signal; the fetch class already in this file (subIssueParentPath, L20929, used by H45) is the read that answers it, or the card's author can rule the sub-issue class into the exempt list by its own spelling. Report-only, overturnable by a seat's sentence (instrument-discipline.md L6), so not a FAIL — but it is a systematic class, not a stray.
7. Should-fix — H74_MAINTAINER_TITLE matches nothing on main. See ③ item 4. As is, the maintainer's hand-filed cards are in the population; a self-test pins a spelling that no card carries.
8. Holds — the record reader. isTriageAuditRecord is the union the card asked for: the older Triage: openings via isTriageRulingComment (signature-tolerant, so the lane self-triage of SKILL.md L171's third exception reads as a record), and the signed shape (first non-blank line parses as a triage#N signature, heading ## Triage to ###### Triage anywhere below, fences stripped so a quoted template is a citation). Pure; no fetch. The pinned asymmetry (a ## Triage heading as the first line reads under the older anchor whatever the signature) is H33's existing reading, pinned rather than silently changed — right.
9. Holds — population and thread states. Issues only, open only, unreadable labels out (not read as unlabelled), pm:dispatched out (H2's subject). Three thread states on the check:react-declaration-parity 是唯一没接进任何 workflow 的源码审计门禁,且无 MANIFEST 时静默 skip 退出 0 —— 它现在永远不可能红 #4690 contract: undefined silent, null UNJUDGED, array judged; the summary pair counts candidates vs probed and names the UNJUDGED row on shortfall. The gather is idempotent and the candidate counter increments once per card. The row text carries no angle bracket and no tracker number (pinned), names both remedies and the report-only boundary, and is not a loud finding (pinned).
10. Holds — wiring. The band entry, the count keys on the enumerated forwarding contract, the clause anchor in rendered order, the battery on the frozen roster with a positive pin under the count (37 cases, pin 32), and emitted-code coverage are each pinned. Lint · PM dispatch-gates and Lint · scoped · tooling self-tests are green on the head.
11. Observation, no fix owed — isTriageRulingComment's /^triage\b/iu anchor also matches a card body or comment whose first non-signature line merely begins with the word "Triage" (e.g. a lane's "Triage requested …" note), which H74 would then read as an audit record. Pre-existing H33 reading, inherited unchanged; worth a tighter positive control if the row ever stops being report-only.

Must-fix: none. Should-fix: items 1, 2, 6, 7.

Implemented-by: claude/project-thread-28iqp6
Reviewed-by: session_01WGufzhd2Ad9ANGTyAMW7pH

VERDICT: PASS

[objectstack-fleet]

domain:skills#3 · os-support-ai · session_01WGufzhd2Ad9ANGTyAMW7pH

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: bea5334987c2f611a21a30dd686d6869de7d46d4
Local-runs: none
Scope: .claude/skills/pm-dispatch/references/execution-duties.md,.claude/skills/pm-dispatch/references/lanes/triage.md,scripts/pm/check-half-states.mjs + .claude/skills/pm-dispatch/SKILL.md (L170–171, L311), .claude/skills/pm-dispatch/references/project-forms.md (L42–43), .claude/skills/pm-dispatch/references/triage-duties.md (L25), .github/workflows/fleet-patrols.yml (L497–503, the platform-checklist-watchdog anchor), .github/workflows/scheduled-full-run-card.yml (L36–38, L95), .github/workflows/test-nightly-tiers.yml (L148–151), scripts/pm/check-skill-line-ratchet.mjs (ceiling and 120-byte rule); in check-half-states.mjs the cited code artefactAuthor, readSignatureLine, h67ReadOrder and its battery (L35617–35636 on main), the H45 parent read (L25028–25040) and rest's error shape (L21018–21019), subIssueParentPath

Round 1, after record 6609708274 on head 197f87e0. Inputs: the delta git diff 197f87e0 bea53349 (one new commit, execution-duties.md 2 lines reworded, check-half-states.mjs +~115), the net diff against origin/main (3 files, +356/−9), the card (no new comment since the os-dev-report), the PR body as it stands on this head, the round-1 commit message (the dev's only account of the round), and the check-runs on bea53349. main moved from 21510bba to 6a4737ab; git diff 21510bba origin/main over the three hits paths, SKILL.md and project-forms.md is empty, so nothing on main touched this surface and the merge base is unchanged. The three hits paths are still the whole diff; no TIER_DEFAULT remainder.

Check-runs on bea53349 at the time of writing: completed non-skipped runs are all success — Governed Surface Queue Guard, Check PR Size, PR-body guards, Live required-set sweep, Platform checklist gate sweep, Release section-coverage sweep, Snapshot the board, Lint · scoped · query-options erasure, Test UI, Dogfood Regression Gate, Auto Label, filter. Still in_progress: Lint · PM dispatch-gates, Lint · scoped · tooling self-tests, Lint · ESLint, Lint · docs & code guards, Lint · CI, release & engine gates, Lint · repo & tooling gates, Lint · scoped · slot lookup & corpus, the four Type Check · lanes, Live half-state sweep, Plan Test Core shards. None has concluded red. The self-test battery count (pin 46) and the ratchet are therefore read from the tree here, with CI's reading still owed.

① Derived judgments

Round 1 after 6609708274. The four round-0 should-fixes and what the delta does with each:

• r0-1, vacant triage → director (execution-duties.md L63). Taken. The line now reads 「缺审计评论当轮敲 Request: triage · #n · first-touch audit,分诊空席敲总监,⛔ 不改报维护者」 — 119 bytes, the project-forms.md L42 idiom in substance. Right. Dropping 「候选」 is harmless: the line sits in 〈候选与批次〉 under the generic knock.
• r0-2, the downgrade reason (execution-duties.md L120–121). Taken by folding: L120 stays deleted and L121 becomes 「effort 按卡难度定,与档位、降档理由写进 Container & model 行与派发令,显式传参,⛔ 不留空」 — 119 bytes. The downgraded tier and its reason are again required on the claim comment's Container & model line (and on the dispatch order, which is new but consistent with L121's existing 「与派发令」). File stays 188/188, widest 120. Right.
• r0-3, SKILL.md L170's audit-exempt classes in H74. Taken for both classes. Sub-issue: h74InheritsFromParent exempts a card whose parent row carries one of the card's own domain:* or priority:* labels, bought through H45's fetch class (subIssueParentPath) with H45's 404 reading; judged under ④. Main-red anchor: H74_MAIN_RED_ANCHOR_TITLE, measured title openings; one in-tree anchor template falls outside it — should-fix under ④.
• r0-4, [maintainer] cards. Taken as the seat directed: read as SKILL.md's 非车队卡 via a new shared isFleetCard (seat-signed body ⇒ fleet; otherwise fleet unless artefactAuthor reads a non-App author; an unreadable author is the fleet's). h74SpeaksAbout now drops non-fleet cards before any thread read. Right.
• H67's switch to isFleetCard — behaviour outside the card. Judged: no reading changes. The replaced closure returned 1 when readSignatureLine(body) !== null, else author && !author.isApp ? 0 : 1; isFleetCard returns true on a signature, else !(author && !author.isApp), and the new leg is isFleetCard ? 1 : 0 — the same truth table on all four inputs (signed body, human author, App author, unreadable author). Pinned twice: H67's own battery on main already pins each leg (⭐ H67 order: a HUMAN account whose body opens with a seat signature is the fleet's, …signature off its first line is still reached first, every App author is the fleet's … and an unreadable author ⛔ is never promoted), which the delta leaves in place, and BATTERY74 adds a cross-pin (the one isFleetCard drives H67's order leg too). Adequate.
• No accept-set or public-surface change, as in round 0; SWEEP_COUNT_KEYS, clause anchor and band are unchanged by the delta; the battery pin rises 32 → 46 (count on the tree ≈ 56). Right.
• Line ratchet. 188/188 and 20/20, widest line 120 bytes, no line over the cap; no raise taken. Right.

② Semver level

Unchanged from round 0: nothing published, skip-changeset, Clause-②: no, Metadata-protocol: none; the delta adds nothing that could alter it. Right.

③ Boundary flags

No round-1 os-dev-report on the card and no new open_questions; the commit message is the dev's declaration. Items judged:

1. The PR body is stale on this head. It still declares, in 〈What changes〉 and 〈Acceptance notes〉, that the vacant-triage → director route is "not restated" with the rejected reason, names the [maintainer] title exemption, and reports the battery as 37/32; the tree now does the opposite on all three. The declaration lines (Clause-②, Metadata-protocol) are still right. Should-fix (④ item 4): bring the deviation list, the exempt-list sentence, the Tests line and the cost note (the parent read is a new per-card purchase) into line with the tree.
2. Parent-read cost not declared. The delta buys one /parent read per card that would otherwise fire (≤ the firing set, bounded by the 33 + 23 population), after both channels are read clean. Not capped, not counted in a summary pair; its failure is loud (UNJUDGED row). Accepted as a reading, flagged for the body (item 1).
3. Round-0 items 1 (one knock per card) and 3 (no subscription, worktree detached) stand as accepted.

④ Design judgment

.claude/skills/pm-dispatch/references/execution-duties.md — against SKILL.md L170–171, L311, project-forms.md L42–43 and the ratchet.

1. Holds. Both round-0 should-fixes are closed in the tree at 119 bytes each, file count unchanged, no restatement elsewhere lost. The folded L121 now carries two obligations (effort; tier + downgrade reason) on one line, which is denser than before but within the file's own style.

.claude/skills/pm-dispatch/references/lanes/triage.md — unchanged in the delta; the round-0 judgment stands (holds; the exempt list is read off the H74 row by pointer, so ④ items below are what that pointer now resolves to).

scripts/pm/check-half-states.mjs — against SKILL.md L170 (the three exemptions), triage-duties.md L25, the anchor-filing workflows, artefactAuthor, H45's parent read, rest's thrown err.status, and H67's battery.

2. Should-fix — the main-red anchor exemption misses an in-tree anchor template. H74_MAIN_RED_ANCHOR_TITLE is ^\s*main[ -]red\b or :\s*red on main\b. The in-tree anchor titles: 4-hourly full run: red on main (CI) and nightly full run: red on main (UI Coverage) (scheduled-full-run-card.yml) and nightly-tiers: red on main (test-nightly-tiers.yml, labels bug,domain:devx,priority:p1) match; check:platform-checklist is red on main (fleet-patrols.yml L498) does not — the colon is followed by platform-checklist is, not red on main. That card is filed by an App (fleet ⇒ in population) with ANCHOR_ROUTING_LABELS: 'pm:queue,tooling' and the identity label platform-checklist-watchdog, so whenever it is open and carries no triage record it fires H74 every sweep while its three sibling anchors are exempt — an inconsistent exemption rather than a wrong one. The clean fix mirrors queue-flake-anchor: add platform-checklist-watchdog (the machine's identity label, single-sourced at L497) to H74_EXEMPT_LABELS, with a pin beside a non-exempt twin; widening the regex to an unanchored \bred on main\b would be the second-best route. Report-only, so not a FAIL.
3. Holds — the sub-issue exemption and its failure path. The read is bought last and only for a card whose thread was READ and found clean (h74NeedsParentRead is false for null/undefined bodies and for a card an audit already answers), so an unconsulted or unreadable thread never buys a parent. Four parent states on the predicate: undefined (not bought) judges without the exemption; null (the documented 404 — rest throws with err.status, L21018–21019, the same reading H45 takes at L25035) fires the ordinary row; a row exempts only when it shares a domain:* or priority:* label with the card (SKILL.md L170's 「承父卡域」; a parent sharing neither inherits nothing and the card fires — right, nothing was inherited); any other failure returns the frozen H74_PARENT_UNREADABLE sentinel and the row fires UNJUDGED, never clean and never silent (check:react-declaration-parity 是唯一没接进任何 workflow 的源码审计门禁,且无 MANIFEST 时静默 skip 退出 0 —— 它现在永远不可能红 #4690). h74InheritsFromParent is pure and refuses null, undefined, the sentinel and an unreadable labels without a crash. The sentinel check sits after the inherits check and before the null-thread check, and the sentinel can only arrive with an array of bodies, so the branch order is consistent. All of it pinned (domain parent, grade parent, stranger parent, 404, sentinel, "never excuses an audited or out-of-scope card", gating, inherit-reader edges). One cost of the shape, carried under ③ item 2: the per-card parent read has no coverage pair in the summary sentence, unlike H45's; the UNJUDGED row makes the shortfall visible per card, so this is an observation, not a fix.
4. Should-fix — the PR body's account. See ③ item 1. The brief judges the tree, and the tree is right; the body contradicts it on three points, and a reviewer reading only the body would re-raise r0-1 and r0-4.
5. Holds — isFleetCard as the [maintainer] reading. It is execution-duties.md L55's 非车队卡 verbatim (作者非 Bot 且首行非席位签名), shared with H67 rather than copied, exported, pure; a seat-operated human account filing with a signature (the card pm-dispatch(triage audit): a queue card with labels but no triage audit comment is invisible to both sides — lanes knock Request: triage, and the triage sweep derives the missing audits every round #29682 shape) stays in the population, a human with an unsigned body is out, an unreadable author is never promoted to a human's. Pinned beside each twin.
6. Holds — row text. Still no angle bracket and no tracker number (pinned); the exempt sentence now names the three classes as the tree reads them; the sentinel sentence names the parent read and tells the reader what to do by hand.
7. Holds — battery and roster. Pin 46 under a count of about 56 on the tree; the two [maintainer] pins were replaced, not silently dropped; the frozen roster is unchanged in shape.

Must-fix: none. Should-fix: items 2 and 4.

Implemented-by: claude/project-thread-28iqp6
Reviewed-by: session_01WGufzhd2Ad9ANGTyAMW7pH

VERDICT: PASS

[objectstack-fleet]

domain:skills#3 · os-support-ai · session_01WGufzhd2Ad9ANGTyAMW7pH

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 1281c79aa201ef093b460d7d8e304a3e44c9e61e
Local-runs: none
Scope: .claude/skills/pm-dispatch/references/execution-duties.md,.claude/skills/pm-dispatch/references/lanes/triage.md,scripts/pm/check-half-states.mjs + .github/workflows/fleet-patrols.yml (L447–448, L497–503), .github/workflows/merge-queue-triage.yml (L730, L808, L948), .github/workflows/scheduled-full-run-card.yml (L36–59) with scripts/ci/scheduled-full-run-card.mjs (L109–157, L352–353), .github/workflows/test-nightly-tiers.yml (L148–151) with scripts/ci/nightly-tiers-card.mjs (L44, L191, L228), the other issue-filing workflows read for their create labels (cross-repo-issue-closer, docs-drift-check, pr-automation, publish-smoke, shard-timings-refresh, ui-test-timings-refresh), scripts/pm/check-skill-line-ratchet.mjs (ceiling and 120-byte rule)

Round 2, after record 6610054068 on head bea53349. Inputs: the delta git diff bea53349 1281c79a (one new commit, check-half-states.mjs only: +18/−6, one label on H74_EXEMPT_LABELS, the exempt sentence of the row, the loop pin, the list pin, three new pins), the net diff against origin/main (3 files, +374/−9), the card (no new comment since the os-dev-report), the PR body as refreshed through the relay on this head, the round-2 commit message, and the check-runs on 1281c79a. origin/main is still 6a4737ab; the merge base is still 21510bba and the diff of main over the three hits paths, SKILL.md, project-forms.md and fleet-patrols.yml since it is empty. The three hits paths are the whole diff; no TIER_DEFAULT remainder. The two prose files are untouched by the delta (188/188 and 20/20, widest line 120 bytes).

Check-runs on 1281c79a at the time of writing: completed non-skipped runs are all success — Governed Surface Queue Guard, Check PR Size, PR-body guards, Live required-set sweep, Platform checklist gate sweep, Release section-coverage sweep, Snapshot the board, Auto Label. Still in_progress: Lint · PM dispatch-gates, Lint · scoped · tooling self-tests, Lint · ESLint, Lint · docs & code guards, Lint · CI, release & engine gates, Lint · repo & tooling gates, Lint · scoped · query-options erasure, Lint · scoped · slot lookup & corpus, the four Type Check · lanes, Live half-state sweep, filter. None has concluded red. The battery (pin 46, about 60 cases on the tree) and the ratchet are read from the tree here, with CI's reading still owed.

① Derived judgments

Round 2 after 6610054068. The two round-1 should-fixes and what this head does with each:

• r1-1, the platform-checklist watchdog anchor (check-half-states.mjs). Taken by the route the record named first: platform-checklist-watchdog is on H74_EXEMPT_LABELS, read the way queue-flake-anchor is — the machine's identity label, single-sourced at fleet-patrols.yml L497 and never graded off (L447–448 say so in the workflow's own words), rather than a widening of the title regex. The row's exempt sentence names it. Pinned four ways: in the exempt loop beside the non-exempt tooling twin; the list pin now enumerates seven labels; the anchor as fleet-patrols.yml files it (App author, pm:queue,tooling, identity label) is silent; the same card without the identity label fires, with a third pin showing why (H74_MAIN_RED_ANCHOR_TITLE does not open that title). Right.
• The dev's census of card-filing templates. Checked against the tree and holds. Of the ten .github/workflows/** and scripts/ci/** templates that create issues, only fleet-patrols.yml applies pm:queue on create (L503); none applies pm:blocked on create; merge-queue-triage.yml files under queue-flake-anchor (L730, L948), already exempt; test-nightly-tiers.yml files bug,domain:devx,priority:p1 (L151, nightly-tiers-card.mjs L228) and the scheduled full-run card applies priority/lane/type on create only (scheduled-full-run-card.yml L48), with a refresh that may move an unassigned pm:blocked card back to pm:queue (scheduled-full-run-card.mjs L352–353) — both of those titles open : red on main, which the regex reads; the remaining six file no pm:* state at all and are out of the population until triage labels them, at which point the audit comment is owed by rule. So after this head every machine-filed card that enters the population on create is exempt by its identity label, and the title regex covers the two scheduled-run cards that can enter it later. Right.
• r1-2, the PR body. Refreshed through the relay and now matches the tree on every point the round-1 record named: the lane line's vacant-triage → director route is described as spelled (with the correct reading of project-forms.md's main-red-only routing); the downgrade-reason fold into the effort line is described; the only remaining declared deviation is one knock per card; the exempt list names the three SKILL.md classes, the card's six labels and platform-checklist-watchdog; the Tests line reads 60/46 and 5222 cases (the pin on the head is 46; the battery on the tree counts about 60 — CI's reading is owed); the cost note names the parent read as a second per-card purchase bought only after both channels are clean; the Verification section names the three heads and what was re-run on each. Right.
• No accept-set or public-surface change, unchanged from rounds 0 and 1. SWEEP_COUNT_KEYS, clause anchors, band and battery pin are unchanged by the delta.
• Line ratchet. Untouched by the delta; 188/188 and 20/20, widest 120 bytes. Right.

② Semver level

Unchanged: nothing published, skip-changeset, Clause-②: no, Metadata-protocol: none; the delta is one label string, one sentence and four pins in a PM script. Right.

③ Boundary flags

No round-2 os-dev-report on the card and no new open_questions; the commit message and the refreshed PR body are the dev's declarations.

1. Census claim. Verified as above; accepted.
2. Round-0 and round-1 items (one knock per card; no subscription; parent-read cost, now declared on the body) stand as accepted.
3. Nothing escalated.

④ Design judgment

.claude/skills/pm-dispatch/references/execution-duties.md and lanes/triage.md — unchanged in the delta; the round-1 judgment stands (holds).

scripts/pm/check-half-states.mjs — against fleet-patrols.yml L447–448 and L497–503, the other card-filing templates, and the H74 battery.

1. Holds — the exemption key. The identity label is the right key for the reason the workflow itself gives: it is applied on create beside the routing labels and is never rewritten on a refresh, whereas pm:queue and tooling are triage-state labels a first touch takes off. Keying on the title would have tied the exemption to one template's wording; keying on the label follows queue-flake-anchor's precedent exactly. Consistency restored: all four in-tree anchor shapes are now exempt by one of the two readings.
2. Holds — the pins. The loop pin and the list pin are the generic coverage; the three WATCHDOG74 pins are the specific one, and the control (same card without the identity label fires) is what makes the exemption falsifiable rather than a silent widening. The regex pin documents the gap the label closes.
3. Holds — row text. The exempt sentence grows by one carrier; the no-angle-bracket and no-tracker-number pins still hold on the tree (the added text is a plain label name).
4. Observation, no fix owed — the census is pinned in a comment, not in code; a future workflow that files a card as pm:queue under a new identity label would re-open the gap silently. That is the same exposure every label-keyed exemption in this file carries, and the row is report-only, so a one-line note is enough.

Must-fix: none. Should-fix: none.

Implemented-by: claude/project-thread-28iqp6
Reviewed-by: session_01WGufzhd2Ad9ANGTyAMW7pH

VERDICT: PASS

[objectstack-fleet]

domain:skills#3 · os-support-ai · session_01WGufzhd2Ad9ANGTyAMW7pH

维护者速读

• 改了什么：排队卡如果有标签、却没有分诊审计评论，车道席当轮用现有门铃键 Request: triage · #n · first-touch audit 敲分诊信箱（分诊空席时敲总监），不再改报维护者。分诊每轮 sweep 推导出这类卡，补做首触审计并报数。check-half-states.mjs 新增只报告、不拦截的 H74 行，列出同一批卡，并豁免 SKILL.md 里三类免审计卡（非车队卡、main-red 锚卡、承父卡域的子卡）和机器锚卡。
• 为什么改：你问「他在等，为什么没有用邮箱提醒你，是否应该立卡改进技能」。立卡时域、级和 pm:queue 一次挂齐，分诊按「缺标签」找卡就看不到这类卡；车道读到「无分诊审计评论不得认领」就停下来等。两边互相等，谁都没被提醒。
• 风险与回滚：两份规则文字各净零行（新增的行靠删掉重复行抵掉，不升上限）。H74 只报告，不写标签、不拦落地，每轮对少量卡多读一次评论页和父卡。回滚即 revert 本 PR。
• 先看：execution-duties.md 第 63、121 行，lanes/triage.md 第 16 行，check-half-states.mjs H74 节。
• 两分钟验证：node scripts/pm/check-half-states.mjs --self-test 显示 5222 cases pass，H74 battery 60/46。
• 需要你做的：无。Tier S，席位按复审 PASS 落地。

席位意见：按你的原话落地，三轮复审 PASS，同意落地。

席位核对 — ACCEPT · domain:skills#3 · head 1281c79aa201ef093b460d7d8e304a3e44c9e61e

• Shape: Fixes #29682; draft, base main, relay-opened, labels documentation, size/s, skip-changeset, no assignees. 3 files: references/execution-duties.md, references/lanes/triage.md, scripts/pm/check-half-states.mjs.
• Premise measured: the non-candidate rule sits at SKILL.md L171 (the card said execution-duties.md; the order corrected it); the request:triage key existed; no derivation of audit-less queue cards on main.
• Gates (check-runs at this head): no failure; several lanes still running at ACCEPT, so the queue waits on them. A red Lint & Repo Gates on the superseded head bea5334 was a lane cancelled by the newer push, not a finding. Dev-side: self-test 5222 pass, check:pm-half-states, check:pm-skill-ratchet, check:pm-skill-id-lint, eslint exit 0.
• Contract review: r0 6609708274 (197f87e, PASS, four should-fixes), r1 6610054068 (bea5334, PASS, two should-fixes), r2 6610275387 (1281c79, PASS, none open); all Served-tier: CONTRACT_REVIEW_TIER, Local-runs: none.
• Declarations: Clause-②: no, Metadata-protocol: none; nothing publishes, so skip-changeset.
• Ceilings: none raised; both rules files net 0 lines at their ceilings, widest line 120 bytes.
• Accepted deviations: one knock per card (the request:triage reader takes one #n); the rule placed in execution-duties.md beside the generic knock, not at SKILL.md L171 (reviewer judged it holds); H67 now shares isFleetCard with an identical truth table, pinned. The seat refreshed the PR body through the relay to match the final tree.
• Out of scope: check-release-section-coverage --strict red identically on main (a release page), not touched here.
• Landing: check-governed-merges --pr 29940: Tier S (.claude/** + scripts/pm/** under Tier S surfaces). The seat readies it and arms auto-merge on the at-tier PASS.