[finding] The contract-review gate is being hung on ONE carrier — 34 of 36 lone clears had a PR that never carried it, which makes a strip undetectable

[claude]

Filed unassigned from the #11881 implementation (PR #12407), which measured it as a side effect of building the gate-removal patrol. Not repaired there — out of that card's ruled scope.

The rule

references/contract-review.md, carrying the maintainer ruling of 2026-08-22 (「简化一点是否可以直接挂 PR 侧」「两边都挂好」):

PR 与卡双载体同笔挂 …… PR 一存在即挂,报告先于 PR 到达则先挂卡侧、ACCEPT 时补齐 PR 侧

Card-side-first is explicitly legal while no PR exists; the PR side is to be filled in at ACCEPT.

The measurement

Corpus: GET /repos/objectstack-ai/objectstack/issues/events, 160 pages, 16,000 events, 2026-08-22T15:35:07Z … 2026-08-26T01:26:58Z (3.41 days) — 415 needs:contract-review label events, 206 removals.

Of the 36 removals with no same-stroke sibling on the other carrier, 34 were gates that only ever had ONE carrier — the delivering PR never carried the label at any point in its history. Spot-verified per PR against each PR's own event list, not inferred from the aggregate:

• card [finding] driver-sql's SQLite json codec is not round-trip faithful for a string whose content is valid JSON — '123' reads back as a number, and Postgres does not agree #12380 gated 00:17:19Z, cleared 01:15:20Z — its PR fix(driver-sql): make the SQLite Field.json codec injective — one encoding across all three dialects #12401 has zero needs:contract-review events, ever.
• card [finding] docs vs driver disagree on whether lookup columns get a real FOREIGN KEY — and the driver branch keys on reference_to, not reference #11567 gated 15:29:04Z, cleared 23:30:45Z — its PR fix(driver-sql): retire the lookup FOREIGN KEY branch gated on the rejected alias reference_to, and refuse the key #12287 has zero, ever.

Both PRs existed well before the card-side clear, so the 「ACCEPT 时补齐 PR 侧」 step had come and gone.

Why it costs something

The second carrier is not decoration — it is the only machine-readable evidence the protocol leaves that a gate was cleared rather than stripped. 「PASS 双载体同笔清标」 makes a legitimate clear two removals seconds apart, one per carrier; a strip leaves one. With a single carrier:

• H31 (check-half-states) cannot fire — it compares two carriers and there is only one;
• H35, the patrol row added by PR feat(pm): H35 — flag a gate-label removal with no dual-carrier clear behind it #12407, must classify the removal UNJUDGEABLE rather than clean or dirty;
• the remaining evidence is a review verdict written as free prose, which has no canonical machine-readable form (measured on the same corpus: a strict Contract review: PASS marker matched 5 of 35 removals, an "any PASS token" reading matched 26 — a check that can barely fail).

So on the majority shape of today's board, 「被剥」 and 「已复审清标」 remain indistinguishable, and the failure direction is toward release.

Two candidate repairs, neither taken here

1. Hang the PR carrier, as the standing ruling already requires — restores the structural evidence with no new mechanism and no new rule.
2. Give the verdict a canonical marker (a fixed first-line spelling the way Claim: is fixed), making the prose channel machine-readable.

Choosing between them is a protocol decision, not an execution one. ⛔ No patrol predicate should be widened to absorb the prose variants — that is the tolerant-consumer direction, and PR #12407's header records the measurement showing where it ends up.

Dedupe

Searched before filing, REST listing rather than semantic search: all 353 open cards enumerated and body-scanned. PR 一存在即挂 / 两边都挂好 / 双载体 / dual-carrier matched 0. Positive control: contract-review matched 18, needs:contract-review 11 — all cards that merely CARRY the label, none about the carrier discipline. Nearest neighbours (#12181, #12132, #12055, #12007) read and unrelated.

Refs: #11881 · PR #12407 · #11470

---

Generated by Claude Code

---

Generated by Claude Code