docs(pm-dispatch): whole-text restructuring PR-2 — lane anchor deletion, Routines connector fact, sanitizer-row consolidation

[claude]

Fixes#11086

Final PR of the whole-text restructuring round adopted by the maintainer on
2026-08-23 (「接受你的重构提案」). PR-1 (#11361) is MERGED; this is PR-2, the
"excluded" list from that PR's dispatch. References-only — SKILL.md,
os-dev.md, state-machine.md, contract-review.md and dispatch-runbook.md
are not touched.

Governed surface (.claude/**): stays draft, human merge only. No seat
flips it ready, enqueues it, or arms auto-merge.

What changed

(a) Seven lane files — delete the sentence PR-1 hoisted. The patrol-anchor
rule was carried verbatim by all seven references/lanes/*.md. Verified before
deleting rather than assumed: the seven copies hash to one distinct value,
and against the SKILL.md copy the only difference is the two-byte list-bullet
marker (- prefix; 211 vs 209 bytes, sentence text byte-identical). The hoist
sits at the head of 执行座位职责, which every executing seat reads, so the
rule keeps a home. Pure deletion, no pointer added.

(b) seat-post-protocol.md — connector mechanism words replaced by the
measured fact. The first bullet of 座位 Routine 创建细则 said the maintainer
creates the Routine "and ticks the GitHub connector". Measured 2026-08-23:
credentials ride the Routine's attached repo sources, and the Routines UI has
no GitHub connector entry at all. The bullet now says that, matching the wording
PR-1 already landed in SKILL.md. The trap warning is kept, with its
mechanism restated: a fresh-session Routine built in-session carries no repo
sources, so the fired session gets no GitHub tools — still a silent zero-output
trap, still not an escape hatch. The smoke-test bullet and the model-pinning
notes are untouched. File stays at 101 lines.

(c) platform-readings.md — three accreted sanitizer rows consolidated.
The write-side deletion row, the markup-declaration row and the comment-
truncation row are now one author rule plus one measured-behaviour row per
surface (issue body / comment). Every date is preserved and every still-load-
bearing boundary note is preserved, including the sister-repo five-shape probe
boundary and the "write side always defends against the worst-case truncation"
posture. Tombstones elsewhere in the file (已死假说 / 已推翻的候选机理) are
out of scope and untouched — confirmed by diffing: they do not appear in the
diff at all.

(d) Ratchet. All eight touched ceilings lowered to their landed counts,
headroom 0, each with a provenance comment naming the round and the 2026-08-23
ruling. Lowering only. cli.md pays two lines because it was carrying the
map's last line of headroom.

Provenance proof

Produced programmatically over the nine touched documentation files, comparing
origin/main against the worktree. Full script output is the basis for every
number below.

Line counts (corpus 506 to 498, net minus 8)

file	before	after	ceiling
lanes/cli.md	36	35	37 to 35
lanes/devx.md	38	37	38 to 37
lanes/engine.md	41	40	41 to 40
lanes/hotcrm.md	45	44	45 to 44
lanes/services.md	31	30	31 to 30
lanes/skills.md	36	35	36 to 35
lanes/spec.md	44	43	44 to 43
seat-post-protocol.md	101	101	101 (unchanged)
platform-readings.md	134	133	134 to 133

Dates — 27 to 28 occurrences, 13 distinct both sides, set of distinct dates
unchanged. The single delta is 2026-08-23, 4 to 5 occurrences: the added one
is the measurement date carried into the (b) connector fix, which is the one
sanctioned wording change. No date was lost, in any file.

Quotes — 88 to 87 occurrences, 83 to 82 distinct. Exactly one removal, no
additions: the parenthetical naming a superseded reading of whether fenced
blocks survive the write-side sanitizer, deleted under Q2 = A because the
surviving rule states the current truth in the imperative and the measurement
date stays with it. Every other CJK-bracket quote in the corpus is byte-
identical across the change, including the two that name the byte sequences in
words rather than literally.

Nothing else lost. Nineteen load-bearing elements of the three consolidated
rows were probed individually on disk after the splice — each present exactly
once: the "stored bytes deleted, web renders the same" framing; the negative-
lookbehind-plus-character-class shape note; the bare less-than-plus-exclamation
survival; "deletes by tag shape, not by angle bracket"; isolated angle brackets
surviving in inline code; fences not protecting tag-shaped tokens; non-tag-
shaped regexes surviving in fences; the "do not infer comments are exempt"
guard; bare identifiers surviving; write returns 200 with loss visible only on
read-back; read-back not exempting comments; marker-only read-back not counting
as verification; read back the tail; a literal-text marker saving only the
marker; the fuse being ordinary TypeScript generic shapes; the sister-repo
five-shape probe; the worst-case posture; the "first named HTML element" start
point; and the same mechanism truncating the recording card's own body.

PM mechanism assumptions — one held, one falsified

• Held: the seven lane copies really are byte-identical to each other and
  verbatim-equivalent to the hoisted sentence (evidence above).
• Falsified, honestly reported: the dispatch expected the lane bullet to be
  a two-line bullet (so roughly minus 12 lines across seven files) and the
  sanitizer consolidation to net minus 4 to minus 8 lines. Measured: the
  lane bullet is one physical line per file (minus 7 total), and the three
  sanitizer rows occupy only four physical lines to begin with — very long
  ones — so an honest consolidation into the requested three entries nets
  minus 1. This is the same line-count-versus-volume gap PR-1 reported: the
  bulk sits on few, very long physical lines. No re-wrapping was used to
  manufacture a bigger number, and no content was cut to reach one. Corpus net
  is minus 8 lines; the value is one rule with one home, not the line count.

Verification

All at final commit 077bf957 (= PR head). Union derived with
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, no
hand-fed paths — the script took its own change set (10 paths vs merge base
9337cd810, committed 10 / working tree 0 / untracked 0) and matched 12
families, all run green under os-verify-lock.sh. Gate-printed verdict lines,
not bare shell status:

• check-skill-line-ratchet: ... lanes/cli.md is 35 lines (ceiling 35; headroom 0)
  and the same headroom-0 line for every other covered file, incl.
  platform-readings.md is 133 lines (ceiling 133) and
  seat-post-protocol.md is 101 lines (ceiling 101); self-test 20 cases pass
• check-skill-id-lint: 21 file(s) clean; self-test 14 cases pass
• check-skill-frame-sync: 4 copies of the decision frame are structurally isomorphic across 3 files — the pinned four-axis block is untouched
• check-nul-bytes: OK (scanned 6386 text file(s) ... no raw ASCII control bytes); self-test 75 assertions
• doc authoring guard: 389 files clean;
  check:doc-formula-expressions: 22 record-scoped formula example(s) ... judged clean (after building the @objectstack/lint dependency closure)
• check:entry-guard: 138 scripts/ file(s); check:parse-guard: 137 scripts/ file(s); check:pnpm-filter-targets: 120/148 ... resolve;
  check-cross-package-test-inputs: 104 self-test cases; check-ci-filter-parity
• check-governed-merges --self-test: 129 assertions; --test over this PR's
  paths answers GOVERNED (exit 3 is the verdict, not a failure) — three of
  four paths hit the register under .claude/**

skip-changeset: this PR publishes nothing (agent instruction tree plus one PM
gate script), so no changeset — the label is applied via the additive endpoint
and read back.

No ablation: documentation restructuring has no runtime behaviour to mutate.
The reverse-verification analogue is the byte-level date and quote inventory
above, produced by comparing origin/main against the worktree
programmatically rather than by eye.

---

Generated by Claude Code