A reader for the clause-② gate: assert the dual carrier, and make a missing declaration loud by claude[bot] · Pull Request #13944 · objectstack-ai/objectstack

claude · 2026-08-31T18:08:20Z

Family dispatch, code half only. One new checker in the existing check:pm-* gate family gives the clause-② enqueue gate a reader a seat can point at one pair: the dual carrier is asserted by mechanism, and a limb nobody can read is reported as a missing reading rather than passing for a decision.

⚠️ Premise correction — read this first

#13922 says the dual-carrier rule "has no enforcement at all" and that "there is no check anywhere that a needs:contract-review on one carrier implies it on the other". That is not true, and the correction shaped this PR.

h31ContractReviewCarrierSplit in scripts/pm/check-half-states.mjs is exactly that check. It compares both carriers, in both directions, names the offending PR, and it has a standing caller — .github/workflows/half-state-patrol.yml, four times a day. Measured on this branch: the patrol's last scheduled run before the card was filed was 2026-08-31T13:42:41Z, conclusion success.

Building a second carrier comparison as though H31 did not exist would have produced two predicates that can disagree about the same pair. So this PR imports H31's label constant and H31's delivery relation instead of restating either, and closes only the parts H31 genuinely cannot reach. Those parts are real, and all three were re-measured on the live board today:

Agreement on ABSENCE is H31's silent case, by construction. It fires on a split; a pair carrying the gate on neither carrier is, to it, clean. That is precisely the "all three limbs silent at once" shape The clause-② gate has three limbs and all three were silent on PR #13910 at once — the dual-carrier label rule has no enforcement, and 4 of 6 measured pairs are out of sync #13922 measured on PR fix(rest): a data engine that cannot be RESOLVED no longer answers 403 FORBIDDEN (#13476) #13910 / card [finding] after the #13279 repair, an UNRESOLVABLE data engine still answers 403 FORBIDDEN — the last surviving GRANTS-LOST disguise at the package door #13476.
Nothing read limb ② at all. Grep over scripts/ and .github/workflows/ finds the Clause-② token in a label description and in prose — never in a predicate. The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914 measured the consequence: 2 of 3 cards in one review round carried the declaration as prose or in the PR body, and a card with no declaration is indistinguishable from a card that declared no.
H31's delivery channel trims. Its report is one row family among ~38 rendered into one pinned anchor issue. Measured on the 13:42Z run body: 231 findings, 74 rendered, "157 further row(s) omitted to fit GitHub's issue-body limit." A gate row competes for space with board-hygiene rows, and the anchor then reads clean on the gate.

premise_still_valid is therefore partly false and the surviving defect is narrower and sharper than the card states. It is stated in full in the new file's header so the next reader is not told the original story.

What landed

scripts/pm/check-clause2-carriers.mjs — answers one question and prints only its own rows, so nothing it finds can be crowded out by another mechanism's inventory.

row	what it says	member
C1	the two carriers of one pair disagree — both directions, each with its own consequence	#13922 · #12409
C2	the declaration limb has NO READING: `absent`, `misplaced` (fixed spelling on the thread but not in the claim carrier), or `malformed`	#13914 remedy 2
C3	a declared `Clause-②: yes` with the gate on neither carrier — the fail-open a carrier comparison is structurally blind to	#13922

Modes, and why each exit code is what it is:

default sweep — report-only, exit 0 on a complete sweep whatever it found; 2 when any pair was UNJUDGED (an unread carrier is not a bare carrier, an unread thread is not an absent declaration); 3 PREREQUISITE NOT MET, the constant imported from check-half-states.mjs so the family has one code for it.
--pair PR-NUMBER — a predicate about that pair, so it may answer adversely where the sweep may not: exit 4, deliberately not 3, so a seat reading the status can never turn a refusal into a clearance. A pre-arm tool, ⛔ not a merge gate.
--self-test — offline, 64 cases. This is what lint.yml runs.

Single-sourced, not restated: CONTRACT_REVIEW_LABEL, prDeliversCard, labelNames, CLAIM_COMMENT_MARKER, governingClaim, proxyRearmPlan and EXIT_PREREQUISITE_NOT_MET all come from check-half-states.mjs. This checker and H31 cannot come to disagree about which PR delivers which card.

It writes nothing, ever. Hanging or clearing a review gate from a checker would be issuing the review verdict — 自查放行. Same call H31 makes, for the same reason.

Measured, on the live board

The sweep, run on this branch's head against objectstack-ai/objectstack at 2026-08-31T18:0xZ: 25 card/PR pairs derived from 27 open PRs, 25 findings, 0 UNJUDGED (exit 0).

1 × C1 — a live desync: PR fix(metadata-protocol): serve runtime-authored view containers to org/environment-scoped reads #13929 carries needs:contract-review, card rest/meta: getViewsByObject / GET /meta/view?object= omits a runtime-authored view CONTAINER — #7163/#7736 expansion fix does not cover this path #13407 does not. Verified independently by a second read of both label sets.
2 × C3 — live fail-opens: card [spec] FieldSchema accepts a lookup/master_detail with no reference target, though its own TSDoc calls the key required #13632 (PR fix(spec): require a non-empty reference on lookup/master_detail fields #13927) and card serve 面保证 stored metadata 规范拼写：reference_to → reference 归一化 + spec 裁定 reference_field/referenceField 协议归属（ui#6837 半 1） #13700 (PR Add field-reference-to-alias conversion so stored reference_to serves as reference #13847) each declare Clause-②: yes in the claim comment while neither carrier carries the gate label. PR fix(spec): require a non-empty reference on lookup/master_detail fields #13927 is not draft. Both claims say in their own words that the label was to be hung on both carriers in the same stroke as PR creation.
22 × C2 — 20 NO READING and 2 MISPLACED. The two misplaced ones quote what was there instead, e.g. card [finding] after the #13279 repair, an UNRESOLVABLE data engine still answers 403 FORBIDDEN — the last surviving GRANTS-LOST disguise at the package door #13476: ### Clause ② — 'yes', and it is a FOURTH class, and card A PERMISSION_DENIED refusal never reaches the dispatcher's throw-transparent exit, so it still drops the author's userMessage — a second door, behind #7898's trigger file #13623: ### Clause ② — declared 'yes' conservatively. A PERMISSION_DENIED refusal never reaches the dispatcher's throw-transparent exit, so it still drops the author's userMessage — a second door, behind #7898's trigger file #13623 is one of The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914's own two measured misses, re-observed by mechanism.

⛔ None of these was repaired here. The deliverable is the mechanism; the rows are the PM round's input.

Zone-2 assumptions, tested rather than inherited:

Pairing is machine-derivable — holds, 7 of 7. Every pair in the two cards' tables carries a closing or Part of keyword in the PR body naming its card, and every branch name carries the fallback too. Both channels agree on all seven.
[finding] Both recorded PR-label READ legs came back label-blind in one run — pull_request_read get returned no labels field, and the web-payload grep spelling that works on issues reads zero on a labeled PR #12902's claim that PR-side labels cannot be written — not relied on either way. This PR writes no label from any channel, so the question does not arise for it. What was measured instead is the read side: repo-scoped REST reads and writes both answer 200 from this container, and the sweep read 27 PRs and 25 threads over it.
Whether the sync check belongs in check-half-states.mjs H31/H35 — the stated condition did not hold, and the answer is standalone anyway. Open PR fix(pm): mask the fixture builders only a self-test can reach #13930 changes scripts/pm/dispatch-gates.mjs, not check-half-states.mjs, so H31/H35 were not held. Standalone is still right, because the trimming measurement above says a new row family added to that report is a row family that can be omitted before a reader sees it. H31/H35 are untouched; dispatch-gates.mjs is untouched.

Two things recorded rather than acted on

1. The two directions of a split are not ranked, because the two standing sources rank them oppositely. H31's header calls the card-bare direction "the more dangerous half" (an ungated card enqueues past a live gate). #13922 calls the PR-bare direction the fail-open ("it is the carrier the enqueue gate reads"). Both are sound about their own consumer. This checker states each direction's consequence and ranks neither — picking one would print an adjudication as a derivation. Which carrier the enqueue gate actually reads is a protocol question for the maintainer.

2. What this implies for .claude/skills/pm-dispatch/references/contract-review.md — recorded here, no edit landed. That file is held by pending human-merge PR #13746 and is outside this dispatch's surface. Two of its sentences are affected:

The 重挂前先查裁决 recovery rule reads "label absent" as probably cleared. The clause-② gate has three limbs and all three were silent on PR #13910 at once — the dual-carrier label rule has no enforcement, and 4 of 6 measured pairs are out of sync #13922 falsified its premise by measurement. --pair now answers that question directly for one pair instead of inferring it, so the recovery rule could point at the checker rather than at an inference.
The PR 与卡双载体同笔挂 rule now has a mechanical reader, which it did not when the text was written. Naming check-clause2-carriers.mjs --pair beside it would let the prose stop being the only executor.

Neither sentence is edited by this PR.

Scope, held

[finding] The contract-review gate is being hung on ONE carrier — 34 of 36 lone clears had a PR that never carried it, which makes a strip undetectable #12409 is taken on its mechanically-forced half only — enforcing the standing 2026-08-22 ruling 「两边都挂好」, which the card's own four-facet analysis marked as needing no new ruling to start. The un-ruled half stays open for the maintainer: a canonical machine-readable spelling for the review VERDICT (repair 2 — the Contract review: PASS marker that matched 5 of 35 removals strictly and 26 loosely). This PR gives the declaration a reader; it gives the verdict none, deliberately. That residue is named in the wrap-up comment on [finding] The contract-review gate is being hung on ONE carrier — 34 of 36 lone clears had a PR that never carried it, which makes a strip undetectable #12409.
The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914 is Part of, remedy 2 only. The claim-comment template in .claude/skills/pm-dispatch/SKILL.md (remedy 1) is not touched and the card stays open for it.
⛔ No patrol predicate widened to absorb prose. The fixed spelling stays exactly Clause-②: yes / Clause-②: no. Decoration around the line is tolerated the way H4 tolerates it; reasoning after the value token is accepted because that is the shape The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914 records as its control (os lint never surfaces ADR-0087 conversion notices — it normalizes with no onConversionNotice sink, the #3782 parity gap os build was in #12297 "carries Clause-②: yes with reasoning"). A reader that rejected it would have graded the card's own control as the defect — and it did, on four real claims, before that case was written. Clause-②: YES, Clause-②: nope, Clause-②: probably not, an empty value and the prose form Clause ②: yes all stay unread, and are quoted back in the row so the residue is actionable.
⛔ No carrier collapse, no branch-protection or required-set change, no new merge gate: the lint.yml step runs the self-test only, the same split as check:pm-half-states and check:pm-governed-merges beside it.
Escalation clause not triggered: no new protocol spelling and no new gate category were invented. Every row asserts a rule that already stands.

Verification

Derived on this PR's own final head — node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, at this PR's final head 850a759 (4 paths vs merge base 0f63965ea; the union is byte-identical to the one derived at d06df85, and it was re-run in full on 850a759 with the same result): 33 families + 2 convention-triggered obligations = 35 commands, all run serially under scripts/pm/os-verify-lock.sh.

32 of 35 exit 0. Including both convention obligations an added gate script incurs — node scripts/pm/bare-root-worklist.mjs --self-test and pnpm check:pm-dispatch-gates — plus check:self-test-wired, check:entry-guard, check:parse-guard, check:watch-hint-literal, check:pm-label-desc-cap and check:required-contexts.

The other 3 are NOT MEASURED, not red — each says so in its own verdict text, and each needs a full package build this diff cannot affect (it touches no package source):

gate	exit	its own words
`check-test-completeness.mjs`	3	"PREREQUISITE NOT MET … the local reading for this gate is NOT MEASURED. ⛔ It is not a red, and there is nothing here to fix."
`check:dual-build-cjs-loads`	3	"PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/. Run `pnpm build` first. ⛔ This is NOT a pass: nothing was measured."
`check:type-check-debt`	1	its `--self-test` and coverage read pass; `--re-measure` refuses without the built closure, because measuring there "would silently measure a DIFFERENT WORLD"

Also run, because this checker imports it: pnpm check:pm-half-states — 1826 cases pass, so the imported surface is intact.

Every exit code was exercised live, in the direction predicted before the run:

run	exit	reading
`--pair 13944` (this PR)	0	its three pairs — #13922, #12409, #13914 — all declare `Clause-②: no` in the fixed spelling and both carriers agree. Three green lines, the clean control.
`--pair 13847`	4	the C3 row on card #13700. A verdict about that pair, not about the environment.
`--pair 13944`, earlier attempt	3	a transient `HTTP 502` on the PR listing, on a route where `curl` returned 200 throughout. It refused with "0 pair(s) had been read … NOT a reading of a clean board" rather than reporting green — which is why the listing now carries the same single retry the per-pair reads do (third commit).

Live evidence beyond the self-test: the sweep output above, plus an independent second read of the label sets on #13929/#13407, #13927/#13632 and #13847/#13700 confirming every C1 and C3 row.

Authored in session session_01Msg17tAHJ3jVTYFgHydCm2 (durable copy of the attribution, because a body edit normalises the footer's session URL away).

No changeset: this diff publishes nothing — scripts/pm/**, a workflow, and a script registration in the private root manifest. skip-changeset applies and is attached.

Generated by Claude Code

`needs:contract-review` is a dual-carrier gate by the maintainer's ruling of 2026-08-22 (「两边都挂好」), and its content limb is a fixed machine spelling in the card's claim comment. Neither had a reader that a seat could point at one pair: H31 in `check-half-states.mjs` compares the two carriers, but it is silent when the gate is missing from BOTH (agreement on absence is its silent case) and it reports through a patrol body that trims — 231 findings, 74 rendered on the 2026-08-31T13:42Z run. The declaration limb had no reader at all: grep over `scripts/` and `.github/workflows/` finds the token only in a label description and in prose. `scripts/pm/check-clause2-carriers.mjs` answers exactly that one question and prints only its own rows: C1 the two carriers of one pair disagree. Both directions, each with its own consequence, neither ranked — H31 and #13922 rank them oppositely and this file records the disagreement rather than adjudicating it. C2 the declaration limb has NO READING: absent, misplaced (the fixed spelling on the thread but not in the claim carrier), or malformed. A missing reading is never collapsed into a declared `no`. C3 a declared `yes` with the gate on NEITHER carrier — the fail-open a carrier comparison is structurally blind to. The label constant, the `prDeliversCard` delivery relation and the shared PREREQUISITE-NOT-MET exit code are imported from `check-half-states.mjs`, so this checker and H31 cannot come to disagree about which PR delivers which card. It writes nothing, ever: hanging or clearing a review gate from a checker would be issuing the verdict. The fixed spelling is not relaxed. Decoration around the line is tolerated the way H4 tolerates it, and reasoning after the value token is accepted because that is the shape #13914 records as its control; prose, a different case and a word merely starting with the token all stay unread and are quoted back in the row so the residue is actionable. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msg17tAHJ3jVTYFgHydCm2

The filing card read this file as the place the dual-carrier rule should have been enforced and found only label-object reconciliation there — a fair reading, because nothing in the file said otherwise. State the boundary, and point at the two files that answer the hanging question instead: H31 for the board-wide carrier comparison, and the new per-pair checker for the same comparison anchored on one pair plus the declaration limb this repo had no reader for. ⛔ No behaviour change: this file still reconciles the label object and nothing else, and none of the three writes the label. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msg17tAHJ3jVTYFgHydCm2

…ds have A failure on the listing is TOTAL — no pair is formed, so the run refuses with "0 pair(s) had been read", which is the correct answer and exactly why it should not be spent on a blip. Measured while verifying this branch: a transient HTTP 502 on page 1 refused a --pair run that answered in a second on the next attempt, on a route where curl was returning 200 throughout. ⛔ Still one retry, not a loop: a second failure is the answer, and a sweep that keeps trying is a sweep that hides an exhausted quota. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msg17tAHJ3jVTYFgHydCm2

claude · 2026-08-31T18:08:20Z

Fixes#13922
Fixes#12409
Part of #13914

Family dispatch, code half only. One new checker in the existing check:pm-* gate family gives the clause-② enqueue gate a reader a seat can point at one pair: the dual carrier is asserted by mechanism, and a limb nobody can read is reported as a missing reading rather than passing for a decision.

⚠️ Premise correction — read this first

#13922 says the dual-carrier rule "has no enforcement at all" and that "there is no check anywhere that a needs:contract-review on one carrier implies it on the other". That is not true, and the correction shaped this PR.

h31ContractReviewCarrierSplit in scripts/pm/check-half-states.mjs is exactly that check. It compares both carriers, in both directions, names the offending PR, and it has a standing caller — .github/workflows/half-state-patrol.yml, four times a day. Measured on this branch: the patrol's last scheduled run before the card was filed was 2026-08-31T13:42:41Z, conclusion success.

Building a second carrier comparison as though H31 did not exist would have produced two predicates that can disagree about the same pair. So this PR imports H31's label constant and H31's delivery relation instead of restating either, and closes only the parts H31 genuinely cannot reach. Those parts are real, and all three were re-measured on the live board today:

Agreement on ABSENCE is H31's silent case, by construction. It fires on a split; a pair carrying the gate on neither carrier is, to it, clean. That is precisely the "all three limbs silent at once" shape The clause-② gate has three limbs and all three were silent on PR #13910 at once — the dual-carrier label rule has no enforcement, and 4 of 6 measured pairs are out of sync #13922 measured on PR fix(rest): a data engine that cannot be RESOLVED no longer answers 403 FORBIDDEN (#13476) #13910 / card [finding] after the #13279 repair, an UNRESOLVABLE data engine still answers 403 FORBIDDEN — the last surviving GRANTS-LOST disguise at the package door #13476.
Nothing read limb ② at all. Grep over scripts/ and .github/workflows/ finds the Clause-② token in a label description and in prose — never in a predicate. The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914 measured the consequence: 2 of 3 cards in one review round carried the declaration as prose or in the PR body, and a card with no declaration is indistinguishable from a card that declared no.
H31's delivery channel trims. Its report is one row family among ~38 rendered into one pinned anchor issue. Measured on the 13:42Z run body: 231 findings, 74 rendered, "157 further row(s) omitted to fit GitHub's issue-body limit." A gate row competes for space with board-hygiene rows, and the anchor then reads clean on the gate.

premise_still_valid is therefore partly false and the surviving defect is narrower and sharper than the card states. It is stated in full in the new file's header so the next reader is not told the original story.

What landed

scripts/pm/check-clause2-carriers.mjs — answers one question and prints only its own rows, so nothing it finds can be crowded out by another mechanism's inventory.

row	what it says	member
C1	the two carriers of one pair disagree — both directions, each with its own consequence	#13922 · #12409
C2	the declaration limb has NO READING: `absent`, `misplaced` (fixed spelling on the thread but not in the claim carrier), or `malformed`	#13914 remedy 2
C3	a declared `Clause-②: yes` with the gate on neither carrier — the fail-open a carrier comparison is structurally blind to	#13922

Modes, and why each exit code is what it is:

default sweep — report-only, exit 0 on a complete sweep whatever it found; 2 when any pair was UNJUDGED (an unread carrier is not a bare carrier, an unread thread is not an absent declaration); 3 PREREQUISITE NOT MET, the constant imported from check-half-states.mjs so the family has one code for it.
--pair PR-NUMBER — a predicate about that pair, so it may answer adversely where the sweep may not: exit 4, deliberately not 3, so a seat reading the status can never turn a refusal into a clearance. A pre-arm tool, ⛔ not a merge gate.
--self-test — offline, 64 cases. This is what lint.yml runs.

Single-sourced, not restated: CONTRACT_REVIEW_LABEL, prDeliversCard, labelNames, CLAIM_COMMENT_MARKER, governingClaim, proxyRearmPlan and EXIT_PREREQUISITE_NOT_MET all come from check-half-states.mjs. This checker and H31 cannot come to disagree about which PR delivers which card.

It writes nothing, ever. Hanging or clearing a review gate from a checker would be issuing the review verdict — 自查放行. Same call H31 makes, for the same reason.

Measured, on the live board

The sweep, run on this branch's head against objectstack-ai/objectstack at 2026-08-31T18:0xZ: 25 card/PR pairs derived from 27 open PRs, 25 findings, 0 UNJUDGED (exit 0).

1 × C1 — a live desync: PR fix(metadata-protocol): serve runtime-authored view containers to org/environment-scoped reads #13929 carries needs:contract-review, card rest/meta: getViewsByObject / GET /meta/view?object= omits a runtime-authored view CONTAINER — #7163/#7736 expansion fix does not cover this path #13407 does not. Verified independently by a second read of both label sets.
2 × C3 — live fail-opens: card [spec] FieldSchema accepts a lookup/master_detail with no reference target, though its own TSDoc calls the key required #13632 (PR fix(spec): require a non-empty reference on lookup/master_detail fields #13927) and card serve 面保证 stored metadata 规范拼写：reference_to → reference 归一化 + spec 裁定 reference_field/referenceField 协议归属（ui#6837 半 1） #13700 (PR Add field-reference-to-alias conversion so stored reference_to serves as reference #13847) each declare Clause-②: yes in the claim comment while neither carrier carries the gate label. PR fix(spec): require a non-empty reference on lookup/master_detail fields #13927 is not draft. Both claims say in their own words that the label was to be hung on both carriers in the same stroke as PR creation.
22 × C2 — 20 NO READING and 2 MISPLACED. The two misplaced ones quote what was there instead, e.g. card [finding] after the #13279 repair, an UNRESOLVABLE data engine still answers 403 FORBIDDEN — the last surviving GRANTS-LOST disguise at the package door #13476: ### Clause ② — 'yes', and it is a FOURTH class, and card A PERMISSION_DENIED refusal never reaches the dispatcher's throw-transparent exit, so it still drops the author's userMessage — a second door, behind #7898's trigger file #13623: ### Clause ② — declared 'yes' conservatively. A PERMISSION_DENIED refusal never reaches the dispatcher's throw-transparent exit, so it still drops the author's userMessage — a second door, behind #7898's trigger file #13623 is one of The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914's own two measured misses, re-observed by mechanism.

⛔ None of these was repaired here. The deliverable is the mechanism; the rows are the PM round's input.

Zone-2 assumptions, tested rather than inherited:

Pairing is machine-derivable — holds, 7 of 7. Every pair in the two cards' tables carries a closing or Part of keyword in the PR body naming its card, and every branch name carries the fallback too. Both channels agree on all seven.
[finding] Both recorded PR-label READ legs came back label-blind in one run — pull_request_read get returned no labels field, and the web-payload grep spelling that works on issues reads zero on a labeled PR #12902's claim that PR-side labels cannot be written — not relied on either way. This PR writes no label from any channel, so the question does not arise for it. What was measured instead is the read side: repo-scoped REST reads and writes both answer 200 from this container, and the sweep read 27 PRs and 25 threads over it.
Whether the sync check belongs in check-half-states.mjs H31/H35 — the stated condition did not hold, and the answer is standalone anyway. Open PR fix(pm): mask the fixture builders only a self-test can reach #13930 changes scripts/pm/dispatch-gates.mjs, not check-half-states.mjs, so H31/H35 were not held. Standalone is still right, because the trimming measurement above says a new row family added to that report is a row family that can be omitted before a reader sees it. H31/H35 are untouched; dispatch-gates.mjs is untouched.

Two things recorded rather than acted on

1. The two directions of a split are not ranked, because the two standing sources rank them oppositely. H31's header calls the card-bare direction "the more dangerous half" (an ungated card enqueues past a live gate). #13922 calls the PR-bare direction the fail-open ("it is the carrier the enqueue gate reads"). Both are sound about their own consumer. This checker states each direction's consequence and ranks neither — picking one would print an adjudication as a derivation. Which carrier the enqueue gate actually reads is a protocol question for the maintainer.

2. What this implies for .claude/skills/pm-dispatch/references/contract-review.md — recorded here, no edit landed. That file is held by pending human-merge PR #13746 and is outside this dispatch's surface. Two of its sentences are affected:

The 重挂前先查裁决 recovery rule reads "label absent" as probably cleared. The clause-② gate has three limbs and all three were silent on PR #13910 at once — the dual-carrier label rule has no enforcement, and 4 of 6 measured pairs are out of sync #13922 falsified its premise by measurement. --pair now answers that question directly for one pair instead of inferring it, so the recovery rule could point at the checker rather than at an inference.
The PR 与卡双载体同笔挂 rule now has a mechanical reader, which it did not when the text was written. Naming check-clause2-carriers.mjs --pair beside it would let the prose stop being the only executor.

Neither sentence is edited by this PR.

Scope, held

[finding] The contract-review gate is being hung on ONE carrier — 34 of 36 lone clears had a PR that never carried it, which makes a strip undetectable #12409 is taken on its mechanically-forced half only — enforcing the standing 2026-08-22 ruling 「两边都挂好」, which the card's own four-facet analysis marked as needing no new ruling to start. The un-ruled half stays open for the maintainer: a canonical machine-readable spelling for the review VERDICT (repair 2 — the Contract review: PASS marker that matched 5 of 35 removals strictly and 26 loosely). This PR gives the declaration a reader; it gives the verdict none, deliberately. That residue is named in the wrap-up comment on [finding] The contract-review gate is being hung on ONE carrier — 34 of 36 lone clears had a PR that never carried it, which makes a strip undetectable #12409.
The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914 is Part of, remedy 2 only. The claim-comment template in .claude/skills/pm-dispatch/SKILL.md (remedy 1) is not touched and the card stays open for it.
⛔ No patrol predicate widened to absorb prose. The fixed spelling stays exactly Clause-②: yes / Clause-②: no. Decoration around the line is tolerated the way H4 tolerates it; reasoning after the value token is accepted because that is the shape The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914 records as its control (os lint never surfaces ADR-0087 conversion notices — it normalizes with no onConversionNotice sink, the #3782 parity gap os build was in #12297 "carries Clause-②: yes with reasoning"). A reader that rejected it would have graded the card's own control as the defect — and it did, on four real claims, before that case was written. Clause-②: YES, Clause-②: nope, Clause-②: probably not, an empty value and the prose form Clause ②: yes all stay unread, and are quoted back in the row so the residue is actionable.
⛔ No carrier collapse, no branch-protection or required-set change, no new merge gate: the lint.yml step runs the self-test only, the same split as check:pm-half-states and check:pm-governed-merges beside it.
Escalation clause not triggered: no new protocol spelling and no new gate category were invented. Every row asserts a rule that already stands.

Verification

Derived on this PR's own final head — node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, at this PR's final head 850a759 (4 paths vs merge base 0f63965ea; the union is byte-identical to the one derived at d06df85, and it was re-run in full on 850a759 with the same result): 33 families + 2 convention-triggered obligations = 35 commands, all run serially under scripts/pm/os-verify-lock.sh.

32 of 35 exit 0. Including both convention obligations an added gate script incurs — node scripts/pm/bare-root-worklist.mjs --self-test and pnpm check:pm-dispatch-gates — plus check:self-test-wired, check:entry-guard, check:parse-guard, check:watch-hint-literal, check:pm-label-desc-cap and check:required-contexts.

The other 3 are NOT MEASURED, not red — each says so in its own verdict text, and each needs a full package build this diff cannot affect (it touches no package source):

gate	exit	its own words
`check-test-completeness.mjs`	3	"PREREQUISITE NOT MET … the local reading for this gate is NOT MEASURED. ⛔ It is not a red, and there is nothing here to fix."
`check:dual-build-cjs-loads`	3	"PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/. Run `pnpm build` first. ⛔ This is NOT a pass: nothing was measured."
`check:type-check-debt`	1	its `--self-test` and coverage read pass; `--re-measure` refuses without the built closure, because measuring there "would silently measure a DIFFERENT WORLD"

Also run, because this checker imports it: pnpm check:pm-half-states — 1826 cases pass, so the imported surface is intact.

Every exit code was exercised live, in the direction predicted before the run:

run	exit	reading
`--pair 13944` (this PR)	0	its three pairs — #13922, #12409, #13914 — all declare `Clause-②: no` in the fixed spelling and both carriers agree. Three green lines, the clean control.
`--pair 13847`	4	the C3 row on card #13700. A verdict about that pair, not about the environment.
`--pair 13944`, earlier attempt	3	a transient `HTTP 502` on the PR listing, on a route where `curl` returned 200 throughout. It refused with "0 pair(s) had been read … NOT a reading of a clean board" rather than reporting green — which is why the listing now carries the same single retry the per-pair reads do (third commit).

Live evidence beyond the self-test: the sweep output above, plus an independent second read of the label sets on #13929/#13407, #13927/#13632 and #13847/#13700 confirming every C1 and C3 row.

Authored in session session_01Msg17tAHJ3jVTYFgHydCm2 (durable copy of the attribution, because a body edit normalises the footer's session URL away).

No changeset: this diff publishes nothing — scripts/pm/**, a workflow, and a script registration in the private root manifest. skip-changeset applies and is attached.

Generated by Claude Code

`needs:contract-review` is a dual-carrier gate by the maintainer's ruling of 2026-08-22 (「两边都挂好」), and its content limb is a fixed machine spelling in the card's claim comment. Neither had a reader that a seat could point at one pair: H31 in `check-half-states.mjs` compares the two carriers, but it is silent when the gate is missing from BOTH (agreement on absence is its silent case) and it reports through a patrol body that trims — 231 findings, 74 rendered on the 2026-08-31T13:42Z run. The declaration limb had no reader at all: grep over `scripts/` and `.github/workflows/` finds the token only in a label description and in prose. `scripts/pm/check-clause2-carriers.mjs` answers exactly that one question and prints only its own rows: C1 the two carriers of one pair disagree. Both directions, each with its own consequence, neither ranked — H31 and #13922 rank them oppositely and this file records the disagreement rather than adjudicating it. C2 the declaration limb has NO READING: absent, misplaced (the fixed spelling on the thread but not in the claim carrier), or malformed. A missing reading is never collapsed into a declared `no`. C3 a declared `yes` with the gate on NEITHER carrier — the fail-open a carrier comparison is structurally blind to. The label constant, the `prDeliversCard` delivery relation and the shared PREREQUISITE-NOT-MET exit code are imported from `check-half-states.mjs`, so this checker and H31 cannot come to disagree about which PR delivers which card. It writes nothing, ever: hanging or clearing a review gate from a checker would be issuing the verdict. The fixed spelling is not relaxed. Decoration around the line is tolerated the way H4 tolerates it, and reasoning after the value token is accepted because that is the shape #13914 records as its control; prose, a different case and a word merely starting with the token all stay unread and are quoted back in the row so the residue is actionable. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msg17tAHJ3jVTYFgHydCm2

The filing card read this file as the place the dual-carrier rule should have been enforced and found only label-object reconciliation there — a fair reading, because nothing in the file said otherwise. State the boundary, and point at the two files that answer the hanging question instead: H31 for the board-wide carrier comparison, and the new per-pair checker for the same comparison anchored on one pair plus the declaration limb this repo had no reader for. ⛔ No behaviour change: this file still reconciles the label object and nothing else, and none of the three writes the label. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msg17tAHJ3jVTYFgHydCm2

…ds have A failure on the listing is TOTAL — no pair is formed, so the run refuses with "0 pair(s) had been read", which is the correct answer and exactly why it should not be spent on a blip. Measured while verifying this branch: a transient HTTP 502 on page 1 refused a --pair run that answered in a second on the next attempt, on a route where curl was returning 200 throughout. ⛔ Still one retry, not a loop: a second failure is the answer, and a sweep that keeps trying is a sweep that hides an exhausted quota. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msg17tAHJ3jVTYFgHydCm2

claude · 2026-08-31T18:08:20Z

Fixes#13922
Fixes#12409
Part of #13914

Family dispatch, code half only. One new checker in the existing check:pm-* gate family gives the clause-② enqueue gate a reader a seat can point at one pair: the dual carrier is asserted by mechanism, and a limb nobody can read is reported as a missing reading rather than passing for a decision.

⚠️ Premise correction — read this first

#13922 says the dual-carrier rule "has no enforcement at all" and that "there is no check anywhere that a needs:contract-review on one carrier implies it on the other". That is not true, and the correction shaped this PR.

h31ContractReviewCarrierSplit in scripts/pm/check-half-states.mjs is exactly that check. It compares both carriers, in both directions, names the offending PR, and it has a standing caller — .github/workflows/half-state-patrol.yml, four times a day. Measured on this branch: the patrol's last scheduled run before the card was filed was 2026-08-31T13:42:41Z, conclusion success.

Building a second carrier comparison as though H31 did not exist would have produced two predicates that can disagree about the same pair. So this PR imports H31's label constant and H31's delivery relation instead of restating either, and closes only the parts H31 genuinely cannot reach. Those parts are real, and all three were re-measured on the live board today:

Agreement on ABSENCE is H31's silent case, by construction. It fires on a split; a pair carrying the gate on neither carrier is, to it, clean. That is precisely the "all three limbs silent at once" shape The clause-② gate has three limbs and all three were silent on PR #13910 at once — the dual-carrier label rule has no enforcement, and 4 of 6 measured pairs are out of sync #13922 measured on PR fix(rest): a data engine that cannot be RESOLVED no longer answers 403 FORBIDDEN (#13476) #13910 / card [finding] after the #13279 repair, an UNRESOLVABLE data engine still answers 403 FORBIDDEN — the last surviving GRANTS-LOST disguise at the package door #13476.
Nothing read limb ② at all. Grep over scripts/ and .github/workflows/ finds the Clause-② token in a label description and in prose — never in a predicate. The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914 measured the consequence: 2 of 3 cards in one review round carried the declaration as prose or in the PR body, and a card with no declaration is indistinguishable from a card that declared no.
H31's delivery channel trims. Its report is one row family among ~38 rendered into one pinned anchor issue. Measured on the 13:42Z run body: 231 findings, 74 rendered, "157 further row(s) omitted to fit GitHub's issue-body limit." A gate row competes for space with board-hygiene rows, and the anchor then reads clean on the gate.

premise_still_valid is therefore partly false and the surviving defect is narrower and sharper than the card states. It is stated in full in the new file's header so the next reader is not told the original story.

What landed

scripts/pm/check-clause2-carriers.mjs — answers one question and prints only its own rows, so nothing it finds can be crowded out by another mechanism's inventory.

row	what it says	member
C1	the two carriers of one pair disagree — both directions, each with its own consequence	#13922 · #12409
C2	the declaration limb has NO READING: `absent`, `misplaced` (fixed spelling on the thread but not in the claim carrier), or `malformed`	#13914 remedy 2
C3	a declared `Clause-②: yes` with the gate on neither carrier — the fail-open a carrier comparison is structurally blind to	#13922

Modes, and why each exit code is what it is:

default sweep — report-only, exit 0 on a complete sweep whatever it found; 2 when any pair was UNJUDGED (an unread carrier is not a bare carrier, an unread thread is not an absent declaration); 3 PREREQUISITE NOT MET, the constant imported from check-half-states.mjs so the family has one code for it.
--pair PR-NUMBER — a predicate about that pair, so it may answer adversely where the sweep may not: exit 4, deliberately not 3, so a seat reading the status can never turn a refusal into a clearance. A pre-arm tool, ⛔ not a merge gate.
--self-test — offline, 64 cases. This is what lint.yml runs.

Single-sourced, not restated: CONTRACT_REVIEW_LABEL, prDeliversCard, labelNames, CLAIM_COMMENT_MARKER, governingClaim, proxyRearmPlan and EXIT_PREREQUISITE_NOT_MET all come from check-half-states.mjs. This checker and H31 cannot come to disagree about which PR delivers which card.

It writes nothing, ever. Hanging or clearing a review gate from a checker would be issuing the review verdict — 自查放行. Same call H31 makes, for the same reason.

Measured, on the live board

The sweep, run on this branch's head against objectstack-ai/objectstack at 2026-08-31T18:0xZ: 25 card/PR pairs derived from 27 open PRs, 25 findings, 0 UNJUDGED (exit 0).

1 × C1 — a live desync: PR fix(metadata-protocol): serve runtime-authored view containers to org/environment-scoped reads #13929 carries needs:contract-review, card rest/meta: getViewsByObject / GET /meta/view?object= omits a runtime-authored view CONTAINER — #7163/#7736 expansion fix does not cover this path #13407 does not. Verified independently by a second read of both label sets.
2 × C3 — live fail-opens: card [spec] FieldSchema accepts a lookup/master_detail with no reference target, though its own TSDoc calls the key required #13632 (PR fix(spec): require a non-empty reference on lookup/master_detail fields #13927) and card serve 面保证 stored metadata 规范拼写：reference_to → reference 归一化 + spec 裁定 reference_field/referenceField 协议归属（ui#6837 半 1） #13700 (PR Add field-reference-to-alias conversion so stored reference_to serves as reference #13847) each declare Clause-②: yes in the claim comment while neither carrier carries the gate label. PR fix(spec): require a non-empty reference on lookup/master_detail fields #13927 is not draft. Both claims say in their own words that the label was to be hung on both carriers in the same stroke as PR creation.
22 × C2 — 20 NO READING and 2 MISPLACED. The two misplaced ones quote what was there instead, e.g. card [finding] after the #13279 repair, an UNRESOLVABLE data engine still answers 403 FORBIDDEN — the last surviving GRANTS-LOST disguise at the package door #13476: ### Clause ② — 'yes', and it is a FOURTH class, and card A PERMISSION_DENIED refusal never reaches the dispatcher's throw-transparent exit, so it still drops the author's userMessage — a second door, behind #7898's trigger file #13623: ### Clause ② — declared 'yes' conservatively. A PERMISSION_DENIED refusal never reaches the dispatcher's throw-transparent exit, so it still drops the author's userMessage — a second door, behind #7898's trigger file #13623 is one of The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914's own two measured misses, re-observed by mechanism.

⛔ None of these was repaired here. The deliverable is the mechanism; the rows are the PM round's input.

Zone-2 assumptions, tested rather than inherited:

Pairing is machine-derivable — holds, 7 of 7. Every pair in the two cards' tables carries a closing or Part of keyword in the PR body naming its card, and every branch name carries the fallback too. Both channels agree on all seven.
[finding] Both recorded PR-label READ legs came back label-blind in one run — pull_request_read get returned no labels field, and the web-payload grep spelling that works on issues reads zero on a labeled PR #12902's claim that PR-side labels cannot be written — not relied on either way. This PR writes no label from any channel, so the question does not arise for it. What was measured instead is the read side: repo-scoped REST reads and writes both answer 200 from this container, and the sweep read 27 PRs and 25 threads over it.
Whether the sync check belongs in check-half-states.mjs H31/H35 — the stated condition did not hold, and the answer is standalone anyway. Open PR fix(pm): mask the fixture builders only a self-test can reach #13930 changes scripts/pm/dispatch-gates.mjs, not check-half-states.mjs, so H31/H35 were not held. Standalone is still right, because the trimming measurement above says a new row family added to that report is a row family that can be omitted before a reader sees it. H31/H35 are untouched; dispatch-gates.mjs is untouched.

Two things recorded rather than acted on

1. The two directions of a split are not ranked, because the two standing sources rank them oppositely. H31's header calls the card-bare direction "the more dangerous half" (an ungated card enqueues past a live gate). #13922 calls the PR-bare direction the fail-open ("it is the carrier the enqueue gate reads"). Both are sound about their own consumer. This checker states each direction's consequence and ranks neither — picking one would print an adjudication as a derivation. Which carrier the enqueue gate actually reads is a protocol question for the maintainer.

2. What this implies for .claude/skills/pm-dispatch/references/contract-review.md — recorded here, no edit landed. That file is held by pending human-merge PR #13746 and is outside this dispatch's surface. Two of its sentences are affected:

The 重挂前先查裁决 recovery rule reads "label absent" as probably cleared. The clause-② gate has three limbs and all three were silent on PR #13910 at once — the dual-carrier label rule has no enforcement, and 4 of 6 measured pairs are out of sync #13922 falsified its premise by measurement. --pair now answers that question directly for one pair instead of inferring it, so the recovery rule could point at the checker rather than at an inference.
The PR 与卡双载体同笔挂 rule now has a mechanical reader, which it did not when the text was written. Naming check-clause2-carriers.mjs --pair beside it would let the prose stop being the only executor.

Neither sentence is edited by this PR.

Scope, held

[finding] The contract-review gate is being hung on ONE carrier — 34 of 36 lone clears had a PR that never carried it, which makes a strip undetectable #12409 is taken on its mechanically-forced half only — enforcing the standing 2026-08-22 ruling 「两边都挂好」, which the card's own four-facet analysis marked as needing no new ruling to start. The un-ruled half stays open for the maintainer: a canonical machine-readable spelling for the review VERDICT (repair 2 — the Contract review: PASS marker that matched 5 of 35 removals strictly and 26 loosely). This PR gives the declaration a reader; it gives the verdict none, deliberately. That residue is named in the wrap-up comment on [finding] The contract-review gate is being hung on ONE carrier — 34 of 36 lone clears had a PR that never carried it, which makes a strip undetectable #12409.
The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914 is Part of, remedy 2 only. The claim-comment template in .claude/skills/pm-dispatch/SKILL.md (remedy 1) is not touched and the card stays open for it.
⛔ No patrol predicate widened to absorb prose. The fixed spelling stays exactly Clause-②: yes / Clause-②: no. Decoration around the line is tolerated the way H4 tolerates it; reasoning after the value token is accepted because that is the shape The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914 records as its control (os lint never surfaces ADR-0087 conversion notices — it normalizes with no onConversionNotice sink, the #3782 parity gap os build was in #12297 "carries Clause-②: yes with reasoning"). A reader that rejected it would have graded the card's own control as the defect — and it did, on four real claims, before that case was written. Clause-②: YES, Clause-②: nope, Clause-②: probably not, an empty value and the prose form Clause ②: yes all stay unread, and are quoted back in the row so the residue is actionable.
⛔ No carrier collapse, no branch-protection or required-set change, no new merge gate: the lint.yml step runs the self-test only, the same split as check:pm-half-states and check:pm-governed-merges beside it.
Escalation clause not triggered: no new protocol spelling and no new gate category were invented. Every row asserts a rule that already stands.

Verification

Derived on this PR's own final head — node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, at this PR's final head 850a759 (4 paths vs merge base 0f63965ea; the union is byte-identical to the one derived at d06df85, and it was re-run in full on 850a759 with the same result): 33 families + 2 convention-triggered obligations = 35 commands, all run serially under scripts/pm/os-verify-lock.sh.

32 of 35 exit 0. Including both convention obligations an added gate script incurs — node scripts/pm/bare-root-worklist.mjs --self-test and pnpm check:pm-dispatch-gates — plus check:self-test-wired, check:entry-guard, check:parse-guard, check:watch-hint-literal, check:pm-label-desc-cap and check:required-contexts.

The other 3 are NOT MEASURED, not red — each says so in its own verdict text, and each needs a full package build this diff cannot affect (it touches no package source):

gate	exit	its own words
`check-test-completeness.mjs`	3	"PREREQUISITE NOT MET … the local reading for this gate is NOT MEASURED. ⛔ It is not a red, and there is nothing here to fix."
`check:dual-build-cjs-loads`	3	"PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/. Run `pnpm build` first. ⛔ This is NOT a pass: nothing was measured."
`check:type-check-debt`	1	its `--self-test` and coverage read pass; `--re-measure` refuses without the built closure, because measuring there "would silently measure a DIFFERENT WORLD"

Also run, because this checker imports it: pnpm check:pm-half-states — 1826 cases pass, so the imported surface is intact.

Every exit code was exercised live, in the direction predicted before the run:

run	exit	reading
`--pair 13944` (this PR)	0	its three pairs — #13922, #12409, #13914 — all declare `Clause-②: no` in the fixed spelling and both carriers agree. Three green lines, the clean control.
`--pair 13847`	4	the C3 row on card #13700. A verdict about that pair, not about the environment.
`--pair 13944`, earlier attempt	3	a transient `HTTP 502` on the PR listing, on a route where `curl` returned 200 throughout. It refused with "0 pair(s) had been read … NOT a reading of a clean board" rather than reporting green — which is why the listing now carries the same single retry the per-pair reads do (third commit).

Live evidence beyond the self-test: the sweep output above, plus an independent second read of the label sets on #13929/#13407, #13927/#13632 and #13847/#13700 confirming every C1 and C3 row.

Authored in session session_01Msg17tAHJ3jVTYFgHydCm2 (durable copy of the attribution, because a body edit normalises the footer's session URL away).

No changeset: this diff publishes nothing — scripts/pm/**, a workflow, and a script registration in the private root manifest. skip-changeset applies and is attached.

Generated by Claude Code

`needs:contract-review` is a dual-carrier gate by the maintainer's ruling of 2026-08-22 (「两边都挂好」), and its content limb is a fixed machine spelling in the card's claim comment. Neither had a reader that a seat could point at one pair: H31 in `check-half-states.mjs` compares the two carriers, but it is silent when the gate is missing from BOTH (agreement on absence is its silent case) and it reports through a patrol body that trims — 231 findings, 74 rendered on the 2026-08-31T13:42Z run. The declaration limb had no reader at all: grep over `scripts/` and `.github/workflows/` finds the token only in a label description and in prose. `scripts/pm/check-clause2-carriers.mjs` answers exactly that one question and prints only its own rows: C1 the two carriers of one pair disagree. Both directions, each with its own consequence, neither ranked — H31 and #13922 rank them oppositely and this file records the disagreement rather than adjudicating it. C2 the declaration limb has NO READING: absent, misplaced (the fixed spelling on the thread but not in the claim carrier), or malformed. A missing reading is never collapsed into a declared `no`. C3 a declared `yes` with the gate on NEITHER carrier — the fail-open a carrier comparison is structurally blind to. The label constant, the `prDeliversCard` delivery relation and the shared PREREQUISITE-NOT-MET exit code are imported from `check-half-states.mjs`, so this checker and H31 cannot come to disagree about which PR delivers which card. It writes nothing, ever: hanging or clearing a review gate from a checker would be issuing the verdict. The fixed spelling is not relaxed. Decoration around the line is tolerated the way H4 tolerates it, and reasoning after the value token is accepted because that is the shape #13914 records as its control; prose, a different case and a word merely starting with the token all stay unread and are quoted back in the row so the residue is actionable. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msg17tAHJ3jVTYFgHydCm2

The filing card read this file as the place the dual-carrier rule should have been enforced and found only label-object reconciliation there — a fair reading, because nothing in the file said otherwise. State the boundary, and point at the two files that answer the hanging question instead: H31 for the board-wide carrier comparison, and the new per-pair checker for the same comparison anchored on one pair plus the declaration limb this repo had no reader for. ⛔ No behaviour change: this file still reconciles the label object and nothing else, and none of the three writes the label. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msg17tAHJ3jVTYFgHydCm2

…ds have A failure on the listing is TOTAL — no pair is formed, so the run refuses with "0 pair(s) had been read", which is the correct answer and exactly why it should not be spent on a blip. Measured while verifying this branch: a transient HTTP 502 on page 1 refused a --pair run that answered in a second on the next attempt, on a route where curl was returning 200 throughout. ⛔ Still one retry, not a loop: a second failure is the answer, and a sweep that keeps trying is a sweep that hides an exhausted quota. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msg17tAHJ3jVTYFgHydCm2

claude · 2026-08-31T18:08:20Z

Fixes#13922
Fixes#12409
Part of #13914

Family dispatch, code half only. One new checker in the existing check:pm-* gate family gives the clause-② enqueue gate a reader a seat can point at one pair: the dual carrier is asserted by mechanism, and a limb nobody can read is reported as a missing reading rather than passing for a decision.

⚠️ Premise correction — read this first

#13922 says the dual-carrier rule "has no enforcement at all" and that "there is no check anywhere that a needs:contract-review on one carrier implies it on the other". That is not true, and the correction shaped this PR.

h31ContractReviewCarrierSplit in scripts/pm/check-half-states.mjs is exactly that check. It compares both carriers, in both directions, names the offending PR, and it has a standing caller — .github/workflows/half-state-patrol.yml, four times a day. Measured on this branch: the patrol's last scheduled run before the card was filed was 2026-08-31T13:42:41Z, conclusion success.

Building a second carrier comparison as though H31 did not exist would have produced two predicates that can disagree about the same pair. So this PR imports H31's label constant and H31's delivery relation instead of restating either, and closes only the parts H31 genuinely cannot reach. Those parts are real, and all three were re-measured on the live board today:

Agreement on ABSENCE is H31's silent case, by construction. It fires on a split; a pair carrying the gate on neither carrier is, to it, clean. That is precisely the "all three limbs silent at once" shape The clause-② gate has three limbs and all three were silent on PR #13910 at once — the dual-carrier label rule has no enforcement, and 4 of 6 measured pairs are out of sync #13922 measured on PR fix(rest): a data engine that cannot be RESOLVED no longer answers 403 FORBIDDEN (#13476) #13910 / card [finding] after the #13279 repair, an UNRESOLVABLE data engine still answers 403 FORBIDDEN — the last surviving GRANTS-LOST disguise at the package door #13476.
Nothing read limb ② at all. Grep over scripts/ and .github/workflows/ finds the Clause-② token in a label description and in prose — never in a predicate. The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914 measured the consequence: 2 of 3 cards in one review round carried the declaration as prose or in the PR body, and a card with no declaration is indistinguishable from a card that declared no.
H31's delivery channel trims. Its report is one row family among ~38 rendered into one pinned anchor issue. Measured on the 13:42Z run body: 231 findings, 74 rendered, "157 further row(s) omitted to fit GitHub's issue-body limit." A gate row competes for space with board-hygiene rows, and the anchor then reads clean on the gate.

premise_still_valid is therefore partly false and the surviving defect is narrower and sharper than the card states. It is stated in full in the new file's header so the next reader is not told the original story.

What landed

scripts/pm/check-clause2-carriers.mjs — answers one question and prints only its own rows, so nothing it finds can be crowded out by another mechanism's inventory.

row	what it says	member
C1	the two carriers of one pair disagree — both directions, each with its own consequence	#13922 · #12409
C2	the declaration limb has NO READING: `absent`, `misplaced` (fixed spelling on the thread but not in the claim carrier), or `malformed`	#13914 remedy 2
C3	a declared `Clause-②: yes` with the gate on neither carrier — the fail-open a carrier comparison is structurally blind to	#13922

Modes, and why each exit code is what it is:

default sweep — report-only, exit 0 on a complete sweep whatever it found; 2 when any pair was UNJUDGED (an unread carrier is not a bare carrier, an unread thread is not an absent declaration); 3 PREREQUISITE NOT MET, the constant imported from check-half-states.mjs so the family has one code for it.
--pair PR-NUMBER — a predicate about that pair, so it may answer adversely where the sweep may not: exit 4, deliberately not 3, so a seat reading the status can never turn a refusal into a clearance. A pre-arm tool, ⛔ not a merge gate.
--self-test — offline, 64 cases. This is what lint.yml runs.

Single-sourced, not restated: CONTRACT_REVIEW_LABEL, prDeliversCard, labelNames, CLAIM_COMMENT_MARKER, governingClaim, proxyRearmPlan and EXIT_PREREQUISITE_NOT_MET all come from check-half-states.mjs. This checker and H31 cannot come to disagree about which PR delivers which card.

It writes nothing, ever. Hanging or clearing a review gate from a checker would be issuing the review verdict — 自查放行. Same call H31 makes, for the same reason.

Measured, on the live board

The sweep, run on this branch's head against objectstack-ai/objectstack at 2026-08-31T18:0xZ: 25 card/PR pairs derived from 27 open PRs, 25 findings, 0 UNJUDGED (exit 0).

1 × C1 — a live desync: PR fix(metadata-protocol): serve runtime-authored view containers to org/environment-scoped reads #13929 carries needs:contract-review, card rest/meta: getViewsByObject / GET /meta/view?object= omits a runtime-authored view CONTAINER — #7163/#7736 expansion fix does not cover this path #13407 does not. Verified independently by a second read of both label sets.
2 × C3 — live fail-opens: card [spec] FieldSchema accepts a lookup/master_detail with no reference target, though its own TSDoc calls the key required #13632 (PR fix(spec): require a non-empty reference on lookup/master_detail fields #13927) and card serve 面保证 stored metadata 规范拼写：reference_to → reference 归一化 + spec 裁定 reference_field/referenceField 协议归属（ui#6837 半 1） #13700 (PR Add field-reference-to-alias conversion so stored reference_to serves as reference #13847) each declare Clause-②: yes in the claim comment while neither carrier carries the gate label. PR fix(spec): require a non-empty reference on lookup/master_detail fields #13927 is not draft. Both claims say in their own words that the label was to be hung on both carriers in the same stroke as PR creation.
22 × C2 — 20 NO READING and 2 MISPLACED. The two misplaced ones quote what was there instead, e.g. card [finding] after the #13279 repair, an UNRESOLVABLE data engine still answers 403 FORBIDDEN — the last surviving GRANTS-LOST disguise at the package door #13476: ### Clause ② — 'yes', and it is a FOURTH class, and card A PERMISSION_DENIED refusal never reaches the dispatcher's throw-transparent exit, so it still drops the author's userMessage — a second door, behind #7898's trigger file #13623: ### Clause ② — declared 'yes' conservatively. A PERMISSION_DENIED refusal never reaches the dispatcher's throw-transparent exit, so it still drops the author's userMessage — a second door, behind #7898's trigger file #13623 is one of The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914's own two measured misses, re-observed by mechanism.

⛔ None of these was repaired here. The deliverable is the mechanism; the rows are the PM round's input.

Zone-2 assumptions, tested rather than inherited:

Pairing is machine-derivable — holds, 7 of 7. Every pair in the two cards' tables carries a closing or Part of keyword in the PR body naming its card, and every branch name carries the fallback too. Both channels agree on all seven.
[finding] Both recorded PR-label READ legs came back label-blind in one run — pull_request_read get returned no labels field, and the web-payload grep spelling that works on issues reads zero on a labeled PR #12902's claim that PR-side labels cannot be written — not relied on either way. This PR writes no label from any channel, so the question does not arise for it. What was measured instead is the read side: repo-scoped REST reads and writes both answer 200 from this container, and the sweep read 27 PRs and 25 threads over it.
Whether the sync check belongs in check-half-states.mjs H31/H35 — the stated condition did not hold, and the answer is standalone anyway. Open PR fix(pm): mask the fixture builders only a self-test can reach #13930 changes scripts/pm/dispatch-gates.mjs, not check-half-states.mjs, so H31/H35 were not held. Standalone is still right, because the trimming measurement above says a new row family added to that report is a row family that can be omitted before a reader sees it. H31/H35 are untouched; dispatch-gates.mjs is untouched.

Two things recorded rather than acted on

1. The two directions of a split are not ranked, because the two standing sources rank them oppositely. H31's header calls the card-bare direction "the more dangerous half" (an ungated card enqueues past a live gate). #13922 calls the PR-bare direction the fail-open ("it is the carrier the enqueue gate reads"). Both are sound about their own consumer. This checker states each direction's consequence and ranks neither — picking one would print an adjudication as a derivation. Which carrier the enqueue gate actually reads is a protocol question for the maintainer.

2. What this implies for .claude/skills/pm-dispatch/references/contract-review.md — recorded here, no edit landed. That file is held by pending human-merge PR #13746 and is outside this dispatch's surface. Two of its sentences are affected:

The 重挂前先查裁决 recovery rule reads "label absent" as probably cleared. The clause-② gate has three limbs and all three were silent on PR #13910 at once — the dual-carrier label rule has no enforcement, and 4 of 6 measured pairs are out of sync #13922 falsified its premise by measurement. --pair now answers that question directly for one pair instead of inferring it, so the recovery rule could point at the checker rather than at an inference.
The PR 与卡双载体同笔挂 rule now has a mechanical reader, which it did not when the text was written. Naming check-clause2-carriers.mjs --pair beside it would let the prose stop being the only executor.

Neither sentence is edited by this PR.

Scope, held

[finding] The contract-review gate is being hung on ONE carrier — 34 of 36 lone clears had a PR that never carried it, which makes a strip undetectable #12409 is taken on its mechanically-forced half only — enforcing the standing 2026-08-22 ruling 「两边都挂好」, which the card's own four-facet analysis marked as needing no new ruling to start. The un-ruled half stays open for the maintainer: a canonical machine-readable spelling for the review VERDICT (repair 2 — the Contract review: PASS marker that matched 5 of 35 removals strictly and 26 loosely). This PR gives the declaration a reader; it gives the verdict none, deliberately. That residue is named in the wrap-up comment on [finding] The contract-review gate is being hung on ONE carrier — 34 of 36 lone clears had a PR that never carried it, which makes a strip undetectable #12409.
The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914 is Part of, remedy 2 only. The claim-comment template in .claude/skills/pm-dispatch/SKILL.md (remedy 1) is not touched and the card stays open for it.
⛔ No patrol predicate widened to absorb prose. The fixed spelling stays exactly Clause-②: yes / Clause-②: no. Decoration around the line is tolerated the way H4 tolerates it; reasoning after the value token is accepted because that is the shape The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914 records as its control (os lint never surfaces ADR-0087 conversion notices — it normalizes with no onConversionNotice sink, the #3782 parity gap os build was in #12297 "carries Clause-②: yes with reasoning"). A reader that rejected it would have graded the card's own control as the defect — and it did, on four real claims, before that case was written. Clause-②: YES, Clause-②: nope, Clause-②: probably not, an empty value and the prose form Clause ②: yes all stay unread, and are quoted back in the row so the residue is actionable.
⛔ No carrier collapse, no branch-protection or required-set change, no new merge gate: the lint.yml step runs the self-test only, the same split as check:pm-half-states and check:pm-governed-merges beside it.
Escalation clause not triggered: no new protocol spelling and no new gate category were invented. Every row asserts a rule that already stands.

Verification

Derived on this PR's own final head — node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, at this PR's final head 850a759 (4 paths vs merge base 0f63965ea; the union is byte-identical to the one derived at d06df85, and it was re-run in full on 850a759 with the same result): 33 families + 2 convention-triggered obligations = 35 commands, all run serially under scripts/pm/os-verify-lock.sh.

32 of 35 exit 0. Including both convention obligations an added gate script incurs — node scripts/pm/bare-root-worklist.mjs --self-test and pnpm check:pm-dispatch-gates — plus check:self-test-wired, check:entry-guard, check:parse-guard, check:watch-hint-literal, check:pm-label-desc-cap and check:required-contexts.

The other 3 are NOT MEASURED, not red — each says so in its own verdict text, and each needs a full package build this diff cannot affect (it touches no package source):

gate	exit	its own words
`check-test-completeness.mjs`	3	"PREREQUISITE NOT MET … the local reading for this gate is NOT MEASURED. ⛔ It is not a red, and there is nothing here to fix."
`check:dual-build-cjs-loads`	3	"PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/. Run `pnpm build` first. ⛔ This is NOT a pass: nothing was measured."
`check:type-check-debt`	1	its `--self-test` and coverage read pass; `--re-measure` refuses without the built closure, because measuring there "would silently measure a DIFFERENT WORLD"

Also run, because this checker imports it: pnpm check:pm-half-states — 1826 cases pass, so the imported surface is intact.

Every exit code was exercised live, in the direction predicted before the run:

run	exit	reading
`--pair 13944` (this PR)	0	its three pairs — #13922, #12409, #13914 — all declare `Clause-②: no` in the fixed spelling and both carriers agree. Three green lines, the clean control.
`--pair 13847`	4	the C3 row on card #13700. A verdict about that pair, not about the environment.
`--pair 13944`, earlier attempt	3	a transient `HTTP 502` on the PR listing, on a route where `curl` returned 200 throughout. It refused with "0 pair(s) had been read … NOT a reading of a clean board" rather than reporting green — which is why the listing now carries the same single retry the per-pair reads do (third commit).

Live evidence beyond the self-test: the sweep output above, plus an independent second read of the label sets on #13929/#13407, #13927/#13632 and #13847/#13700 confirming every C1 and C3 row.

Authored in session session_01Msg17tAHJ3jVTYFgHydCm2 (durable copy of the attribution, because a body edit normalises the footer's session URL away).

No changeset: this diff publishes nothing — scripts/pm/**, a workflow, and a script registration in the private root manifest. skip-changeset applies and is attached.

Generated by Claude Code

`needs:contract-review` is a dual-carrier gate by the maintainer's ruling of 2026-08-22 (「两边都挂好」), and its content limb is a fixed machine spelling in the card's claim comment. Neither had a reader that a seat could point at one pair: H31 in `check-half-states.mjs` compares the two carriers, but it is silent when the gate is missing from BOTH (agreement on absence is its silent case) and it reports through a patrol body that trims — 231 findings, 74 rendered on the 2026-08-31T13:42Z run. The declaration limb had no reader at all: grep over `scripts/` and `.github/workflows/` finds the token only in a label description and in prose. `scripts/pm/check-clause2-carriers.mjs` answers exactly that one question and prints only its own rows: C1 the two carriers of one pair disagree. Both directions, each with its own consequence, neither ranked — H31 and #13922 rank them oppositely and this file records the disagreement rather than adjudicating it. C2 the declaration limb has NO READING: absent, misplaced (the fixed spelling on the thread but not in the claim carrier), or malformed. A missing reading is never collapsed into a declared `no`. C3 a declared `yes` with the gate on NEITHER carrier — the fail-open a carrier comparison is structurally blind to. The label constant, the `prDeliversCard` delivery relation and the shared PREREQUISITE-NOT-MET exit code are imported from `check-half-states.mjs`, so this checker and H31 cannot come to disagree about which PR delivers which card. It writes nothing, ever: hanging or clearing a review gate from a checker would be issuing the verdict. The fixed spelling is not relaxed. Decoration around the line is tolerated the way H4 tolerates it, and reasoning after the value token is accepted because that is the shape #13914 records as its control; prose, a different case and a word merely starting with the token all stay unread and are quoted back in the row so the residue is actionable. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msg17tAHJ3jVTYFgHydCm2

The filing card read this file as the place the dual-carrier rule should have been enforced and found only label-object reconciliation there — a fair reading, because nothing in the file said otherwise. State the boundary, and point at the two files that answer the hanging question instead: H31 for the board-wide carrier comparison, and the new per-pair checker for the same comparison anchored on one pair plus the declaration limb this repo had no reader for. ⛔ No behaviour change: this file still reconciles the label object and nothing else, and none of the three writes the label. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msg17tAHJ3jVTYFgHydCm2

…ds have A failure on the listing is TOTAL — no pair is formed, so the run refuses with "0 pair(s) had been read", which is the correct answer and exactly why it should not be spent on a blip. Measured while verifying this branch: a transient HTTP 502 on page 1 refused a --pair run that answered in a second on the next attempt, on a route where curl was returning 200 throughout. ⛔ Still one retry, not a loop: a second failure is the answer, and a sweep that keeps trying is a sweep that hides an exhausted quota. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msg17tAHJ3jVTYFgHydCm2

claude · 2026-08-31T18:08:20Z

Fixes#13922
Fixes#12409
Part of #13914

Family dispatch, code half only. One new checker in the existing check:pm-* gate family gives the clause-② enqueue gate a reader a seat can point at one pair: the dual carrier is asserted by mechanism, and a limb nobody can read is reported as a missing reading rather than passing for a decision.

⚠️ Premise correction — read this first

#13922 says the dual-carrier rule "has no enforcement at all" and that "there is no check anywhere that a needs:contract-review on one carrier implies it on the other". That is not true, and the correction shaped this PR.

h31ContractReviewCarrierSplit in scripts/pm/check-half-states.mjs is exactly that check. It compares both carriers, in both directions, names the offending PR, and it has a standing caller — .github/workflows/half-state-patrol.yml, four times a day. Measured on this branch: the patrol's last scheduled run before the card was filed was 2026-08-31T13:42:41Z, conclusion success.

Building a second carrier comparison as though H31 did not exist would have produced two predicates that can disagree about the same pair. So this PR imports H31's label constant and H31's delivery relation instead of restating either, and closes only the parts H31 genuinely cannot reach. Those parts are real, and all three were re-measured on the live board today:

Agreement on ABSENCE is H31's silent case, by construction. It fires on a split; a pair carrying the gate on neither carrier is, to it, clean. That is precisely the "all three limbs silent at once" shape The clause-② gate has three limbs and all three were silent on PR #13910 at once — the dual-carrier label rule has no enforcement, and 4 of 6 measured pairs are out of sync #13922 measured on PR fix(rest): a data engine that cannot be RESOLVED no longer answers 403 FORBIDDEN (#13476) #13910 / card [finding] after the #13279 repair, an UNRESOLVABLE data engine still answers 403 FORBIDDEN — the last surviving GRANTS-LOST disguise at the package door #13476.
Nothing read limb ② at all. Grep over scripts/ and .github/workflows/ finds the Clause-② token in a label description and in prose — never in a predicate. The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914 measured the consequence: 2 of 3 cards in one review round carried the declaration as prose or in the PR body, and a card with no declaration is indistinguishable from a card that declared no.
H31's delivery channel trims. Its report is one row family among ~38 rendered into one pinned anchor issue. Measured on the 13:42Z run body: 231 findings, 74 rendered, "157 further row(s) omitted to fit GitHub's issue-body limit." A gate row competes for space with board-hygiene rows, and the anchor then reads clean on the gate.

premise_still_valid is therefore partly false and the surviving defect is narrower and sharper than the card states. It is stated in full in the new file's header so the next reader is not told the original story.

What landed

scripts/pm/check-clause2-carriers.mjs — answers one question and prints only its own rows, so nothing it finds can be crowded out by another mechanism's inventory.

row	what it says	member
C1	the two carriers of one pair disagree — both directions, each with its own consequence	#13922 · #12409
C2	the declaration limb has NO READING: `absent`, `misplaced` (fixed spelling on the thread but not in the claim carrier), or `malformed`	#13914 remedy 2
C3	a declared `Clause-②: yes` with the gate on neither carrier — the fail-open a carrier comparison is structurally blind to	#13922

Modes, and why each exit code is what it is:

default sweep — report-only, exit 0 on a complete sweep whatever it found; 2 when any pair was UNJUDGED (an unread carrier is not a bare carrier, an unread thread is not an absent declaration); 3 PREREQUISITE NOT MET, the constant imported from check-half-states.mjs so the family has one code for it.
--pair PR-NUMBER — a predicate about that pair, so it may answer adversely where the sweep may not: exit 4, deliberately not 3, so a seat reading the status can never turn a refusal into a clearance. A pre-arm tool, ⛔ not a merge gate.
--self-test — offline, 64 cases. This is what lint.yml runs.

Single-sourced, not restated: CONTRACT_REVIEW_LABEL, prDeliversCard, labelNames, CLAIM_COMMENT_MARKER, governingClaim, proxyRearmPlan and EXIT_PREREQUISITE_NOT_MET all come from check-half-states.mjs. This checker and H31 cannot come to disagree about which PR delivers which card.

It writes nothing, ever. Hanging or clearing a review gate from a checker would be issuing the review verdict — 自查放行. Same call H31 makes, for the same reason.

Measured, on the live board

The sweep, run on this branch's head against objectstack-ai/objectstack at 2026-08-31T18:0xZ: 25 card/PR pairs derived from 27 open PRs, 25 findings, 0 UNJUDGED (exit 0).

1 × C1 — a live desync: PR fix(metadata-protocol): serve runtime-authored view containers to org/environment-scoped reads #13929 carries needs:contract-review, card rest/meta: getViewsByObject / GET /meta/view?object= omits a runtime-authored view CONTAINER — #7163/#7736 expansion fix does not cover this path #13407 does not. Verified independently by a second read of both label sets.
2 × C3 — live fail-opens: card [spec] FieldSchema accepts a lookup/master_detail with no reference target, though its own TSDoc calls the key required #13632 (PR fix(spec): require a non-empty reference on lookup/master_detail fields #13927) and card serve 面保证 stored metadata 规范拼写：reference_to → reference 归一化 + spec 裁定 reference_field/referenceField 协议归属（ui#6837 半 1） #13700 (PR Add field-reference-to-alias conversion so stored reference_to serves as reference #13847) each declare Clause-②: yes in the claim comment while neither carrier carries the gate label. PR fix(spec): require a non-empty reference on lookup/master_detail fields #13927 is not draft. Both claims say in their own words that the label was to be hung on both carriers in the same stroke as PR creation.
22 × C2 — 20 NO READING and 2 MISPLACED. The two misplaced ones quote what was there instead, e.g. card [finding] after the #13279 repair, an UNRESOLVABLE data engine still answers 403 FORBIDDEN — the last surviving GRANTS-LOST disguise at the package door #13476: ### Clause ② — 'yes', and it is a FOURTH class, and card A PERMISSION_DENIED refusal never reaches the dispatcher's throw-transparent exit, so it still drops the author's userMessage — a second door, behind #7898's trigger file #13623: ### Clause ② — declared 'yes' conservatively. A PERMISSION_DENIED refusal never reaches the dispatcher's throw-transparent exit, so it still drops the author's userMessage — a second door, behind #7898's trigger file #13623 is one of The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914's own two measured misses, re-observed by mechanism.

⛔ None of these was repaired here. The deliverable is the mechanism; the rows are the PM round's input.

Zone-2 assumptions, tested rather than inherited:

Pairing is machine-derivable — holds, 7 of 7. Every pair in the two cards' tables carries a closing or Part of keyword in the PR body naming its card, and every branch name carries the fallback too. Both channels agree on all seven.
[finding] Both recorded PR-label READ legs came back label-blind in one run — pull_request_read get returned no labels field, and the web-payload grep spelling that works on issues reads zero on a labeled PR #12902's claim that PR-side labels cannot be written — not relied on either way. This PR writes no label from any channel, so the question does not arise for it. What was measured instead is the read side: repo-scoped REST reads and writes both answer 200 from this container, and the sweep read 27 PRs and 25 threads over it.
Whether the sync check belongs in check-half-states.mjs H31/H35 — the stated condition did not hold, and the answer is standalone anyway. Open PR fix(pm): mask the fixture builders only a self-test can reach #13930 changes scripts/pm/dispatch-gates.mjs, not check-half-states.mjs, so H31/H35 were not held. Standalone is still right, because the trimming measurement above says a new row family added to that report is a row family that can be omitted before a reader sees it. H31/H35 are untouched; dispatch-gates.mjs is untouched.

Two things recorded rather than acted on

1. The two directions of a split are not ranked, because the two standing sources rank them oppositely. H31's header calls the card-bare direction "the more dangerous half" (an ungated card enqueues past a live gate). #13922 calls the PR-bare direction the fail-open ("it is the carrier the enqueue gate reads"). Both are sound about their own consumer. This checker states each direction's consequence and ranks neither — picking one would print an adjudication as a derivation. Which carrier the enqueue gate actually reads is a protocol question for the maintainer.

2. What this implies for .claude/skills/pm-dispatch/references/contract-review.md — recorded here, no edit landed. That file is held by pending human-merge PR #13746 and is outside this dispatch's surface. Two of its sentences are affected:

The 重挂前先查裁决 recovery rule reads "label absent" as probably cleared. The clause-② gate has three limbs and all three were silent on PR #13910 at once — the dual-carrier label rule has no enforcement, and 4 of 6 measured pairs are out of sync #13922 falsified its premise by measurement. --pair now answers that question directly for one pair instead of inferring it, so the recovery rule could point at the checker rather than at an inference.
The PR 与卡双载体同笔挂 rule now has a mechanical reader, which it did not when the text was written. Naming check-clause2-carriers.mjs --pair beside it would let the prose stop being the only executor.

Neither sentence is edited by this PR.

Scope, held

[finding] The contract-review gate is being hung on ONE carrier — 34 of 36 lone clears had a PR that never carried it, which makes a strip undetectable #12409 is taken on its mechanically-forced half only — enforcing the standing 2026-08-22 ruling 「两边都挂好」, which the card's own four-facet analysis marked as needing no new ruling to start. The un-ruled half stays open for the maintainer: a canonical machine-readable spelling for the review VERDICT (repair 2 — the Contract review: PASS marker that matched 5 of 35 removals strictly and 26 loosely). This PR gives the declaration a reader; it gives the verdict none, deliberately. That residue is named in the wrap-up comment on [finding] The contract-review gate is being hung on ONE carrier — 34 of 36 lone clears had a PR that never carried it, which makes a strip undetectable #12409.
The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914 is Part of, remedy 2 only. The claim-comment template in .claude/skills/pm-dispatch/SKILL.md (remedy 1) is not touched and the card stays open for it.
⛔ No patrol predicate widened to absorb prose. The fixed spelling stays exactly Clause-②: yes / Clause-②: no. Decoration around the line is tolerated the way H4 tolerates it; reasoning after the value token is accepted because that is the shape The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914 records as its control (os lint never surfaces ADR-0087 conversion notices — it normalizes with no onConversionNotice sink, the #3782 parity gap os build was in #12297 "carries Clause-②: yes with reasoning"). A reader that rejected it would have graded the card's own control as the defect — and it did, on four real claims, before that case was written. Clause-②: YES, Clause-②: nope, Clause-②: probably not, an empty value and the prose form Clause ②: yes all stay unread, and are quoted back in the row so the residue is actionable.
⛔ No carrier collapse, no branch-protection or required-set change, no new merge gate: the lint.yml step runs the self-test only, the same split as check:pm-half-states and check:pm-governed-merges beside it.
Escalation clause not triggered: no new protocol spelling and no new gate category were invented. Every row asserts a rule that already stands.

Verification

Derived on this PR's own final head — node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, at this PR's final head 850a759 (4 paths vs merge base 0f63965ea; the union is byte-identical to the one derived at d06df85, and it was re-run in full on 850a759 with the same result): 33 families + 2 convention-triggered obligations = 35 commands, all run serially under scripts/pm/os-verify-lock.sh.

32 of 35 exit 0. Including both convention obligations an added gate script incurs — node scripts/pm/bare-root-worklist.mjs --self-test and pnpm check:pm-dispatch-gates — plus check:self-test-wired, check:entry-guard, check:parse-guard, check:watch-hint-literal, check:pm-label-desc-cap and check:required-contexts.

The other 3 are NOT MEASURED, not red — each says so in its own verdict text, and each needs a full package build this diff cannot affect (it touches no package source):

gate	exit	its own words
`check-test-completeness.mjs`	3	"PREREQUISITE NOT MET … the local reading for this gate is NOT MEASURED. ⛔ It is not a red, and there is nothing here to fix."
`check:dual-build-cjs-loads`	3	"PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/. Run `pnpm build` first. ⛔ This is NOT a pass: nothing was measured."
`check:type-check-debt`	1	its `--self-test` and coverage read pass; `--re-measure` refuses without the built closure, because measuring there "would silently measure a DIFFERENT WORLD"

Also run, because this checker imports it: pnpm check:pm-half-states — 1826 cases pass, so the imported surface is intact.

Every exit code was exercised live, in the direction predicted before the run:

run	exit	reading
`--pair 13944` (this PR)	0	its three pairs — #13922, #12409, #13914 — all declare `Clause-②: no` in the fixed spelling and both carriers agree. Three green lines, the clean control.
`--pair 13847`	4	the C3 row on card #13700. A verdict about that pair, not about the environment.
`--pair 13944`, earlier attempt	3	a transient `HTTP 502` on the PR listing, on a route where `curl` returned 200 throughout. It refused with "0 pair(s) had been read … NOT a reading of a clean board" rather than reporting green — which is why the listing now carries the same single retry the per-pair reads do (third commit).

Live evidence beyond the self-test: the sweep output above, plus an independent second read of the label sets on #13929/#13407, #13927/#13632 and #13847/#13700 confirming every C1 and C3 row.

Authored in session session_01Msg17tAHJ3jVTYFgHydCm2 (durable copy of the attribution, because a body edit normalises the footer's session URL away).

No changeset: this diff publishes nothing — scripts/pm/**, a workflow, and a script registration in the private root manifest. skip-changeset applies and is attached.

Generated by Claude Code

`needs:contract-review` is a dual-carrier gate by the maintainer's ruling of 2026-08-22 (「两边都挂好」), and its content limb is a fixed machine spelling in the card's claim comment. Neither had a reader that a seat could point at one pair: H31 in `check-half-states.mjs` compares the two carriers, but it is silent when the gate is missing from BOTH (agreement on absence is its silent case) and it reports through a patrol body that trims — 231 findings, 74 rendered on the 2026-08-31T13:42Z run. The declaration limb had no reader at all: grep over `scripts/` and `.github/workflows/` finds the token only in a label description and in prose. `scripts/pm/check-clause2-carriers.mjs` answers exactly that one question and prints only its own rows: C1 the two carriers of one pair disagree. Both directions, each with its own consequence, neither ranked — H31 and #13922 rank them oppositely and this file records the disagreement rather than adjudicating it. C2 the declaration limb has NO READING: absent, misplaced (the fixed spelling on the thread but not in the claim carrier), or malformed. A missing reading is never collapsed into a declared `no`. C3 a declared `yes` with the gate on NEITHER carrier — the fail-open a carrier comparison is structurally blind to. The label constant, the `prDeliversCard` delivery relation and the shared PREREQUISITE-NOT-MET exit code are imported from `check-half-states.mjs`, so this checker and H31 cannot come to disagree about which PR delivers which card. It writes nothing, ever: hanging or clearing a review gate from a checker would be issuing the verdict. The fixed spelling is not relaxed. Decoration around the line is tolerated the way H4 tolerates it, and reasoning after the value token is accepted because that is the shape #13914 records as its control; prose, a different case and a word merely starting with the token all stay unread and are quoted back in the row so the residue is actionable. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msg17tAHJ3jVTYFgHydCm2

The filing card read this file as the place the dual-carrier rule should have been enforced and found only label-object reconciliation there — a fair reading, because nothing in the file said otherwise. State the boundary, and point at the two files that answer the hanging question instead: H31 for the board-wide carrier comparison, and the new per-pair checker for the same comparison anchored on one pair plus the declaration limb this repo had no reader for. ⛔ No behaviour change: this file still reconciles the label object and nothing else, and none of the three writes the label. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msg17tAHJ3jVTYFgHydCm2

…ds have A failure on the listing is TOTAL — no pair is formed, so the run refuses with "0 pair(s) had been read", which is the correct answer and exactly why it should not be spent on a blip. Measured while verifying this branch: a transient HTTP 502 on page 1 refused a --pair run that answered in a second on the next attempt, on a route where curl was returning 200 throughout. ⛔ Still one retry, not a loop: a second failure is the answer, and a sweep that keeps trying is a sweep that hides an exhausted quota. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msg17tAHJ3jVTYFgHydCm2

claude · 2026-08-31T18:08:20Z

Fixes#13922
Fixes#12409
Part of #13914

Family dispatch, code half only. One new checker in the existing check:pm-* gate family gives the clause-② enqueue gate a reader a seat can point at one pair: the dual carrier is asserted by mechanism, and a limb nobody can read is reported as a missing reading rather than passing for a decision.

⚠️ Premise correction — read this first

#13922 says the dual-carrier rule "has no enforcement at all" and that "there is no check anywhere that a needs:contract-review on one carrier implies it on the other". That is not true, and the correction shaped this PR.

h31ContractReviewCarrierSplit in scripts/pm/check-half-states.mjs is exactly that check. It compares both carriers, in both directions, names the offending PR, and it has a standing caller — .github/workflows/half-state-patrol.yml, four times a day. Measured on this branch: the patrol's last scheduled run before the card was filed was 2026-08-31T13:42:41Z, conclusion success.

Building a second carrier comparison as though H31 did not exist would have produced two predicates that can disagree about the same pair. So this PR imports H31's label constant and H31's delivery relation instead of restating either, and closes only the parts H31 genuinely cannot reach. Those parts are real, and all three were re-measured on the live board today:

Agreement on ABSENCE is H31's silent case, by construction. It fires on a split; a pair carrying the gate on neither carrier is, to it, clean. That is precisely the "all three limbs silent at once" shape The clause-② gate has three limbs and all three were silent on PR #13910 at once — the dual-carrier label rule has no enforcement, and 4 of 6 measured pairs are out of sync #13922 measured on PR fix(rest): a data engine that cannot be RESOLVED no longer answers 403 FORBIDDEN (#13476) #13910 / card [finding] after the #13279 repair, an UNRESOLVABLE data engine still answers 403 FORBIDDEN — the last surviving GRANTS-LOST disguise at the package door #13476.
Nothing read limb ② at all. Grep over scripts/ and .github/workflows/ finds the Clause-② token in a label description and in prose — never in a predicate. The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914 measured the consequence: 2 of 3 cards in one review round carried the declaration as prose or in the PR body, and a card with no declaration is indistinguishable from a card that declared no.
H31's delivery channel trims. Its report is one row family among ~38 rendered into one pinned anchor issue. Measured on the 13:42Z run body: 231 findings, 74 rendered, "157 further row(s) omitted to fit GitHub's issue-body limit." A gate row competes for space with board-hygiene rows, and the anchor then reads clean on the gate.

premise_still_valid is therefore partly false and the surviving defect is narrower and sharper than the card states. It is stated in full in the new file's header so the next reader is not told the original story.

What landed

scripts/pm/check-clause2-carriers.mjs — answers one question and prints only its own rows, so nothing it finds can be crowded out by another mechanism's inventory.

row	what it says	member
C1	the two carriers of one pair disagree — both directions, each with its own consequence	#13922 · #12409
C2	the declaration limb has NO READING: `absent`, `misplaced` (fixed spelling on the thread but not in the claim carrier), or `malformed`	#13914 remedy 2
C3	a declared `Clause-②: yes` with the gate on neither carrier — the fail-open a carrier comparison is structurally blind to	#13922

Modes, and why each exit code is what it is:

default sweep — report-only, exit 0 on a complete sweep whatever it found; 2 when any pair was UNJUDGED (an unread carrier is not a bare carrier, an unread thread is not an absent declaration); 3 PREREQUISITE NOT MET, the constant imported from check-half-states.mjs so the family has one code for it.
--pair PR-NUMBER — a predicate about that pair, so it may answer adversely where the sweep may not: exit 4, deliberately not 3, so a seat reading the status can never turn a refusal into a clearance. A pre-arm tool, ⛔ not a merge gate.
--self-test — offline, 64 cases. This is what lint.yml runs.

Single-sourced, not restated: CONTRACT_REVIEW_LABEL, prDeliversCard, labelNames, CLAIM_COMMENT_MARKER, governingClaim, proxyRearmPlan and EXIT_PREREQUISITE_NOT_MET all come from check-half-states.mjs. This checker and H31 cannot come to disagree about which PR delivers which card.

It writes nothing, ever. Hanging or clearing a review gate from a checker would be issuing the review verdict — 自查放行. Same call H31 makes, for the same reason.

Measured, on the live board

The sweep, run on this branch's head against objectstack-ai/objectstack at 2026-08-31T18:0xZ: 25 card/PR pairs derived from 27 open PRs, 25 findings, 0 UNJUDGED (exit 0).

1 × C1 — a live desync: PR fix(metadata-protocol): serve runtime-authored view containers to org/environment-scoped reads #13929 carries needs:contract-review, card rest/meta: getViewsByObject / GET /meta/view?object= omits a runtime-authored view CONTAINER — #7163/#7736 expansion fix does not cover this path #13407 does not. Verified independently by a second read of both label sets.
2 × C3 — live fail-opens: card [spec] FieldSchema accepts a lookup/master_detail with no reference target, though its own TSDoc calls the key required #13632 (PR fix(spec): require a non-empty reference on lookup/master_detail fields #13927) and card serve 面保证 stored metadata 规范拼写：reference_to → reference 归一化 + spec 裁定 reference_field/referenceField 协议归属（ui#6837 半 1） #13700 (PR Add field-reference-to-alias conversion so stored reference_to serves as reference #13847) each declare Clause-②: yes in the claim comment while neither carrier carries the gate label. PR fix(spec): require a non-empty reference on lookup/master_detail fields #13927 is not draft. Both claims say in their own words that the label was to be hung on both carriers in the same stroke as PR creation.
22 × C2 — 20 NO READING and 2 MISPLACED. The two misplaced ones quote what was there instead, e.g. card [finding] after the #13279 repair, an UNRESOLVABLE data engine still answers 403 FORBIDDEN — the last surviving GRANTS-LOST disguise at the package door #13476: ### Clause ② — 'yes', and it is a FOURTH class, and card A PERMISSION_DENIED refusal never reaches the dispatcher's throw-transparent exit, so it still drops the author's userMessage — a second door, behind #7898's trigger file #13623: ### Clause ② — declared 'yes' conservatively. A PERMISSION_DENIED refusal never reaches the dispatcher's throw-transparent exit, so it still drops the author's userMessage — a second door, behind #7898's trigger file #13623 is one of The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914's own two measured misses, re-observed by mechanism.

⛔ None of these was repaired here. The deliverable is the mechanism; the rows are the PM round's input.

Zone-2 assumptions, tested rather than inherited:

Pairing is machine-derivable — holds, 7 of 7. Every pair in the two cards' tables carries a closing or Part of keyword in the PR body naming its card, and every branch name carries the fallback too. Both channels agree on all seven.
[finding] Both recorded PR-label READ legs came back label-blind in one run — pull_request_read get returned no labels field, and the web-payload grep spelling that works on issues reads zero on a labeled PR #12902's claim that PR-side labels cannot be written — not relied on either way. This PR writes no label from any channel, so the question does not arise for it. What was measured instead is the read side: repo-scoped REST reads and writes both answer 200 from this container, and the sweep read 27 PRs and 25 threads over it.
Whether the sync check belongs in check-half-states.mjs H31/H35 — the stated condition did not hold, and the answer is standalone anyway. Open PR fix(pm): mask the fixture builders only a self-test can reach #13930 changes scripts/pm/dispatch-gates.mjs, not check-half-states.mjs, so H31/H35 were not held. Standalone is still right, because the trimming measurement above says a new row family added to that report is a row family that can be omitted before a reader sees it. H31/H35 are untouched; dispatch-gates.mjs is untouched.

Two things recorded rather than acted on

1. The two directions of a split are not ranked, because the two standing sources rank them oppositely. H31's header calls the card-bare direction "the more dangerous half" (an ungated card enqueues past a live gate). #13922 calls the PR-bare direction the fail-open ("it is the carrier the enqueue gate reads"). Both are sound about their own consumer. This checker states each direction's consequence and ranks neither — picking one would print an adjudication as a derivation. Which carrier the enqueue gate actually reads is a protocol question for the maintainer.

2. What this implies for .claude/skills/pm-dispatch/references/contract-review.md — recorded here, no edit landed. That file is held by pending human-merge PR #13746 and is outside this dispatch's surface. Two of its sentences are affected:

The 重挂前先查裁决 recovery rule reads "label absent" as probably cleared. The clause-② gate has three limbs and all three were silent on PR #13910 at once — the dual-carrier label rule has no enforcement, and 4 of 6 measured pairs are out of sync #13922 falsified its premise by measurement. --pair now answers that question directly for one pair instead of inferring it, so the recovery rule could point at the checker rather than at an inference.
The PR 与卡双载体同笔挂 rule now has a mechanical reader, which it did not when the text was written. Naming check-clause2-carriers.mjs --pair beside it would let the prose stop being the only executor.

Neither sentence is edited by this PR.

Scope, held

[finding] The contract-review gate is being hung on ONE carrier — 34 of 36 lone clears had a PR that never carried it, which makes a strip undetectable #12409 is taken on its mechanically-forced half only — enforcing the standing 2026-08-22 ruling 「两边都挂好」, which the card's own four-facet analysis marked as needing no new ruling to start. The un-ruled half stays open for the maintainer: a canonical machine-readable spelling for the review VERDICT (repair 2 — the Contract review: PASS marker that matched 5 of 35 removals strictly and 26 loosely). This PR gives the declaration a reader; it gives the verdict none, deliberately. That residue is named in the wrap-up comment on [finding] The contract-review gate is being hung on ONE carrier — 34 of 36 lone clears had a PR that never carried it, which makes a strip undetectable #12409.
The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914 is Part of, remedy 2 only. The claim-comment template in .claude/skills/pm-dispatch/SKILL.md (remedy 1) is not touched and the card stays open for it.
⛔ No patrol predicate widened to absorb prose. The fixed spelling stays exactly Clause-②: yes / Clause-②: no. Decoration around the line is tolerated the way H4 tolerates it; reasoning after the value token is accepted because that is the shape The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914 records as its control (os lint never surfaces ADR-0087 conversion notices — it normalizes with no onConversionNotice sink, the #3782 parity gap os build was in #12297 "carries Clause-②: yes with reasoning"). A reader that rejected it would have graded the card's own control as the defect — and it did, on four real claims, before that case was written. Clause-②: YES, Clause-②: nope, Clause-②: probably not, an empty value and the prose form Clause ②: yes all stay unread, and are quoted back in the row so the residue is actionable.
⛔ No carrier collapse, no branch-protection or required-set change, no new merge gate: the lint.yml step runs the self-test only, the same split as check:pm-half-states and check:pm-governed-merges beside it.
Escalation clause not triggered: no new protocol spelling and no new gate category were invented. Every row asserts a rule that already stands.

Verification

Derived on this PR's own final head — node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, at this PR's final head 850a759 (4 paths vs merge base 0f63965ea; the union is byte-identical to the one derived at d06df85, and it was re-run in full on 850a759 with the same result): 33 families + 2 convention-triggered obligations = 35 commands, all run serially under scripts/pm/os-verify-lock.sh.

32 of 35 exit 0. Including both convention obligations an added gate script incurs — node scripts/pm/bare-root-worklist.mjs --self-test and pnpm check:pm-dispatch-gates — plus check:self-test-wired, check:entry-guard, check:parse-guard, check:watch-hint-literal, check:pm-label-desc-cap and check:required-contexts.

The other 3 are NOT MEASURED, not red — each says so in its own verdict text, and each needs a full package build this diff cannot affect (it touches no package source):

gate	exit	its own words
`check-test-completeness.mjs`	3	"PREREQUISITE NOT MET … the local reading for this gate is NOT MEASURED. ⛔ It is not a red, and there is nothing here to fix."
`check:dual-build-cjs-loads`	3	"PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/. Run `pnpm build` first. ⛔ This is NOT a pass: nothing was measured."
`check:type-check-debt`	1	its `--self-test` and coverage read pass; `--re-measure` refuses without the built closure, because measuring there "would silently measure a DIFFERENT WORLD"

Also run, because this checker imports it: pnpm check:pm-half-states — 1826 cases pass, so the imported surface is intact.

Every exit code was exercised live, in the direction predicted before the run:

run	exit	reading
`--pair 13944` (this PR)	0	its three pairs — #13922, #12409, #13914 — all declare `Clause-②: no` in the fixed spelling and both carriers agree. Three green lines, the clean control.
`--pair 13847`	4	the C3 row on card #13700. A verdict about that pair, not about the environment.
`--pair 13944`, earlier attempt	3	a transient `HTTP 502` on the PR listing, on a route where `curl` returned 200 throughout. It refused with "0 pair(s) had been read … NOT a reading of a clean board" rather than reporting green — which is why the listing now carries the same single retry the per-pair reads do (third commit).

Live evidence beyond the self-test: the sweep output above, plus an independent second read of the label sets on #13929/#13407, #13927/#13632 and #13847/#13700 confirming every C1 and C3 row.

Authored in session session_01Msg17tAHJ3jVTYFgHydCm2 (durable copy of the attribution, because a body edit normalises the footer's session URL away).

No changeset: this diff publishes nothing — scripts/pm/**, a workflow, and a script registration in the private root manifest. skip-changeset applies and is attached.

Generated by Claude Code

`needs:contract-review` is a dual-carrier gate by the maintainer's ruling of 2026-08-22 (「两边都挂好」), and its content limb is a fixed machine spelling in the card's claim comment. Neither had a reader that a seat could point at one pair: H31 in `check-half-states.mjs` compares the two carriers, but it is silent when the gate is missing from BOTH (agreement on absence is its silent case) and it reports through a patrol body that trims — 231 findings, 74 rendered on the 2026-08-31T13:42Z run. The declaration limb had no reader at all: grep over `scripts/` and `.github/workflows/` finds the token only in a label description and in prose. `scripts/pm/check-clause2-carriers.mjs` answers exactly that one question and prints only its own rows: C1 the two carriers of one pair disagree. Both directions, each with its own consequence, neither ranked — H31 and #13922 rank them oppositely and this file records the disagreement rather than adjudicating it. C2 the declaration limb has NO READING: absent, misplaced (the fixed spelling on the thread but not in the claim carrier), or malformed. A missing reading is never collapsed into a declared `no`. C3 a declared `yes` with the gate on NEITHER carrier — the fail-open a carrier comparison is structurally blind to. The label constant, the `prDeliversCard` delivery relation and the shared PREREQUISITE-NOT-MET exit code are imported from `check-half-states.mjs`, so this checker and H31 cannot come to disagree about which PR delivers which card. It writes nothing, ever: hanging or clearing a review gate from a checker would be issuing the verdict. The fixed spelling is not relaxed. Decoration around the line is tolerated the way H4 tolerates it, and reasoning after the value token is accepted because that is the shape #13914 records as its control; prose, a different case and a word merely starting with the token all stay unread and are quoted back in the row so the residue is actionable. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msg17tAHJ3jVTYFgHydCm2

The filing card read this file as the place the dual-carrier rule should have been enforced and found only label-object reconciliation there — a fair reading, because nothing in the file said otherwise. State the boundary, and point at the two files that answer the hanging question instead: H31 for the board-wide carrier comparison, and the new per-pair checker for the same comparison anchored on one pair plus the declaration limb this repo had no reader for. ⛔ No behaviour change: this file still reconciles the label object and nothing else, and none of the three writes the label. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msg17tAHJ3jVTYFgHydCm2

…ds have A failure on the listing is TOTAL — no pair is formed, so the run refuses with "0 pair(s) had been read", which is the correct answer and exactly why it should not be spent on a blip. Measured while verifying this branch: a transient HTTP 502 on page 1 refused a --pair run that answered in a second on the next attempt, on a route where curl was returning 200 throughout. ⛔ Still one retry, not a loop: a second failure is the answer, and a sweep that keeps trying is a sweep that hides an exhausted quota. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msg17tAHJ3jVTYFgHydCm2

claude · 2026-08-31T18:08:20Z

Fixes#13922
Fixes#12409
Part of #13914

Family dispatch, code half only. One new checker in the existing check:pm-* gate family gives the clause-② enqueue gate a reader a seat can point at one pair: the dual carrier is asserted by mechanism, and a limb nobody can read is reported as a missing reading rather than passing for a decision.

⚠️ Premise correction — read this first

#13922 says the dual-carrier rule "has no enforcement at all" and that "there is no check anywhere that a needs:contract-review on one carrier implies it on the other". That is not true, and the correction shaped this PR.

h31ContractReviewCarrierSplit in scripts/pm/check-half-states.mjs is exactly that check. It compares both carriers, in both directions, names the offending PR, and it has a standing caller — .github/workflows/half-state-patrol.yml, four times a day. Measured on this branch: the patrol's last scheduled run before the card was filed was 2026-08-31T13:42:41Z, conclusion success.

Building a second carrier comparison as though H31 did not exist would have produced two predicates that can disagree about the same pair. So this PR imports H31's label constant and H31's delivery relation instead of restating either, and closes only the parts H31 genuinely cannot reach. Those parts are real, and all three were re-measured on the live board today:

Agreement on ABSENCE is H31's silent case, by construction. It fires on a split; a pair carrying the gate on neither carrier is, to it, clean. That is precisely the "all three limbs silent at once" shape The clause-② gate has three limbs and all three were silent on PR #13910 at once — the dual-carrier label rule has no enforcement, and 4 of 6 measured pairs are out of sync #13922 measured on PR fix(rest): a data engine that cannot be RESOLVED no longer answers 403 FORBIDDEN (#13476) #13910 / card [finding] after the #13279 repair, an UNRESOLVABLE data engine still answers 403 FORBIDDEN — the last surviving GRANTS-LOST disguise at the package door #13476.
Nothing read limb ② at all. Grep over scripts/ and .github/workflows/ finds the Clause-② token in a label description and in prose — never in a predicate. The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914 measured the consequence: 2 of 3 cards in one review round carried the declaration as prose or in the PR body, and a card with no declaration is indistinguishable from a card that declared no.
H31's delivery channel trims. Its report is one row family among ~38 rendered into one pinned anchor issue. Measured on the 13:42Z run body: 231 findings, 74 rendered, "157 further row(s) omitted to fit GitHub's issue-body limit." A gate row competes for space with board-hygiene rows, and the anchor then reads clean on the gate.

premise_still_valid is therefore partly false and the surviving defect is narrower and sharper than the card states. It is stated in full in the new file's header so the next reader is not told the original story.

What landed

scripts/pm/check-clause2-carriers.mjs — answers one question and prints only its own rows, so nothing it finds can be crowded out by another mechanism's inventory.

row	what it says	member
C1	the two carriers of one pair disagree — both directions, each with its own consequence	#13922 · #12409
C2	the declaration limb has NO READING: `absent`, `misplaced` (fixed spelling on the thread but not in the claim carrier), or `malformed`	#13914 remedy 2
C3	a declared `Clause-②: yes` with the gate on neither carrier — the fail-open a carrier comparison is structurally blind to	#13922

Modes, and why each exit code is what it is:

default sweep — report-only, exit 0 on a complete sweep whatever it found; 2 when any pair was UNJUDGED (an unread carrier is not a bare carrier, an unread thread is not an absent declaration); 3 PREREQUISITE NOT MET, the constant imported from check-half-states.mjs so the family has one code for it.
--pair PR-NUMBER — a predicate about that pair, so it may answer adversely where the sweep may not: exit 4, deliberately not 3, so a seat reading the status can never turn a refusal into a clearance. A pre-arm tool, ⛔ not a merge gate.
--self-test — offline, 64 cases. This is what lint.yml runs.

Single-sourced, not restated: CONTRACT_REVIEW_LABEL, prDeliversCard, labelNames, CLAIM_COMMENT_MARKER, governingClaim, proxyRearmPlan and EXIT_PREREQUISITE_NOT_MET all come from check-half-states.mjs. This checker and H31 cannot come to disagree about which PR delivers which card.

It writes nothing, ever. Hanging or clearing a review gate from a checker would be issuing the review verdict — 自查放行. Same call H31 makes, for the same reason.

Measured, on the live board

The sweep, run on this branch's head against objectstack-ai/objectstack at 2026-08-31T18:0xZ: 25 card/PR pairs derived from 27 open PRs, 25 findings, 0 UNJUDGED (exit 0).

1 × C1 — a live desync: PR fix(metadata-protocol): serve runtime-authored view containers to org/environment-scoped reads #13929 carries needs:contract-review, card rest/meta: getViewsByObject / GET /meta/view?object= omits a runtime-authored view CONTAINER — #7163/#7736 expansion fix does not cover this path #13407 does not. Verified independently by a second read of both label sets.
2 × C3 — live fail-opens: card [spec] FieldSchema accepts a lookup/master_detail with no reference target, though its own TSDoc calls the key required #13632 (PR fix(spec): require a non-empty reference on lookup/master_detail fields #13927) and card serve 面保证 stored metadata 规范拼写：reference_to → reference 归一化 + spec 裁定 reference_field/referenceField 协议归属（ui#6837 半 1） #13700 (PR Add field-reference-to-alias conversion so stored reference_to serves as reference #13847) each declare Clause-②: yes in the claim comment while neither carrier carries the gate label. PR fix(spec): require a non-empty reference on lookup/master_detail fields #13927 is not draft. Both claims say in their own words that the label was to be hung on both carriers in the same stroke as PR creation.
22 × C2 — 20 NO READING and 2 MISPLACED. The two misplaced ones quote what was there instead, e.g. card [finding] after the #13279 repair, an UNRESOLVABLE data engine still answers 403 FORBIDDEN — the last surviving GRANTS-LOST disguise at the package door #13476: ### Clause ② — 'yes', and it is a FOURTH class, and card A PERMISSION_DENIED refusal never reaches the dispatcher's throw-transparent exit, so it still drops the author's userMessage — a second door, behind #7898's trigger file #13623: ### Clause ② — declared 'yes' conservatively. A PERMISSION_DENIED refusal never reaches the dispatcher's throw-transparent exit, so it still drops the author's userMessage — a second door, behind #7898's trigger file #13623 is one of The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914's own two measured misses, re-observed by mechanism.

⛔ None of these was repaired here. The deliverable is the mechanism; the rows are the PM round's input.

Zone-2 assumptions, tested rather than inherited:

Pairing is machine-derivable — holds, 7 of 7. Every pair in the two cards' tables carries a closing or Part of keyword in the PR body naming its card, and every branch name carries the fallback too. Both channels agree on all seven.
[finding] Both recorded PR-label READ legs came back label-blind in one run — pull_request_read get returned no labels field, and the web-payload grep spelling that works on issues reads zero on a labeled PR #12902's claim that PR-side labels cannot be written — not relied on either way. This PR writes no label from any channel, so the question does not arise for it. What was measured instead is the read side: repo-scoped REST reads and writes both answer 200 from this container, and the sweep read 27 PRs and 25 threads over it.
Whether the sync check belongs in check-half-states.mjs H31/H35 — the stated condition did not hold, and the answer is standalone anyway. Open PR fix(pm): mask the fixture builders only a self-test can reach #13930 changes scripts/pm/dispatch-gates.mjs, not check-half-states.mjs, so H31/H35 were not held. Standalone is still right, because the trimming measurement above says a new row family added to that report is a row family that can be omitted before a reader sees it. H31/H35 are untouched; dispatch-gates.mjs is untouched.

Two things recorded rather than acted on

1. The two directions of a split are not ranked, because the two standing sources rank them oppositely. H31's header calls the card-bare direction "the more dangerous half" (an ungated card enqueues past a live gate). #13922 calls the PR-bare direction the fail-open ("it is the carrier the enqueue gate reads"). Both are sound about their own consumer. This checker states each direction's consequence and ranks neither — picking one would print an adjudication as a derivation. Which carrier the enqueue gate actually reads is a protocol question for the maintainer.

2. What this implies for .claude/skills/pm-dispatch/references/contract-review.md — recorded here, no edit landed. That file is held by pending human-merge PR #13746 and is outside this dispatch's surface. Two of its sentences are affected:

The 重挂前先查裁决 recovery rule reads "label absent" as probably cleared. The clause-② gate has three limbs and all three were silent on PR #13910 at once — the dual-carrier label rule has no enforcement, and 4 of 6 measured pairs are out of sync #13922 falsified its premise by measurement. --pair now answers that question directly for one pair instead of inferring it, so the recovery rule could point at the checker rather than at an inference.
The PR 与卡双载体同笔挂 rule now has a mechanical reader, which it did not when the text was written. Naming check-clause2-carriers.mjs --pair beside it would let the prose stop being the only executor.

Neither sentence is edited by this PR.

Scope, held

[finding] The contract-review gate is being hung on ONE carrier — 34 of 36 lone clears had a PR that never carried it, which makes a strip undetectable #12409 is taken on its mechanically-forced half only — enforcing the standing 2026-08-22 ruling 「两边都挂好」, which the card's own four-facet analysis marked as needing no new ruling to start. The un-ruled half stays open for the maintainer: a canonical machine-readable spelling for the review VERDICT (repair 2 — the Contract review: PASS marker that matched 5 of 35 removals strictly and 26 loosely). This PR gives the declaration a reader; it gives the verdict none, deliberately. That residue is named in the wrap-up comment on [finding] The contract-review gate is being hung on ONE carrier — 34 of 36 lone clears had a PR that never carried it, which makes a strip undetectable #12409.
The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914 is Part of, remedy 2 only. The claim-comment template in .claude/skills/pm-dispatch/SKILL.md (remedy 1) is not touched and the card stays open for it.
⛔ No patrol predicate widened to absorb prose. The fixed spelling stays exactly Clause-②: yes / Clause-②: no. Decoration around the line is tolerated the way H4 tolerates it; reasoning after the value token is accepted because that is the shape The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914 records as its control (os lint never surfaces ADR-0087 conversion notices — it normalizes with no onConversionNotice sink, the #3782 parity gap os build was in #12297 "carries Clause-②: yes with reasoning"). A reader that rejected it would have graded the card's own control as the defect — and it did, on four real claims, before that case was written. Clause-②: YES, Clause-②: nope, Clause-②: probably not, an empty value and the prose form Clause ②: yes all stay unread, and are quoted back in the row so the residue is actionable.
⛔ No carrier collapse, no branch-protection or required-set change, no new merge gate: the lint.yml step runs the self-test only, the same split as check:pm-half-states and check:pm-governed-merges beside it.
Escalation clause not triggered: no new protocol spelling and no new gate category were invented. Every row asserts a rule that already stands.

Verification

Derived on this PR's own final head — node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, at this PR's final head 850a759 (4 paths vs merge base 0f63965ea; the union is byte-identical to the one derived at d06df85, and it was re-run in full on 850a759 with the same result): 33 families + 2 convention-triggered obligations = 35 commands, all run serially under scripts/pm/os-verify-lock.sh.

32 of 35 exit 0. Including both convention obligations an added gate script incurs — node scripts/pm/bare-root-worklist.mjs --self-test and pnpm check:pm-dispatch-gates — plus check:self-test-wired, check:entry-guard, check:parse-guard, check:watch-hint-literal, check:pm-label-desc-cap and check:required-contexts.

The other 3 are NOT MEASURED, not red — each says so in its own verdict text, and each needs a full package build this diff cannot affect (it touches no package source):

gate	exit	its own words
`check-test-completeness.mjs`	3	"PREREQUISITE NOT MET … the local reading for this gate is NOT MEASURED. ⛔ It is not a red, and there is nothing here to fix."
`check:dual-build-cjs-loads`	3	"PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/. Run `pnpm build` first. ⛔ This is NOT a pass: nothing was measured."
`check:type-check-debt`	1	its `--self-test` and coverage read pass; `--re-measure` refuses without the built closure, because measuring there "would silently measure a DIFFERENT WORLD"

Also run, because this checker imports it: pnpm check:pm-half-states — 1826 cases pass, so the imported surface is intact.

Every exit code was exercised live, in the direction predicted before the run:

run	exit	reading
`--pair 13944` (this PR)	0	its three pairs — #13922, #12409, #13914 — all declare `Clause-②: no` in the fixed spelling and both carriers agree. Three green lines, the clean control.
`--pair 13847`	4	the C3 row on card #13700. A verdict about that pair, not about the environment.
`--pair 13944`, earlier attempt	3	a transient `HTTP 502` on the PR listing, on a route where `curl` returned 200 throughout. It refused with "0 pair(s) had been read … NOT a reading of a clean board" rather than reporting green — which is why the listing now carries the same single retry the per-pair reads do (third commit).

Live evidence beyond the self-test: the sweep output above, plus an independent second read of the label sets on #13929/#13407, #13927/#13632 and #13847/#13700 confirming every C1 and C3 row.

Authored in session session_01Msg17tAHJ3jVTYFgHydCm2 (durable copy of the attribution, because a body edit normalises the footer's session URL away).

No changeset: this diff publishes nothing — scripts/pm/**, a workflow, and a script registration in the private root manifest. skip-changeset applies and is attached.

Generated by Claude Code

`needs:contract-review` is a dual-carrier gate by the maintainer's ruling of 2026-08-22 (「两边都挂好」), and its content limb is a fixed machine spelling in the card's claim comment. Neither had a reader that a seat could point at one pair: H31 in `check-half-states.mjs` compares the two carriers, but it is silent when the gate is missing from BOTH (agreement on absence is its silent case) and it reports through a patrol body that trims — 231 findings, 74 rendered on the 2026-08-31T13:42Z run. The declaration limb had no reader at all: grep over `scripts/` and `.github/workflows/` finds the token only in a label description and in prose. `scripts/pm/check-clause2-carriers.mjs` answers exactly that one question and prints only its own rows: C1 the two carriers of one pair disagree. Both directions, each with its own consequence, neither ranked — H31 and #13922 rank them oppositely and this file records the disagreement rather than adjudicating it. C2 the declaration limb has NO READING: absent, misplaced (the fixed spelling on the thread but not in the claim carrier), or malformed. A missing reading is never collapsed into a declared `no`. C3 a declared `yes` with the gate on NEITHER carrier — the fail-open a carrier comparison is structurally blind to. The label constant, the `prDeliversCard` delivery relation and the shared PREREQUISITE-NOT-MET exit code are imported from `check-half-states.mjs`, so this checker and H31 cannot come to disagree about which PR delivers which card. It writes nothing, ever: hanging or clearing a review gate from a checker would be issuing the verdict. The fixed spelling is not relaxed. Decoration around the line is tolerated the way H4 tolerates it, and reasoning after the value token is accepted because that is the shape #13914 records as its control; prose, a different case and a word merely starting with the token all stay unread and are quoted back in the row so the residue is actionable. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msg17tAHJ3jVTYFgHydCm2

The filing card read this file as the place the dual-carrier rule should have been enforced and found only label-object reconciliation there — a fair reading, because nothing in the file said otherwise. State the boundary, and point at the two files that answer the hanging question instead: H31 for the board-wide carrier comparison, and the new per-pair checker for the same comparison anchored on one pair plus the declaration limb this repo had no reader for. ⛔ No behaviour change: this file still reconciles the label object and nothing else, and none of the three writes the label. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msg17tAHJ3jVTYFgHydCm2

…ds have A failure on the listing is TOTAL — no pair is formed, so the run refuses with "0 pair(s) had been read", which is the correct answer and exactly why it should not be spent on a blip. Measured while verifying this branch: a transient HTTP 502 on page 1 refused a --pair run that answered in a second on the next attempt, on a route where curl was returning 200 throughout. ⛔ Still one retry, not a loop: a second failure is the answer, and a sweep that keeps trying is a sweep that hides an exhausted quota. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msg17tAHJ3jVTYFgHydCm2

claude · 2026-08-31T18:08:20Z

Fixes#13922
Fixes#12409
Part of #13914

Family dispatch, code half only. One new checker in the existing check:pm-* gate family gives the clause-② enqueue gate a reader a seat can point at one pair: the dual carrier is asserted by mechanism, and a limb nobody can read is reported as a missing reading rather than passing for a decision.

⚠️ Premise correction — read this first

#13922 says the dual-carrier rule "has no enforcement at all" and that "there is no check anywhere that a needs:contract-review on one carrier implies it on the other". That is not true, and the correction shaped this PR.

h31ContractReviewCarrierSplit in scripts/pm/check-half-states.mjs is exactly that check. It compares both carriers, in both directions, names the offending PR, and it has a standing caller — .github/workflows/half-state-patrol.yml, four times a day. Measured on this branch: the patrol's last scheduled run before the card was filed was 2026-08-31T13:42:41Z, conclusion success.

Building a second carrier comparison as though H31 did not exist would have produced two predicates that can disagree about the same pair. So this PR imports H31's label constant and H31's delivery relation instead of restating either, and closes only the parts H31 genuinely cannot reach. Those parts are real, and all three were re-measured on the live board today:

Agreement on ABSENCE is H31's silent case, by construction. It fires on a split; a pair carrying the gate on neither carrier is, to it, clean. That is precisely the "all three limbs silent at once" shape The clause-② gate has three limbs and all three were silent on PR #13910 at once — the dual-carrier label rule has no enforcement, and 4 of 6 measured pairs are out of sync #13922 measured on PR fix(rest): a data engine that cannot be RESOLVED no longer answers 403 FORBIDDEN (#13476) #13910 / card [finding] after the #13279 repair, an UNRESOLVABLE data engine still answers 403 FORBIDDEN — the last surviving GRANTS-LOST disguise at the package door #13476.
Nothing read limb ② at all. Grep over scripts/ and .github/workflows/ finds the Clause-② token in a label description and in prose — never in a predicate. The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914 measured the consequence: 2 of 3 cards in one review round carried the declaration as prose or in the PR body, and a card with no declaration is indistinguishable from a card that declared no.
H31's delivery channel trims. Its report is one row family among ~38 rendered into one pinned anchor issue. Measured on the 13:42Z run body: 231 findings, 74 rendered, "157 further row(s) omitted to fit GitHub's issue-body limit." A gate row competes for space with board-hygiene rows, and the anchor then reads clean on the gate.

premise_still_valid is therefore partly false and the surviving defect is narrower and sharper than the card states. It is stated in full in the new file's header so the next reader is not told the original story.

What landed

scripts/pm/check-clause2-carriers.mjs — answers one question and prints only its own rows, so nothing it finds can be crowded out by another mechanism's inventory.

row	what it says	member
C1	the two carriers of one pair disagree — both directions, each with its own consequence	#13922 · #12409
C2	the declaration limb has NO READING: `absent`, `misplaced` (fixed spelling on the thread but not in the claim carrier), or `malformed`	#13914 remedy 2
C3	a declared `Clause-②: yes` with the gate on neither carrier — the fail-open a carrier comparison is structurally blind to	#13922

Modes, and why each exit code is what it is:

default sweep — report-only, exit 0 on a complete sweep whatever it found; 2 when any pair was UNJUDGED (an unread carrier is not a bare carrier, an unread thread is not an absent declaration); 3 PREREQUISITE NOT MET, the constant imported from check-half-states.mjs so the family has one code for it.
--pair PR-NUMBER — a predicate about that pair, so it may answer adversely where the sweep may not: exit 4, deliberately not 3, so a seat reading the status can never turn a refusal into a clearance. A pre-arm tool, ⛔ not a merge gate.
--self-test — offline, 64 cases. This is what lint.yml runs.

Single-sourced, not restated: CONTRACT_REVIEW_LABEL, prDeliversCard, labelNames, CLAIM_COMMENT_MARKER, governingClaim, proxyRearmPlan and EXIT_PREREQUISITE_NOT_MET all come from check-half-states.mjs. This checker and H31 cannot come to disagree about which PR delivers which card.

It writes nothing, ever. Hanging or clearing a review gate from a checker would be issuing the review verdict — 自查放行. Same call H31 makes, for the same reason.

Measured, on the live board

The sweep, run on this branch's head against objectstack-ai/objectstack at 2026-08-31T18:0xZ: 25 card/PR pairs derived from 27 open PRs, 25 findings, 0 UNJUDGED (exit 0).

1 × C1 — a live desync: PR fix(metadata-protocol): serve runtime-authored view containers to org/environment-scoped reads #13929 carries needs:contract-review, card rest/meta: getViewsByObject / GET /meta/view?object= omits a runtime-authored view CONTAINER — #7163/#7736 expansion fix does not cover this path #13407 does not. Verified independently by a second read of both label sets.
2 × C3 — live fail-opens: card [spec] FieldSchema accepts a lookup/master_detail with no reference target, though its own TSDoc calls the key required #13632 (PR fix(spec): require a non-empty reference on lookup/master_detail fields #13927) and card serve 面保证 stored metadata 规范拼写：reference_to → reference 归一化 + spec 裁定 reference_field/referenceField 协议归属（ui#6837 半 1） #13700 (PR Add field-reference-to-alias conversion so stored reference_to serves as reference #13847) each declare Clause-②: yes in the claim comment while neither carrier carries the gate label. PR fix(spec): require a non-empty reference on lookup/master_detail fields #13927 is not draft. Both claims say in their own words that the label was to be hung on both carriers in the same stroke as PR creation.
22 × C2 — 20 NO READING and 2 MISPLACED. The two misplaced ones quote what was there instead, e.g. card [finding] after the #13279 repair, an UNRESOLVABLE data engine still answers 403 FORBIDDEN — the last surviving GRANTS-LOST disguise at the package door #13476: ### Clause ② — 'yes', and it is a FOURTH class, and card A PERMISSION_DENIED refusal never reaches the dispatcher's throw-transparent exit, so it still drops the author's userMessage — a second door, behind #7898's trigger file #13623: ### Clause ② — declared 'yes' conservatively. A PERMISSION_DENIED refusal never reaches the dispatcher's throw-transparent exit, so it still drops the author's userMessage — a second door, behind #7898's trigger file #13623 is one of The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914's own two measured misses, re-observed by mechanism.

⛔ None of these was repaired here. The deliverable is the mechanism; the rows are the PM round's input.

Zone-2 assumptions, tested rather than inherited:

Pairing is machine-derivable — holds, 7 of 7. Every pair in the two cards' tables carries a closing or Part of keyword in the PR body naming its card, and every branch name carries the fallback too. Both channels agree on all seven.
[finding] Both recorded PR-label READ legs came back label-blind in one run — pull_request_read get returned no labels field, and the web-payload grep spelling that works on issues reads zero on a labeled PR #12902's claim that PR-side labels cannot be written — not relied on either way. This PR writes no label from any channel, so the question does not arise for it. What was measured instead is the read side: repo-scoped REST reads and writes both answer 200 from this container, and the sweep read 27 PRs and 25 threads over it.
Whether the sync check belongs in check-half-states.mjs H31/H35 — the stated condition did not hold, and the answer is standalone anyway. Open PR fix(pm): mask the fixture builders only a self-test can reach #13930 changes scripts/pm/dispatch-gates.mjs, not check-half-states.mjs, so H31/H35 were not held. Standalone is still right, because the trimming measurement above says a new row family added to that report is a row family that can be omitted before a reader sees it. H31/H35 are untouched; dispatch-gates.mjs is untouched.

Two things recorded rather than acted on

1. The two directions of a split are not ranked, because the two standing sources rank them oppositely. H31's header calls the card-bare direction "the more dangerous half" (an ungated card enqueues past a live gate). #13922 calls the PR-bare direction the fail-open ("it is the carrier the enqueue gate reads"). Both are sound about their own consumer. This checker states each direction's consequence and ranks neither — picking one would print an adjudication as a derivation. Which carrier the enqueue gate actually reads is a protocol question for the maintainer.

2. What this implies for .claude/skills/pm-dispatch/references/contract-review.md — recorded here, no edit landed. That file is held by pending human-merge PR #13746 and is outside this dispatch's surface. Two of its sentences are affected:

The 重挂前先查裁决 recovery rule reads "label absent" as probably cleared. The clause-② gate has three limbs and all three were silent on PR #13910 at once — the dual-carrier label rule has no enforcement, and 4 of 6 measured pairs are out of sync #13922 falsified its premise by measurement. --pair now answers that question directly for one pair instead of inferring it, so the recovery rule could point at the checker rather than at an inference.
The PR 与卡双载体同笔挂 rule now has a mechanical reader, which it did not when the text was written. Naming check-clause2-carriers.mjs --pair beside it would let the prose stop being the only executor.

Neither sentence is edited by this PR.

Scope, held

[finding] The contract-review gate is being hung on ONE carrier — 34 of 36 lone clears had a PR that never carried it, which makes a strip undetectable #12409 is taken on its mechanically-forced half only — enforcing the standing 2026-08-22 ruling 「两边都挂好」, which the card's own four-facet analysis marked as needing no new ruling to start. The un-ruled half stays open for the maintainer: a canonical machine-readable spelling for the review VERDICT (repair 2 — the Contract review: PASS marker that matched 5 of 35 removals strictly and 26 loosely). This PR gives the declaration a reader; it gives the verdict none, deliberately. That residue is named in the wrap-up comment on [finding] The contract-review gate is being hung on ONE carrier — 34 of 36 lone clears had a PR that never carried it, which makes a strip undetectable #12409.
The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914 is Part of, remedy 2 only. The claim-comment template in .claude/skills/pm-dispatch/SKILL.md (remedy 1) is not touched and the card stays open for it.
⛔ No patrol predicate widened to absorb prose. The fixed spelling stays exactly Clause-②: yes / Clause-②: no. Decoration around the line is tolerated the way H4 tolerates it; reasoning after the value token is accepted because that is the shape The Clause-②: yes | no machine spelling is missing from the claim comment on 2 of 3 measured cards — the enqueue gate's predicate reads it there, and it is not there #13914 records as its control (os lint never surfaces ADR-0087 conversion notices — it normalizes with no onConversionNotice sink, the #3782 parity gap os build was in #12297 "carries Clause-②: yes with reasoning"). A reader that rejected it would have graded the card's own control as the defect — and it did, on four real claims, before that case was written. Clause-②: YES, Clause-②: nope, Clause-②: probably not, an empty value and the prose form Clause ②: yes all stay unread, and are quoted back in the row so the residue is actionable.
⛔ No carrier collapse, no branch-protection or required-set change, no new merge gate: the lint.yml step runs the self-test only, the same split as check:pm-half-states and check:pm-governed-merges beside it.
Escalation clause not triggered: no new protocol spelling and no new gate category were invented. Every row asserts a rule that already stands.

Verification

Derived on this PR's own final head — node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, at this PR's final head 850a759 (4 paths vs merge base 0f63965ea; the union is byte-identical to the one derived at d06df85, and it was re-run in full on 850a759 with the same result): 33 families + 2 convention-triggered obligations = 35 commands, all run serially under scripts/pm/os-verify-lock.sh.

32 of 35 exit 0. Including both convention obligations an added gate script incurs — node scripts/pm/bare-root-worklist.mjs --self-test and pnpm check:pm-dispatch-gates — plus check:self-test-wired, check:entry-guard, check:parse-guard, check:watch-hint-literal, check:pm-label-desc-cap and check:required-contexts.

The other 3 are NOT MEASURED, not red — each says so in its own verdict text, and each needs a full package build this diff cannot affect (it touches no package source):

gate	exit	its own words
`check-test-completeness.mjs`	3	"PREREQUISITE NOT MET … the local reading for this gate is NOT MEASURED. ⛔ It is not a red, and there is nothing here to fix."
`check:dual-build-cjs-loads`	3	"PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/. Run `pnpm build` first. ⛔ This is NOT a pass: nothing was measured."
`check:type-check-debt`	1	its `--self-test` and coverage read pass; `--re-measure` refuses without the built closure, because measuring there "would silently measure a DIFFERENT WORLD"

Also run, because this checker imports it: pnpm check:pm-half-states — 1826 cases pass, so the imported surface is intact.

Every exit code was exercised live, in the direction predicted before the run:

run	exit	reading
`--pair 13944` (this PR)	0	its three pairs — #13922, #12409, #13914 — all declare `Clause-②: no` in the fixed spelling and both carriers agree. Three green lines, the clean control.
`--pair 13847`	4	the C3 row on card #13700. A verdict about that pair, not about the environment.
`--pair 13944`, earlier attempt	3	a transient `HTTP 502` on the PR listing, on a route where `curl` returned 200 throughout. It refused with "0 pair(s) had been read … NOT a reading of a clean board" rather than reporting green — which is why the listing now carries the same single retry the per-pair reads do (third commit).

Live evidence beyond the self-test: the sweep output above, plus an independent second read of the label sets on #13929/#13407, #13927/#13632 and #13847/#13700 confirming every C1 and C3 row.

Authored in session session_01Msg17tAHJ3jVTYFgHydCm2 (durable copy of the attribution, because a body edit normalises the footer's session URL away).

No changeset: this diff publishes nothing — scripts/pm/**, a workflow, and a script registration in the private root manifest. skip-changeset applies and is attached.

Generated by Claude Code

`needs:contract-review` is a dual-carrier gate by the maintainer's ruling of 2026-08-22 (「两边都挂好」), and its content limb is a fixed machine spelling in the card's claim comment. Neither had a reader that a seat could point at one pair: H31 in `check-half-states.mjs` compares the two carriers, but it is silent when the gate is missing from BOTH (agreement on absence is its silent case) and it reports through a patrol body that trims — 231 findings, 74 rendered on the 2026-08-31T13:42Z run. The declaration limb had no reader at all: grep over `scripts/` and `.github/workflows/` finds the token only in a label description and in prose. `scripts/pm/check-clause2-carriers.mjs` answers exactly that one question and prints only its own rows: C1 the two carriers of one pair disagree. Both directions, each with its own consequence, neither ranked — H31 and #13922 rank them oppositely and this file records the disagreement rather than adjudicating it. C2 the declaration limb has NO READING: absent, misplaced (the fixed spelling on the thread but not in the claim carrier), or malformed. A missing reading is never collapsed into a declared `no`. C3 a declared `yes` with the gate on NEITHER carrier — the fail-open a carrier comparison is structurally blind to. The label constant, the `prDeliversCard` delivery relation and the shared PREREQUISITE-NOT-MET exit code are imported from `check-half-states.mjs`, so this checker and H31 cannot come to disagree about which PR delivers which card. It writes nothing, ever: hanging or clearing a review gate from a checker would be issuing the verdict. The fixed spelling is not relaxed. Decoration around the line is tolerated the way H4 tolerates it, and reasoning after the value token is accepted because that is the shape #13914 records as its control; prose, a different case and a word merely starting with the token all stay unread and are quoted back in the row so the residue is actionable. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msg17tAHJ3jVTYFgHydCm2

The filing card read this file as the place the dual-carrier rule should have been enforced and found only label-object reconciliation there — a fair reading, because nothing in the file said otherwise. State the boundary, and point at the two files that answer the hanging question instead: H31 for the board-wide carrier comparison, and the new per-pair checker for the same comparison anchored on one pair plus the declaration limb this repo had no reader for. ⛔ No behaviour change: this file still reconciles the label object and nothing else, and none of the three writes the label. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msg17tAHJ3jVTYFgHydCm2

…ds have A failure on the listing is TOTAL — no pair is formed, so the run refuses with "0 pair(s) had been read", which is the correct answer and exactly why it should not be spent on a blip. Measured while verifying this branch: a transient HTTP 502 on page 1 refused a --pair run that answered in a second on the next attempt, on a route where curl was returning 200 throughout. ⛔ Still one retry, not a loop: a second failure is the answer, and a sweep that keeps trying is a sweep that hides an exhausted quota. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msg17tAHJ3jVTYFgHydCm2

claude added 2 commits August 31, 2026 17:56

claudeBot added the skip-changeset PR has no user-facing published change; bypasses the changeset gate label Aug 31, 2026

github-actionsBot added size/l ci/cd dependencies Pull requests that update a dependency file labels Aug 31, 2026

os-sam mentioned this pull request Aug 31, 2026
The clause-② gate has three limbs and all three were silent on PR #13910 at once — the dual-carrier label rule has no enforcement, and 4 of 6 measured pairs are out of sync #13922
Closed

os-sam marked this pull request as ready for review August 31, 2026 18:32

os-sam enabled auto-merge August 31, 2026 18:32

os-sam mentioned this pull request Aug 31, 2026
[PM seat] skills — 🟢 session_01Msg17tAHJ3jVTYFgHydCm2 · R6 standby · 20 cards / 5 PRs merged · 6 drafts awaiting human merge · sweep program 100% #7623
Open

os-sam added this pull request to the merge queue Aug 31, 2026

Merged via the queue into main with commit 736980cAug 31, 2026
37 checks passed

os-sam deleted the claude/issue-13922-clause2-carrier-enforcement branch August 31, 2026 18:57

claude added 2 commits August 31, 2026 17:56

claudeBot added the skip-changeset PR has no user-facing published change; bypasses the changeset gate label Aug 31, 2026

github-actionsBot added size/l ci/cd dependencies Pull requests that update a dependency file labels Aug 31, 2026

os-sam mentioned this pull request Aug 31, 2026
The clause-② gate has three limbs and all three were silent on PR #13910 at once — the dual-carrier label rule has no enforcement, and 4 of 6 measured pairs are out of sync #13922
Closed

os-sam marked this pull request as ready for review August 31, 2026 18:32

os-sam enabled auto-merge August 31, 2026 18:32

os-sam mentioned this pull request Aug 31, 2026
[PM seat] skills — 🟢 session_01Msg17tAHJ3jVTYFgHydCm2 · R6 standby · 20 cards / 5 PRs merged · 6 drafts awaiting human merge · sweep program 100% #7623
Open

os-sam added this pull request to the merge queue Aug 31, 2026

Merged via the queue into main with commit 736980cAug 31, 2026
37 checks passed

os-sam deleted the claude/issue-13922-clause2-carrier-enforcement branch August 31, 2026 18:57

claude added 2 commits August 31, 2026 17:56

claudeBot added the skip-changeset PR has no user-facing published change; bypasses the changeset gate label Aug 31, 2026

github-actionsBot added size/l ci/cd dependencies Pull requests that update a dependency file labels Aug 31, 2026

os-sam mentioned this pull request Aug 31, 2026
The clause-② gate has three limbs and all three were silent on PR #13910 at once — the dual-carrier label rule has no enforcement, and 4 of 6 measured pairs are out of sync #13922
Closed

os-sam marked this pull request as ready for review August 31, 2026 18:32

os-sam enabled auto-merge August 31, 2026 18:32

os-sam mentioned this pull request Aug 31, 2026
[PM seat] skills — 🟢 session_01Msg17tAHJ3jVTYFgHydCm2 · R6 standby · 20 cards / 5 PRs merged · 6 drafts awaiting human merge · sweep program 100% #7623
Open

os-sam added this pull request to the merge queue Aug 31, 2026

Merged via the queue into main with commit 736980cAug 31, 2026
37 checks passed

os-sam deleted the claude/issue-13922-clause2-carrier-enforcement branch August 31, 2026 18:57

claude added 2 commits August 31, 2026 17:56

claudeBot added the skip-changeset PR has no user-facing published change; bypasses the changeset gate label Aug 31, 2026

github-actionsBot added size/l ci/cd dependencies Pull requests that update a dependency file labels Aug 31, 2026

os-sam mentioned this pull request Aug 31, 2026
The clause-② gate has three limbs and all three were silent on PR #13910 at once — the dual-carrier label rule has no enforcement, and 4 of 6 measured pairs are out of sync #13922
Closed

os-sam marked this pull request as ready for review August 31, 2026 18:32

os-sam enabled auto-merge August 31, 2026 18:32

os-sam mentioned this pull request Aug 31, 2026
[PM seat] skills — 🟢 session_01Msg17tAHJ3jVTYFgHydCm2 · R6 standby · 20 cards / 5 PRs merged · 6 drafts awaiting human merge · sweep program 100% #7623
Open

os-sam added this pull request to the merge queue Aug 31, 2026

Merged via the queue into main with commit 736980cAug 31, 2026
37 checks passed

os-sam deleted the claude/issue-13922-clause2-carrier-enforcement branch August 31, 2026 18:57

claude added 2 commits August 31, 2026 17:56

claudeBot added the skip-changeset PR has no user-facing published change; bypasses the changeset gate label Aug 31, 2026

github-actionsBot added size/l ci/cd dependencies Pull requests that update a dependency file labels Aug 31, 2026

os-sam mentioned this pull request Aug 31, 2026
The clause-② gate has three limbs and all three were silent on PR #13910 at once — the dual-carrier label rule has no enforcement, and 4 of 6 measured pairs are out of sync #13922
Closed

os-sam marked this pull request as ready for review August 31, 2026 18:32

os-sam enabled auto-merge August 31, 2026 18:32

os-sam mentioned this pull request Aug 31, 2026
[PM seat] skills — 🟢 session_01Msg17tAHJ3jVTYFgHydCm2 · R6 standby · 20 cards / 5 PRs merged · 6 drafts awaiting human merge · sweep program 100% #7623
Open

os-sam added this pull request to the merge queue Aug 31, 2026

Merged via the queue into main with commit 736980cAug 31, 2026
37 checks passed

os-sam deleted the claude/issue-13922-clause2-carrier-enforcement branch August 31, 2026 18:57

claude added 2 commits August 31, 2026 17:56

claudeBot added the skip-changeset PR has no user-facing published change; bypasses the changeset gate label Aug 31, 2026

github-actionsBot added size/l ci/cd dependencies Pull requests that update a dependency file labels Aug 31, 2026

os-sam mentioned this pull request Aug 31, 2026
The clause-② gate has three limbs and all three were silent on PR #13910 at once — the dual-carrier label rule has no enforcement, and 4 of 6 measured pairs are out of sync #13922
Closed

os-sam marked this pull request as ready for review August 31, 2026 18:32

os-sam enabled auto-merge August 31, 2026 18:32

os-sam mentioned this pull request Aug 31, 2026
[PM seat] skills — 🟢 session_01Msg17tAHJ3jVTYFgHydCm2 · R6 standby · 20 cards / 5 PRs merged · 6 drafts awaiting human merge · sweep program 100% #7623
Open

os-sam added this pull request to the merge queue Aug 31, 2026

Merged via the queue into main with commit 736980cAug 31, 2026
37 checks passed

os-sam deleted the claude/issue-13922-clause2-carrier-enforcement branch August 31, 2026 18:57

claude added 2 commits August 31, 2026 17:56

claudeBot added the skip-changeset PR has no user-facing published change; bypasses the changeset gate label Aug 31, 2026

github-actionsBot added size/l ci/cd dependencies Pull requests that update a dependency file labels Aug 31, 2026

os-sam mentioned this pull request Aug 31, 2026
The clause-② gate has three limbs and all three were silent on PR #13910 at once — the dual-carrier label rule has no enforcement, and 4 of 6 measured pairs are out of sync #13922
Closed

os-sam marked this pull request as ready for review August 31, 2026 18:32

os-sam enabled auto-merge August 31, 2026 18:32

os-sam mentioned this pull request Aug 31, 2026
[PM seat] skills — 🟢 session_01Msg17tAHJ3jVTYFgHydCm2 · R6 standby · 20 cards / 5 PRs merged · 6 drafts awaiting human merge · sweep program 100% #7623
Open

os-sam added this pull request to the merge queue Aug 31, 2026

Merged via the queue into main with commit 736980cAug 31, 2026
37 checks passed

os-sam deleted the claude/issue-13922-clause2-carrier-enforcement branch August 31, 2026 18:57

claude added 2 commits August 31, 2026 17:56

claudeBot added the skip-changeset PR has no user-facing published change; bypasses the changeset gate label Aug 31, 2026

github-actionsBot added size/l ci/cd dependencies Pull requests that update a dependency file labels Aug 31, 2026

os-sam mentioned this pull request Aug 31, 2026
The clause-② gate has three limbs and all three were silent on PR #13910 at once — the dual-carrier label rule has no enforcement, and 4 of 6 measured pairs are out of sync #13922
Closed

os-sam marked this pull request as ready for review August 31, 2026 18:32

os-sam enabled auto-merge August 31, 2026 18:32

os-sam mentioned this pull request Aug 31, 2026
[PM seat] skills — 🟢 session_01Msg17tAHJ3jVTYFgHydCm2 · R6 standby · 20 cards / 5 PRs merged · 6 drafts awaiting human merge · sweep program 100% #7623
Open

os-sam added this pull request to the merge queue Aug 31, 2026

Merged via the queue into main with commit 736980cAug 31, 2026
37 checks passed

os-sam deleted the claude/issue-13922-clause2-carrier-enforcement branch August 31, 2026 18:57

Uh oh!

Conversation

claudeBot commented Aug 31, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Premise correction — read this first

What landed

Measured, on the live board

Two things recorded rather than acted on

Scope, held

Verification

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

claudeBot commented Aug 31, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Premise correction — read this first

What landed

Measured, on the live board

Two things recorded rather than acted on

Scope, held

Verification

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

claudeBot commented Aug 31, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Premise correction — read this first

What landed

Measured, on the live board

Two things recorded rather than acted on

Scope, held

Verification

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

claudeBot commented Aug 31, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Premise correction — read this first

What landed

Measured, on the live board

Two things recorded rather than acted on

Scope, held

Verification

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

claudeBot commented Aug 31, 2026•
edited
Loading

claudeBot commented Aug 31, 2026•
edited
Loading

claudeBot commented Aug 31, 2026•
edited
Loading

claudeBot commented Aug 31, 2026•
edited
Loading

claudeBot commented Aug 31, 2026•
edited
Loading

claudeBot commented Aug 31, 2026•
edited
Loading