feat(pm): give the contract-review independence clause a machine carrier (C4)

[os-support-ai]

Part of #14209 — direction A's guard half. #14209 stays open: its template half is deferred on a
governance blocker named under "What is NOT in this PR", and merging this alone must not close the card.

Ruling being implemented (maintainer, 2026-09-01, verbatim and untranslated): 「同意 A」 — the
contract-review verdict template carries an Implemented-by: / Reviewed-by: session-ID pair, and the
guard refuses to recognise a verdict whose two IDs are the same session.

What changed

One file: scripts/pm/check-clause2-carriers.mjs, one new finding row C4, report-only like every
other row. No existing row is weakened or reordered, no label is ever written (the file's standing
NEVER_WRITES rule), and no sibling script is touched.

C4 reports a pair whose governing contract-review verdict names the SAME session on both authorship
lines — a self-review, which does not count as an independent review. The clause it finally carries is
references/contract-review.md's own: the in-seat path is scoped to 「低档实现者的契约增量,非自身产物」,
and its isolation sub-rule will not feed a reviewer even 「派发席自己的结论(污染即失独立性)」.

Four states, exactly as the card's scope sets them:

verdict on the card thread	C4
both lines, same session ID	fires — self-review
both lines, distinct session IDs	silent — this is the shape the clause asks for
neither line (a legacy verdict)	silent — absence never turns a historic pair red
one line only	fires as its own MALFORMED state — half a pair compares to nothing

The four design choices worth reviewing

1. The discriminator is a VERDICT: key line, picked from the live corpus rather than invented: real
   verdicts open a fenced block whose first line is VERDICT: PASS, beside REVIEWED-HEAD: and
   CLAUSE-2-PATH:. The same board supplies the near miss that makes the colon load-bearing — an os-dev
   report writes `VERDICT command-exit 0` in prose, repeatedly. Both are pinned as self-test
   fixtures, so a discriminator that matched the bare WORD would read a build log as a review verdict.
2. Spelling strictness mirrors the Clause-②: reader one section up: case-sensitive key, the session
   token immediately after the colon, trailing reasoning tolerated, the same markdown decoration allowed.
   One convention for machine spellings in this file, not two. Its residual hole is stated in the row
   rather than hidden: both IDs are SELF-DECLARED, and this file compares them to each other without
   cross-checking either against the implementation claim — it catches the honest self-review.
3. The NEWEST verdict carrying the pair governs. Load-bearing, not tidy: a self-review followed by an
   independent re-review is precisely the remedy the row asks for, so judging every verdict ever posted
   would leave a remediated pair red on every later sweep — the defect [finding] check-clause2-carriers.mjs --pair answers C3 / exit 4 on a LEGITIMATELY cleared clause-② pair — the completed state (declaration outlives the label) is indistinguishable from the fail-open it hunts #14155 had to repair in C3, where
   a row that could never clear made the landing check's own precondition unsatisfiable.
4. It costs no new request. C4 reads the card comment thread the declaration limb already fetches.

The file header's boundary sentence was narrowed to match, not quietly broken: it read "it does not read
verdict comments"; it now reads "it reads no verdict VALUE", with a starred paragraph saying that the
authorship pair is the one thing read out of a verdict and that no PASS or FAIL token is read to reach
it. The PASS half of the recovery rule stays human, exactly as before.

What is NOT in this PR, and why — please read before reviewing scope

The dispatched surface was two files. The second, .claude/skills/pm-dispatch/references/contract-review.md
(the template lines plus one sentence about the guard), is not here, and could not be added inside the
dispatched surface. Measured, not assumed:

• check-skill-line-ratchet.mjs pins that file at 60 lines, and it is 60 lines — the gate's own
  verdict line is contract-review.md is 60 lines (ceiling 60; headroom 0). Any net growth is red.
• Both in-place payments are refused by standing rulings, so the growth cannot be self-funded. Re-wrap or
  densify to buy lines is 筹行, banned by the maintainer's 2026-08-17 ruling as recorded in SKILL.md:
  「⛔ re-wrap(折行合并)不得用作筹行 …… 新增以删减付账;密度优化仅随净减内容的 PR 顺带」. Deleting a
  ruled clause is refused on the state-machine precedent, recorded twice in this very file's own ceiling
  comments.
• The remaining route is the one this file's ceiling took on both prior occasions (51 to 57, then 57 to
  60): raise the ceiling, with the maintainer ruling quoted in the raising PR body — which means
  editing scripts/pm/check-skill-line-ratchet.mjs, a third file the dispatch did not authorize and
  explicitly said to stop on rather than improvise.

⚠️ It is also the wrong shape to improvise here specifically: granting my own diff an exemption from a
governance control, unilaterally, is the same act #14209 exists to record. So the guard ships and the
template waits for an authorization only the dispatching seat or the maintainer can give.

Consequence if this merges alone: none adverse. A verdict carrying neither line is silent by mandate,
so C4 simply does not fire until seats start writing the pair — the row is forward-compatible and inert
on today's board. The template half is what turns it on.

To finish the card on this branch: authorize the ceiling raise (60 to about 66), add the template
lines plus the guard sentence to the review-checklist section, record the raise above the CEILINGS entry
in the established comment form, and flip this PR's first line to the closing keyword.

Gates run

All readings at the pushed head 57f23063f (the final commit), every exit captured by
redirect-then-capture, never across a pipe.

• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack EXIT=0, repo assertion held,
  1 path vs merge base b992b1d64, three-dot, 199 families discovered, 13 matched plus 2
  convention-triggered (adds or edits a GATE SCRIPT).
• All 15 run. 14 EXIT=0: check:pm-clause2-carriers, check:pm-dispatch-gates,
  bare-root-worklist --self-test, check:agent-test-spelling, check:bash32-floor,
  check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard,
  check:pnpm-filter-targets, check:watch-hint-literal, check-cross-package-test-inputs.mjs,
  check-ci-filter-parity.mjs, check-shard-attestation.mjs.
• 1 NOT MEASURED, not a red: check-test-completeness.mjs EXIT=3, its own text — "The log comes from
  a test RUN. This gate does not run tests and cannot produce one … the local reading for this gate is
  NOT MEASURED." CI covers it.
• ⚠️check-ci-filter-parity.mjs and check-shard-attestation.mjs first returned EXIT=3 PREREQUISITE
  NOT MET ("the dependency yaml is not installed") because the worktree had no node_modules yet;
  both were re-run after pnpm install and are the EXIT=0 readings above. Recorded because a 3 read as a
  pass would have been the false green.
• Repo-wide, NOT narrowed: eslint . --no-inline-config --format json EXIT=0 — 5,644 files, 0 errors,
  0 warnings, with the edited file confirmed present in the linted set by its own JSON row.
• check-nul-bytes.mjs EXIT=0 (7,766 files). Control-character self-scan over the edited file with
  grep -naP returned rc=1, no matches.
• check-skill-line-ratchet.mjs EXIT=0 — unchanged, since no ceilinged file is touched.
• Self-test: 138 cases pass, up from 98 on the base commit — 40 new, of which 30 are C4's.

Ablation — the new cases can actually fail

Run from the committed implementation, so the restore leg had something true to restore to. The C4
comparison was neutered (if (implementedBy !== reviewedBy) replaced by if (true), marker appended).
Mutation confirmed ON DISK before running, not from the editor's exit code: the original anchor's
grep -cF count went 1 to 0 and the injected marker's 0 to 1. Ablated run: EXIT=1, 11 of 138 cases
failed, including "a same-session verdict FIRES C4" and "a self-reviewed pair is adverse even when
every carrier reading is clean". Restore by git checkout HEAD -- (absolute path) under an EXIT/INT/TERM
trap, then proved rather than assumed: git diff HEAD empty, marker count back to 0, and the worktree
blob hash equal to the HEAD blob hash (2ea30125… both sides). Self-test green again at 138.

No rebuild leg applies and none is claimed: this script is plain ESM executed from source, with no dist
between the edit and the run.

Landing shape

Draft, and it stays draft — .claude/-adjacent PM tooling under the governed four-step, which the
dispatching seat runs after this report. No auto-merge, no ready flip from here. skip-changeset applies
and is set: the diff is confined to scripts/pm/**, which publishes from no package.

---

Generated by Claude Code

[os-support-ai]

Part of #14209 — direction A's guard half. #14209 stays open: its template half is deferred on a
governance blocker named under "What is NOT in this PR", and merging this alone must not close the card.

Ruling being implemented (maintainer, 2026-09-01, verbatim and untranslated): 「同意 A」 — the
contract-review verdict template carries an Implemented-by: / Reviewed-by: session-ID pair, and the
guard refuses to recognise a verdict whose two IDs are the same session.

What changed

One file: scripts/pm/check-clause2-carriers.mjs, one new finding row C4, report-only like every
other row. No existing row is weakened or reordered, no label is ever written (the file's standing
NEVER_WRITES rule), and no sibling script is touched.

C4 reports a pair whose governing contract-review verdict names the SAME session on both authorship
lines — a self-review, which does not count as an independent review. The clause it finally carries is
references/contract-review.md's own: the in-seat path is scoped to 「低档实现者的契约增量,非自身产物」,
and its isolation sub-rule will not feed a reviewer even 「派发席自己的结论(污染即失独立性)」.

Four states, exactly as the card's scope sets them:

verdict on the card thread	C4
both lines, same session ID	fires — self-review
both lines, distinct session IDs	silent — this is the shape the clause asks for
neither line (a legacy verdict)	silent — absence never turns a historic pair red
one line only	fires as its own MALFORMED state — half a pair compares to nothing

The four design choices worth reviewing

1. The discriminator is a VERDICT: key line, picked from the live corpus rather than invented: real
   verdicts open a fenced block whose first line is VERDICT: PASS, beside REVIEWED-HEAD: and
   CLAUSE-2-PATH:. The same board supplies the near miss that makes the colon load-bearing — an os-dev
   report writes `VERDICT command-exit 0` in prose, repeatedly. Both are pinned as self-test
   fixtures, so a discriminator that matched the bare WORD would read a build log as a review verdict.
2. Spelling strictness mirrors the Clause-②: reader one section up: case-sensitive key, the session
   token immediately after the colon, trailing reasoning tolerated, the same markdown decoration allowed.
   One convention for machine spellings in this file, not two. Its residual hole is stated in the row
   rather than hidden: both IDs are SELF-DECLARED, and this file compares them to each other without
   cross-checking either against the implementation claim — it catches the honest self-review.
3. The NEWEST verdict carrying the pair governs. Load-bearing, not tidy: a self-review followed by an
   independent re-review is precisely the remedy the row asks for, so judging every verdict ever posted
   would leave a remediated pair red on every later sweep — the defect [finding] check-clause2-carriers.mjs --pair answers C3 / exit 4 on a LEGITIMATELY cleared clause-② pair — the completed state (declaration outlives the label) is indistinguishable from the fail-open it hunts #14155 had to repair in C3, where
   a row that could never clear made the landing check's own precondition unsatisfiable.
4. It costs no new request. C4 reads the card comment thread the declaration limb already fetches.

The file header's boundary sentence was narrowed to match, not quietly broken: it read "it does not read
verdict comments"; it now reads "it reads no verdict VALUE", with a starred paragraph saying that the
authorship pair is the one thing read out of a verdict and that no PASS or FAIL token is read to reach
it. The PASS half of the recovery rule stays human, exactly as before.

What is NOT in this PR, and why — please read before reviewing scope

The dispatched surface was two files. The second, .claude/skills/pm-dispatch/references/contract-review.md
(the template lines plus one sentence about the guard), is not here, and could not be added inside the
dispatched surface. Measured, not assumed:

• check-skill-line-ratchet.mjs pins that file at 60 lines, and it is 60 lines — the gate's own
  verdict line is contract-review.md is 60 lines (ceiling 60; headroom 0). Any net growth is red.
• Both in-place payments are refused by standing rulings, so the growth cannot be self-funded. Re-wrap or
  densify to buy lines is 筹行, banned by the maintainer's 2026-08-17 ruling as recorded in SKILL.md:
  「⛔ re-wrap(折行合并)不得用作筹行 …… 新增以删减付账;密度优化仅随净减内容的 PR 顺带」. Deleting a
  ruled clause is refused on the state-machine precedent, recorded twice in this very file's own ceiling
  comments.
• The remaining route is the one this file's ceiling took on both prior occasions (51 to 57, then 57 to
  60): raise the ceiling, with the maintainer ruling quoted in the raising PR body — which means
  editing scripts/pm/check-skill-line-ratchet.mjs, a third file the dispatch did not authorize and
  explicitly said to stop on rather than improvise.

⚠️ It is also the wrong shape to improvise here specifically: granting my own diff an exemption from a
governance control, unilaterally, is the same act #14209 exists to record. So the guard ships and the
template waits for an authorization only the dispatching seat or the maintainer can give.

Consequence if this merges alone: none adverse. A verdict carrying neither line is silent by mandate,
so C4 simply does not fire until seats start writing the pair — the row is forward-compatible and inert
on today's board. The template half is what turns it on.

To finish the card on this branch: authorize the ceiling raise (60 to about 66), add the template
lines plus the guard sentence to the review-checklist section, record the raise above the CEILINGS entry
in the established comment form, and flip this PR's first line to the closing keyword.

Gates run

All readings at the pushed head 57f23063f (the final commit), every exit captured by
redirect-then-capture, never across a pipe.

• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack EXIT=0, repo assertion held,
  1 path vs merge base b992b1d64, three-dot, 199 families discovered, 13 matched plus 2
  convention-triggered (adds or edits a GATE SCRIPT).
• All 15 run. 14 EXIT=0: check:pm-clause2-carriers, check:pm-dispatch-gates,
  bare-root-worklist --self-test, check:agent-test-spelling, check:bash32-floor,
  check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard,
  check:pnpm-filter-targets, check:watch-hint-literal, check-cross-package-test-inputs.mjs,
  check-ci-filter-parity.mjs, check-shard-attestation.mjs.
• 1 NOT MEASURED, not a red: check-test-completeness.mjs EXIT=3, its own text — "The log comes from
  a test RUN. This gate does not run tests and cannot produce one … the local reading for this gate is
  NOT MEASURED." CI covers it.
• ⚠️check-ci-filter-parity.mjs and check-shard-attestation.mjs first returned EXIT=3 PREREQUISITE
  NOT MET ("the dependency yaml is not installed") because the worktree had no node_modules yet;
  both were re-run after pnpm install and are the EXIT=0 readings above. Recorded because a 3 read as a
  pass would have been the false green.
• Repo-wide, NOT narrowed: eslint . --no-inline-config --format json EXIT=0 — 5,644 files, 0 errors,
  0 warnings, with the edited file confirmed present in the linted set by its own JSON row.
• check-nul-bytes.mjs EXIT=0 (7,766 files). Control-character self-scan over the edited file with
  grep -naP returned rc=1, no matches.
• check-skill-line-ratchet.mjs EXIT=0 — unchanged, since no ceilinged file is touched.
• Self-test: 138 cases pass, up from 98 on the base commit — 40 new, of which 30 are C4's.

Ablation — the new cases can actually fail

Run from the committed implementation, so the restore leg had something true to restore to. The C4
comparison was neutered (if (implementedBy !== reviewedBy) replaced by if (true), marker appended).
Mutation confirmed ON DISK before running, not from the editor's exit code: the original anchor's
grep -cF count went 1 to 0 and the injected marker's 0 to 1. Ablated run: EXIT=1, 11 of 138 cases
failed, including "a same-session verdict FIRES C4" and "a self-reviewed pair is adverse even when
every carrier reading is clean". Restore by git checkout HEAD -- (absolute path) under an EXIT/INT/TERM
trap, then proved rather than assumed: git diff HEAD empty, marker count back to 0, and the worktree
blob hash equal to the HEAD blob hash (2ea30125… both sides). Self-test green again at 138.

No rebuild leg applies and none is claimed: this script is plain ESM executed from source, with no dist
between the edit and the run.

Landing shape

Draft, and it stays draft — .claude/-adjacent PM tooling under the governed four-step, which the
dispatching seat runs after this report. No auto-merge, no ready flip from here. skip-changeset applies
and is set: the diff is confined to scripts/pm/**, which publishes from no package.

---

Generated by Claude Code

[os-support-ai]

Part of #14209 — direction A's guard half. #14209 stays open: its template half is deferred on a
governance blocker named under "What is NOT in this PR", and merging this alone must not close the card.

Ruling being implemented (maintainer, 2026-09-01, verbatim and untranslated): 「同意 A」 — the
contract-review verdict template carries an Implemented-by: / Reviewed-by: session-ID pair, and the
guard refuses to recognise a verdict whose two IDs are the same session.

What changed

One file: scripts/pm/check-clause2-carriers.mjs, one new finding row C4, report-only like every
other row. No existing row is weakened or reordered, no label is ever written (the file's standing
NEVER_WRITES rule), and no sibling script is touched.

C4 reports a pair whose governing contract-review verdict names the SAME session on both authorship
lines — a self-review, which does not count as an independent review. The clause it finally carries is
references/contract-review.md's own: the in-seat path is scoped to 「低档实现者的契约增量,非自身产物」,
and its isolation sub-rule will not feed a reviewer even 「派发席自己的结论(污染即失独立性)」.

Four states, exactly as the card's scope sets them:

verdict on the card thread	C4
both lines, same session ID	fires — self-review
both lines, distinct session IDs	silent — this is the shape the clause asks for
neither line (a legacy verdict)	silent — absence never turns a historic pair red
one line only	fires as its own MALFORMED state — half a pair compares to nothing

The four design choices worth reviewing

1. The discriminator is a VERDICT: key line, picked from the live corpus rather than invented: real
   verdicts open a fenced block whose first line is VERDICT: PASS, beside REVIEWED-HEAD: and
   CLAUSE-2-PATH:. The same board supplies the near miss that makes the colon load-bearing — an os-dev
   report writes `VERDICT command-exit 0` in prose, repeatedly. Both are pinned as self-test
   fixtures, so a discriminator that matched the bare WORD would read a build log as a review verdict.
2. Spelling strictness mirrors the Clause-②: reader one section up: case-sensitive key, the session
   token immediately after the colon, trailing reasoning tolerated, the same markdown decoration allowed.
   One convention for machine spellings in this file, not two. Its residual hole is stated in the row
   rather than hidden: both IDs are SELF-DECLARED, and this file compares them to each other without
   cross-checking either against the implementation claim — it catches the honest self-review.
3. The NEWEST verdict carrying the pair governs. Load-bearing, not tidy: a self-review followed by an
   independent re-review is precisely the remedy the row asks for, so judging every verdict ever posted
   would leave a remediated pair red on every later sweep — the defect [finding] check-clause2-carriers.mjs --pair answers C3 / exit 4 on a LEGITIMATELY cleared clause-② pair — the completed state (declaration outlives the label) is indistinguishable from the fail-open it hunts #14155 had to repair in C3, where
   a row that could never clear made the landing check's own precondition unsatisfiable.
4. It costs no new request. C4 reads the card comment thread the declaration limb already fetches.

The file header's boundary sentence was narrowed to match, not quietly broken: it read "it does not read
verdict comments"; it now reads "it reads no verdict VALUE", with a starred paragraph saying that the
authorship pair is the one thing read out of a verdict and that no PASS or FAIL token is read to reach
it. The PASS half of the recovery rule stays human, exactly as before.

What is NOT in this PR, and why — please read before reviewing scope

The dispatched surface was two files. The second, .claude/skills/pm-dispatch/references/contract-review.md
(the template lines plus one sentence about the guard), is not here, and could not be added inside the
dispatched surface. Measured, not assumed:

• check-skill-line-ratchet.mjs pins that file at 60 lines, and it is 60 lines — the gate's own
  verdict line is contract-review.md is 60 lines (ceiling 60; headroom 0). Any net growth is red.
• Both in-place payments are refused by standing rulings, so the growth cannot be self-funded. Re-wrap or
  densify to buy lines is 筹行, banned by the maintainer's 2026-08-17 ruling as recorded in SKILL.md:
  「⛔ re-wrap(折行合并)不得用作筹行 …… 新增以删减付账;密度优化仅随净减内容的 PR 顺带」. Deleting a
  ruled clause is refused on the state-machine precedent, recorded twice in this very file's own ceiling
  comments.
• The remaining route is the one this file's ceiling took on both prior occasions (51 to 57, then 57 to
  60): raise the ceiling, with the maintainer ruling quoted in the raising PR body — which means
  editing scripts/pm/check-skill-line-ratchet.mjs, a third file the dispatch did not authorize and
  explicitly said to stop on rather than improvise.

⚠️ It is also the wrong shape to improvise here specifically: granting my own diff an exemption from a
governance control, unilaterally, is the same act #14209 exists to record. So the guard ships and the
template waits for an authorization only the dispatching seat or the maintainer can give.

Consequence if this merges alone: none adverse. A verdict carrying neither line is silent by mandate,
so C4 simply does not fire until seats start writing the pair — the row is forward-compatible and inert
on today's board. The template half is what turns it on.

To finish the card on this branch: authorize the ceiling raise (60 to about 66), add the template
lines plus the guard sentence to the review-checklist section, record the raise above the CEILINGS entry
in the established comment form, and flip this PR's first line to the closing keyword.

Gates run

All readings at the pushed head 57f23063f (the final commit), every exit captured by
redirect-then-capture, never across a pipe.

• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack EXIT=0, repo assertion held,
  1 path vs merge base b992b1d64, three-dot, 199 families discovered, 13 matched plus 2
  convention-triggered (adds or edits a GATE SCRIPT).
• All 15 run. 14 EXIT=0: check:pm-clause2-carriers, check:pm-dispatch-gates,
  bare-root-worklist --self-test, check:agent-test-spelling, check:bash32-floor,
  check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard,
  check:pnpm-filter-targets, check:watch-hint-literal, check-cross-package-test-inputs.mjs,
  check-ci-filter-parity.mjs, check-shard-attestation.mjs.
• 1 NOT MEASURED, not a red: check-test-completeness.mjs EXIT=3, its own text — "The log comes from
  a test RUN. This gate does not run tests and cannot produce one … the local reading for this gate is
  NOT MEASURED." CI covers it.
• ⚠️check-ci-filter-parity.mjs and check-shard-attestation.mjs first returned EXIT=3 PREREQUISITE
  NOT MET ("the dependency yaml is not installed") because the worktree had no node_modules yet;
  both were re-run after pnpm install and are the EXIT=0 readings above. Recorded because a 3 read as a
  pass would have been the false green.
• Repo-wide, NOT narrowed: eslint . --no-inline-config --format json EXIT=0 — 5,644 files, 0 errors,
  0 warnings, with the edited file confirmed present in the linted set by its own JSON row.
• check-nul-bytes.mjs EXIT=0 (7,766 files). Control-character self-scan over the edited file with
  grep -naP returned rc=1, no matches.
• check-skill-line-ratchet.mjs EXIT=0 — unchanged, since no ceilinged file is touched.
• Self-test: 138 cases pass, up from 98 on the base commit — 40 new, of which 30 are C4's.

Ablation — the new cases can actually fail

Run from the committed implementation, so the restore leg had something true to restore to. The C4
comparison was neutered (if (implementedBy !== reviewedBy) replaced by if (true), marker appended).
Mutation confirmed ON DISK before running, not from the editor's exit code: the original anchor's
grep -cF count went 1 to 0 and the injected marker's 0 to 1. Ablated run: EXIT=1, 11 of 138 cases
failed, including "a same-session verdict FIRES C4" and "a self-reviewed pair is adverse even when
every carrier reading is clean". Restore by git checkout HEAD -- (absolute path) under an EXIT/INT/TERM
trap, then proved rather than assumed: git diff HEAD empty, marker count back to 0, and the worktree
blob hash equal to the HEAD blob hash (2ea30125… both sides). Self-test green again at 138.

No rebuild leg applies and none is claimed: this script is plain ESM executed from source, with no dist
between the edit and the run.

Landing shape

Draft, and it stays draft — .claude/-adjacent PM tooling under the governed four-step, which the
dispatching seat runs after this report. No auto-merge, no ready flip from here. skip-changeset applies
and is set: the diff is confined to scripts/pm/**, which publishes from no package.

---

Generated by Claude Code

[os-support-ai]

Part of #14209 — direction A's guard half. #14209 stays open: its template half is deferred on a
governance blocker named under "What is NOT in this PR", and merging this alone must not close the card.

Ruling being implemented (maintainer, 2026-09-01, verbatim and untranslated): 「同意 A」 — the
contract-review verdict template carries an Implemented-by: / Reviewed-by: session-ID pair, and the
guard refuses to recognise a verdict whose two IDs are the same session.

What changed

One file: scripts/pm/check-clause2-carriers.mjs, one new finding row C4, report-only like every
other row. No existing row is weakened or reordered, no label is ever written (the file's standing
NEVER_WRITES rule), and no sibling script is touched.

C4 reports a pair whose governing contract-review verdict names the SAME session on both authorship
lines — a self-review, which does not count as an independent review. The clause it finally carries is
references/contract-review.md's own: the in-seat path is scoped to 「低档实现者的契约增量,非自身产物」,
and its isolation sub-rule will not feed a reviewer even 「派发席自己的结论(污染即失独立性)」.

Four states, exactly as the card's scope sets them:

verdict on the card thread	C4
both lines, same session ID	fires — self-review
both lines, distinct session IDs	silent — this is the shape the clause asks for
neither line (a legacy verdict)	silent — absence never turns a historic pair red
one line only	fires as its own MALFORMED state — half a pair compares to nothing

The four design choices worth reviewing

1. The discriminator is a VERDICT: key line, picked from the live corpus rather than invented: real
   verdicts open a fenced block whose first line is VERDICT: PASS, beside REVIEWED-HEAD: and
   CLAUSE-2-PATH:. The same board supplies the near miss that makes the colon load-bearing — an os-dev
   report writes `VERDICT command-exit 0` in prose, repeatedly. Both are pinned as self-test
   fixtures, so a discriminator that matched the bare WORD would read a build log as a review verdict.
2. Spelling strictness mirrors the Clause-②: reader one section up: case-sensitive key, the session
   token immediately after the colon, trailing reasoning tolerated, the same markdown decoration allowed.
   One convention for machine spellings in this file, not two. Its residual hole is stated in the row
   rather than hidden: both IDs are SELF-DECLARED, and this file compares them to each other without
   cross-checking either against the implementation claim — it catches the honest self-review.
3. The NEWEST verdict carrying the pair governs. Load-bearing, not tidy: a self-review followed by an
   independent re-review is precisely the remedy the row asks for, so judging every verdict ever posted
   would leave a remediated pair red on every later sweep — the defect [finding] check-clause2-carriers.mjs --pair answers C3 / exit 4 on a LEGITIMATELY cleared clause-② pair — the completed state (declaration outlives the label) is indistinguishable from the fail-open it hunts #14155 had to repair in C3, where
   a row that could never clear made the landing check's own precondition unsatisfiable.
4. It costs no new request. C4 reads the card comment thread the declaration limb already fetches.

The file header's boundary sentence was narrowed to match, not quietly broken: it read "it does not read
verdict comments"; it now reads "it reads no verdict VALUE", with a starred paragraph saying that the
authorship pair is the one thing read out of a verdict and that no PASS or FAIL token is read to reach
it. The PASS half of the recovery rule stays human, exactly as before.

What is NOT in this PR, and why — please read before reviewing scope

The dispatched surface was two files. The second, .claude/skills/pm-dispatch/references/contract-review.md
(the template lines plus one sentence about the guard), is not here, and could not be added inside the
dispatched surface. Measured, not assumed:

• check-skill-line-ratchet.mjs pins that file at 60 lines, and it is 60 lines — the gate's own
  verdict line is contract-review.md is 60 lines (ceiling 60; headroom 0). Any net growth is red.
• Both in-place payments are refused by standing rulings, so the growth cannot be self-funded. Re-wrap or
  densify to buy lines is 筹行, banned by the maintainer's 2026-08-17 ruling as recorded in SKILL.md:
  「⛔ re-wrap(折行合并)不得用作筹行 …… 新增以删减付账;密度优化仅随净减内容的 PR 顺带」. Deleting a
  ruled clause is refused on the state-machine precedent, recorded twice in this very file's own ceiling
  comments.
• The remaining route is the one this file's ceiling took on both prior occasions (51 to 57, then 57 to
  60): raise the ceiling, with the maintainer ruling quoted in the raising PR body — which means
  editing scripts/pm/check-skill-line-ratchet.mjs, a third file the dispatch did not authorize and
  explicitly said to stop on rather than improvise.

⚠️ It is also the wrong shape to improvise here specifically: granting my own diff an exemption from a
governance control, unilaterally, is the same act #14209 exists to record. So the guard ships and the
template waits for an authorization only the dispatching seat or the maintainer can give.

Consequence if this merges alone: none adverse. A verdict carrying neither line is silent by mandate,
so C4 simply does not fire until seats start writing the pair — the row is forward-compatible and inert
on today's board. The template half is what turns it on.

To finish the card on this branch: authorize the ceiling raise (60 to about 66), add the template
lines plus the guard sentence to the review-checklist section, record the raise above the CEILINGS entry
in the established comment form, and flip this PR's first line to the closing keyword.

Gates run

All readings at the pushed head 57f23063f (the final commit), every exit captured by
redirect-then-capture, never across a pipe.

• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack EXIT=0, repo assertion held,
  1 path vs merge base b992b1d64, three-dot, 199 families discovered, 13 matched plus 2
  convention-triggered (adds or edits a GATE SCRIPT).
• All 15 run. 14 EXIT=0: check:pm-clause2-carriers, check:pm-dispatch-gates,
  bare-root-worklist --self-test, check:agent-test-spelling, check:bash32-floor,
  check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard,
  check:pnpm-filter-targets, check:watch-hint-literal, check-cross-package-test-inputs.mjs,
  check-ci-filter-parity.mjs, check-shard-attestation.mjs.
• 1 NOT MEASURED, not a red: check-test-completeness.mjs EXIT=3, its own text — "The log comes from
  a test RUN. This gate does not run tests and cannot produce one … the local reading for this gate is
  NOT MEASURED." CI covers it.
• ⚠️check-ci-filter-parity.mjs and check-shard-attestation.mjs first returned EXIT=3 PREREQUISITE
  NOT MET ("the dependency yaml is not installed") because the worktree had no node_modules yet;
  both were re-run after pnpm install and are the EXIT=0 readings above. Recorded because a 3 read as a
  pass would have been the false green.
• Repo-wide, NOT narrowed: eslint . --no-inline-config --format json EXIT=0 — 5,644 files, 0 errors,
  0 warnings, with the edited file confirmed present in the linted set by its own JSON row.
• check-nul-bytes.mjs EXIT=0 (7,766 files). Control-character self-scan over the edited file with
  grep -naP returned rc=1, no matches.
• check-skill-line-ratchet.mjs EXIT=0 — unchanged, since no ceilinged file is touched.
• Self-test: 138 cases pass, up from 98 on the base commit — 40 new, of which 30 are C4's.

Ablation — the new cases can actually fail

Run from the committed implementation, so the restore leg had something true to restore to. The C4
comparison was neutered (if (implementedBy !== reviewedBy) replaced by if (true), marker appended).
Mutation confirmed ON DISK before running, not from the editor's exit code: the original anchor's
grep -cF count went 1 to 0 and the injected marker's 0 to 1. Ablated run: EXIT=1, 11 of 138 cases
failed, including "a same-session verdict FIRES C4" and "a self-reviewed pair is adverse even when
every carrier reading is clean". Restore by git checkout HEAD -- (absolute path) under an EXIT/INT/TERM
trap, then proved rather than assumed: git diff HEAD empty, marker count back to 0, and the worktree
blob hash equal to the HEAD blob hash (2ea30125… both sides). Self-test green again at 138.

No rebuild leg applies and none is claimed: this script is plain ESM executed from source, with no dist
between the edit and the run.

Landing shape

Draft, and it stays draft — .claude/-adjacent PM tooling under the governed four-step, which the
dispatching seat runs after this report. No auto-merge, no ready flip from here. skip-changeset applies
and is set: the diff is confined to scripts/pm/**, which publishes from no package.

---

Generated by Claude Code

[os-support-ai]

Part of #14209 — direction A's guard half. #14209 stays open: its template half is deferred on a
governance blocker named under "What is NOT in this PR", and merging this alone must not close the card.

Ruling being implemented (maintainer, 2026-09-01, verbatim and untranslated): 「同意 A」 — the
contract-review verdict template carries an Implemented-by: / Reviewed-by: session-ID pair, and the
guard refuses to recognise a verdict whose two IDs are the same session.

What changed

One file: scripts/pm/check-clause2-carriers.mjs, one new finding row C4, report-only like every
other row. No existing row is weakened or reordered, no label is ever written (the file's standing
NEVER_WRITES rule), and no sibling script is touched.

C4 reports a pair whose governing contract-review verdict names the SAME session on both authorship
lines — a self-review, which does not count as an independent review. The clause it finally carries is
references/contract-review.md's own: the in-seat path is scoped to 「低档实现者的契约增量,非自身产物」,
and its isolation sub-rule will not feed a reviewer even 「派发席自己的结论(污染即失独立性)」.

Four states, exactly as the card's scope sets them:

verdict on the card thread	C4
both lines, same session ID	fires — self-review
both lines, distinct session IDs	silent — this is the shape the clause asks for
neither line (a legacy verdict)	silent — absence never turns a historic pair red
one line only	fires as its own MALFORMED state — half a pair compares to nothing

The four design choices worth reviewing

1. The discriminator is a VERDICT: key line, picked from the live corpus rather than invented: real
   verdicts open a fenced block whose first line is VERDICT: PASS, beside REVIEWED-HEAD: and
   CLAUSE-2-PATH:. The same board supplies the near miss that makes the colon load-bearing — an os-dev
   report writes `VERDICT command-exit 0` in prose, repeatedly. Both are pinned as self-test
   fixtures, so a discriminator that matched the bare WORD would read a build log as a review verdict.
2. Spelling strictness mirrors the Clause-②: reader one section up: case-sensitive key, the session
   token immediately after the colon, trailing reasoning tolerated, the same markdown decoration allowed.
   One convention for machine spellings in this file, not two. Its residual hole is stated in the row
   rather than hidden: both IDs are SELF-DECLARED, and this file compares them to each other without
   cross-checking either against the implementation claim — it catches the honest self-review.
3. The NEWEST verdict carrying the pair governs. Load-bearing, not tidy: a self-review followed by an
   independent re-review is precisely the remedy the row asks for, so judging every verdict ever posted
   would leave a remediated pair red on every later sweep — the defect [finding] check-clause2-carriers.mjs --pair answers C3 / exit 4 on a LEGITIMATELY cleared clause-② pair — the completed state (declaration outlives the label) is indistinguishable from the fail-open it hunts #14155 had to repair in C3, where
   a row that could never clear made the landing check's own precondition unsatisfiable.
4. It costs no new request. C4 reads the card comment thread the declaration limb already fetches.

The file header's boundary sentence was narrowed to match, not quietly broken: it read "it does not read
verdict comments"; it now reads "it reads no verdict VALUE", with a starred paragraph saying that the
authorship pair is the one thing read out of a verdict and that no PASS or FAIL token is read to reach
it. The PASS half of the recovery rule stays human, exactly as before.

What is NOT in this PR, and why — please read before reviewing scope

The dispatched surface was two files. The second, .claude/skills/pm-dispatch/references/contract-review.md
(the template lines plus one sentence about the guard), is not here, and could not be added inside the
dispatched surface. Measured, not assumed:

• check-skill-line-ratchet.mjs pins that file at 60 lines, and it is 60 lines — the gate's own
  verdict line is contract-review.md is 60 lines (ceiling 60; headroom 0). Any net growth is red.
• Both in-place payments are refused by standing rulings, so the growth cannot be self-funded. Re-wrap or
  densify to buy lines is 筹行, banned by the maintainer's 2026-08-17 ruling as recorded in SKILL.md:
  「⛔ re-wrap(折行合并)不得用作筹行 …… 新增以删减付账;密度优化仅随净减内容的 PR 顺带」. Deleting a
  ruled clause is refused on the state-machine precedent, recorded twice in this very file's own ceiling
  comments.
• The remaining route is the one this file's ceiling took on both prior occasions (51 to 57, then 57 to
  60): raise the ceiling, with the maintainer ruling quoted in the raising PR body — which means
  editing scripts/pm/check-skill-line-ratchet.mjs, a third file the dispatch did not authorize and
  explicitly said to stop on rather than improvise.

⚠️ It is also the wrong shape to improvise here specifically: granting my own diff an exemption from a
governance control, unilaterally, is the same act #14209 exists to record. So the guard ships and the
template waits for an authorization only the dispatching seat or the maintainer can give.

Consequence if this merges alone: none adverse. A verdict carrying neither line is silent by mandate,
so C4 simply does not fire until seats start writing the pair — the row is forward-compatible and inert
on today's board. The template half is what turns it on.

To finish the card on this branch: authorize the ceiling raise (60 to about 66), add the template
lines plus the guard sentence to the review-checklist section, record the raise above the CEILINGS entry
in the established comment form, and flip this PR's first line to the closing keyword.

Gates run

All readings at the pushed head 57f23063f (the final commit), every exit captured by
redirect-then-capture, never across a pipe.

• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack EXIT=0, repo assertion held,
  1 path vs merge base b992b1d64, three-dot, 199 families discovered, 13 matched plus 2
  convention-triggered (adds or edits a GATE SCRIPT).
• All 15 run. 14 EXIT=0: check:pm-clause2-carriers, check:pm-dispatch-gates,
  bare-root-worklist --self-test, check:agent-test-spelling, check:bash32-floor,
  check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard,
  check:pnpm-filter-targets, check:watch-hint-literal, check-cross-package-test-inputs.mjs,
  check-ci-filter-parity.mjs, check-shard-attestation.mjs.
• 1 NOT MEASURED, not a red: check-test-completeness.mjs EXIT=3, its own text — "The log comes from
  a test RUN. This gate does not run tests and cannot produce one … the local reading for this gate is
  NOT MEASURED." CI covers it.
• ⚠️check-ci-filter-parity.mjs and check-shard-attestation.mjs first returned EXIT=3 PREREQUISITE
  NOT MET ("the dependency yaml is not installed") because the worktree had no node_modules yet;
  both were re-run after pnpm install and are the EXIT=0 readings above. Recorded because a 3 read as a
  pass would have been the false green.
• Repo-wide, NOT narrowed: eslint . --no-inline-config --format json EXIT=0 — 5,644 files, 0 errors,
  0 warnings, with the edited file confirmed present in the linted set by its own JSON row.
• check-nul-bytes.mjs EXIT=0 (7,766 files). Control-character self-scan over the edited file with
  grep -naP returned rc=1, no matches.
• check-skill-line-ratchet.mjs EXIT=0 — unchanged, since no ceilinged file is touched.
• Self-test: 138 cases pass, up from 98 on the base commit — 40 new, of which 30 are C4's.

Ablation — the new cases can actually fail

Run from the committed implementation, so the restore leg had something true to restore to. The C4
comparison was neutered (if (implementedBy !== reviewedBy) replaced by if (true), marker appended).
Mutation confirmed ON DISK before running, not from the editor's exit code: the original anchor's
grep -cF count went 1 to 0 and the injected marker's 0 to 1. Ablated run: EXIT=1, 11 of 138 cases
failed, including "a same-session verdict FIRES C4" and "a self-reviewed pair is adverse even when
every carrier reading is clean". Restore by git checkout HEAD -- (absolute path) under an EXIT/INT/TERM
trap, then proved rather than assumed: git diff HEAD empty, marker count back to 0, and the worktree
blob hash equal to the HEAD blob hash (2ea30125… both sides). Self-test green again at 138.

No rebuild leg applies and none is claimed: this script is plain ESM executed from source, with no dist
between the edit and the run.

Landing shape

Draft, and it stays draft — .claude/-adjacent PM tooling under the governed four-step, which the
dispatching seat runs after this report. No auto-merge, no ready flip from here. skip-changeset applies
and is set: the diff is confined to scripts/pm/**, which publishes from no package.

---

Generated by Claude Code

[os-support-ai]

Part of #14209 — direction A's guard half. #14209 stays open: its template half is deferred on a
governance blocker named under "What is NOT in this PR", and merging this alone must not close the card.

Ruling being implemented (maintainer, 2026-09-01, verbatim and untranslated): 「同意 A」 — the
contract-review verdict template carries an Implemented-by: / Reviewed-by: session-ID pair, and the
guard refuses to recognise a verdict whose two IDs are the same session.

What changed

One file: scripts/pm/check-clause2-carriers.mjs, one new finding row C4, report-only like every
other row. No existing row is weakened or reordered, no label is ever written (the file's standing
NEVER_WRITES rule), and no sibling script is touched.

C4 reports a pair whose governing contract-review verdict names the SAME session on both authorship
lines — a self-review, which does not count as an independent review. The clause it finally carries is
references/contract-review.md's own: the in-seat path is scoped to 「低档实现者的契约增量,非自身产物」,
and its isolation sub-rule will not feed a reviewer even 「派发席自己的结论(污染即失独立性)」.

Four states, exactly as the card's scope sets them:

verdict on the card thread	C4
both lines, same session ID	fires — self-review
both lines, distinct session IDs	silent — this is the shape the clause asks for
neither line (a legacy verdict)	silent — absence never turns a historic pair red
one line only	fires as its own MALFORMED state — half a pair compares to nothing

The four design choices worth reviewing

1. The discriminator is a VERDICT: key line, picked from the live corpus rather than invented: real
   verdicts open a fenced block whose first line is VERDICT: PASS, beside REVIEWED-HEAD: and
   CLAUSE-2-PATH:. The same board supplies the near miss that makes the colon load-bearing — an os-dev
   report writes `VERDICT command-exit 0` in prose, repeatedly. Both are pinned as self-test
   fixtures, so a discriminator that matched the bare WORD would read a build log as a review verdict.
2. Spelling strictness mirrors the Clause-②: reader one section up: case-sensitive key, the session
   token immediately after the colon, trailing reasoning tolerated, the same markdown decoration allowed.
   One convention for machine spellings in this file, not two. Its residual hole is stated in the row
   rather than hidden: both IDs are SELF-DECLARED, and this file compares them to each other without
   cross-checking either against the implementation claim — it catches the honest self-review.
3. The NEWEST verdict carrying the pair governs. Load-bearing, not tidy: a self-review followed by an
   independent re-review is precisely the remedy the row asks for, so judging every verdict ever posted
   would leave a remediated pair red on every later sweep — the defect [finding] check-clause2-carriers.mjs --pair answers C3 / exit 4 on a LEGITIMATELY cleared clause-② pair — the completed state (declaration outlives the label) is indistinguishable from the fail-open it hunts #14155 had to repair in C3, where
   a row that could never clear made the landing check's own precondition unsatisfiable.
4. It costs no new request. C4 reads the card comment thread the declaration limb already fetches.

The file header's boundary sentence was narrowed to match, not quietly broken: it read "it does not read
verdict comments"; it now reads "it reads no verdict VALUE", with a starred paragraph saying that the
authorship pair is the one thing read out of a verdict and that no PASS or FAIL token is read to reach
it. The PASS half of the recovery rule stays human, exactly as before.

What is NOT in this PR, and why — please read before reviewing scope

The dispatched surface was two files. The second, .claude/skills/pm-dispatch/references/contract-review.md
(the template lines plus one sentence about the guard), is not here, and could not be added inside the
dispatched surface. Measured, not assumed:

• check-skill-line-ratchet.mjs pins that file at 60 lines, and it is 60 lines — the gate's own
  verdict line is contract-review.md is 60 lines (ceiling 60; headroom 0). Any net growth is red.
• Both in-place payments are refused by standing rulings, so the growth cannot be self-funded. Re-wrap or
  densify to buy lines is 筹行, banned by the maintainer's 2026-08-17 ruling as recorded in SKILL.md:
  「⛔ re-wrap(折行合并)不得用作筹行 …… 新增以删减付账;密度优化仅随净减内容的 PR 顺带」. Deleting a
  ruled clause is refused on the state-machine precedent, recorded twice in this very file's own ceiling
  comments.
• The remaining route is the one this file's ceiling took on both prior occasions (51 to 57, then 57 to
  60): raise the ceiling, with the maintainer ruling quoted in the raising PR body — which means
  editing scripts/pm/check-skill-line-ratchet.mjs, a third file the dispatch did not authorize and
  explicitly said to stop on rather than improvise.

⚠️ It is also the wrong shape to improvise here specifically: granting my own diff an exemption from a
governance control, unilaterally, is the same act #14209 exists to record. So the guard ships and the
template waits for an authorization only the dispatching seat or the maintainer can give.

Consequence if this merges alone: none adverse. A verdict carrying neither line is silent by mandate,
so C4 simply does not fire until seats start writing the pair — the row is forward-compatible and inert
on today's board. The template half is what turns it on.

To finish the card on this branch: authorize the ceiling raise (60 to about 66), add the template
lines plus the guard sentence to the review-checklist section, record the raise above the CEILINGS entry
in the established comment form, and flip this PR's first line to the closing keyword.

Gates run

All readings at the pushed head 57f23063f (the final commit), every exit captured by
redirect-then-capture, never across a pipe.

• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack EXIT=0, repo assertion held,
  1 path vs merge base b992b1d64, three-dot, 199 families discovered, 13 matched plus 2
  convention-triggered (adds or edits a GATE SCRIPT).
• All 15 run. 14 EXIT=0: check:pm-clause2-carriers, check:pm-dispatch-gates,
  bare-root-worklist --self-test, check:agent-test-spelling, check:bash32-floor,
  check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard,
  check:pnpm-filter-targets, check:watch-hint-literal, check-cross-package-test-inputs.mjs,
  check-ci-filter-parity.mjs, check-shard-attestation.mjs.
• 1 NOT MEASURED, not a red: check-test-completeness.mjs EXIT=3, its own text — "The log comes from
  a test RUN. This gate does not run tests and cannot produce one … the local reading for this gate is
  NOT MEASURED." CI covers it.
• ⚠️check-ci-filter-parity.mjs and check-shard-attestation.mjs first returned EXIT=3 PREREQUISITE
  NOT MET ("the dependency yaml is not installed") because the worktree had no node_modules yet;
  both were re-run after pnpm install and are the EXIT=0 readings above. Recorded because a 3 read as a
  pass would have been the false green.
• Repo-wide, NOT narrowed: eslint . --no-inline-config --format json EXIT=0 — 5,644 files, 0 errors,
  0 warnings, with the edited file confirmed present in the linted set by its own JSON row.
• check-nul-bytes.mjs EXIT=0 (7,766 files). Control-character self-scan over the edited file with
  grep -naP returned rc=1, no matches.
• check-skill-line-ratchet.mjs EXIT=0 — unchanged, since no ceilinged file is touched.
• Self-test: 138 cases pass, up from 98 on the base commit — 40 new, of which 30 are C4's.

Ablation — the new cases can actually fail

Run from the committed implementation, so the restore leg had something true to restore to. The C4
comparison was neutered (if (implementedBy !== reviewedBy) replaced by if (true), marker appended).
Mutation confirmed ON DISK before running, not from the editor's exit code: the original anchor's
grep -cF count went 1 to 0 and the injected marker's 0 to 1. Ablated run: EXIT=1, 11 of 138 cases
failed, including "a same-session verdict FIRES C4" and "a self-reviewed pair is adverse even when
every carrier reading is clean". Restore by git checkout HEAD -- (absolute path) under an EXIT/INT/TERM
trap, then proved rather than assumed: git diff HEAD empty, marker count back to 0, and the worktree
blob hash equal to the HEAD blob hash (2ea30125… both sides). Self-test green again at 138.

No rebuild leg applies and none is claimed: this script is plain ESM executed from source, with no dist
between the edit and the run.

Landing shape

Draft, and it stays draft — .claude/-adjacent PM tooling under the governed four-step, which the
dispatching seat runs after this report. No auto-merge, no ready flip from here. skip-changeset applies
and is set: the diff is confined to scripts/pm/**, which publishes from no package.

---

Generated by Claude Code

[os-support-ai]

Part of #14209 — direction A's guard half. #14209 stays open: its template half is deferred on a
governance blocker named under "What is NOT in this PR", and merging this alone must not close the card.

Ruling being implemented (maintainer, 2026-09-01, verbatim and untranslated): 「同意 A」 — the
contract-review verdict template carries an Implemented-by: / Reviewed-by: session-ID pair, and the
guard refuses to recognise a verdict whose two IDs are the same session.

What changed

One file: scripts/pm/check-clause2-carriers.mjs, one new finding row C4, report-only like every
other row. No existing row is weakened or reordered, no label is ever written (the file's standing
NEVER_WRITES rule), and no sibling script is touched.

C4 reports a pair whose governing contract-review verdict names the SAME session on both authorship
lines — a self-review, which does not count as an independent review. The clause it finally carries is
references/contract-review.md's own: the in-seat path is scoped to 「低档实现者的契约增量,非自身产物」,
and its isolation sub-rule will not feed a reviewer even 「派发席自己的结论(污染即失独立性)」.

Four states, exactly as the card's scope sets them:

verdict on the card thread	C4
both lines, same session ID	fires — self-review
both lines, distinct session IDs	silent — this is the shape the clause asks for
neither line (a legacy verdict)	silent — absence never turns a historic pair red
one line only	fires as its own MALFORMED state — half a pair compares to nothing

The four design choices worth reviewing

1. The discriminator is a VERDICT: key line, picked from the live corpus rather than invented: real
   verdicts open a fenced block whose first line is VERDICT: PASS, beside REVIEWED-HEAD: and
   CLAUSE-2-PATH:. The same board supplies the near miss that makes the colon load-bearing — an os-dev
   report writes `VERDICT command-exit 0` in prose, repeatedly. Both are pinned as self-test
   fixtures, so a discriminator that matched the bare WORD would read a build log as a review verdict.
2. Spelling strictness mirrors the Clause-②: reader one section up: case-sensitive key, the session
   token immediately after the colon, trailing reasoning tolerated, the same markdown decoration allowed.
   One convention for machine spellings in this file, not two. Its residual hole is stated in the row
   rather than hidden: both IDs are SELF-DECLARED, and this file compares them to each other without
   cross-checking either against the implementation claim — it catches the honest self-review.
3. The NEWEST verdict carrying the pair governs. Load-bearing, not tidy: a self-review followed by an
   independent re-review is precisely the remedy the row asks for, so judging every verdict ever posted
   would leave a remediated pair red on every later sweep — the defect [finding] check-clause2-carriers.mjs --pair answers C3 / exit 4 on a LEGITIMATELY cleared clause-② pair — the completed state (declaration outlives the label) is indistinguishable from the fail-open it hunts #14155 had to repair in C3, where
   a row that could never clear made the landing check's own precondition unsatisfiable.
4. It costs no new request. C4 reads the card comment thread the declaration limb already fetches.

The file header's boundary sentence was narrowed to match, not quietly broken: it read "it does not read
verdict comments"; it now reads "it reads no verdict VALUE", with a starred paragraph saying that the
authorship pair is the one thing read out of a verdict and that no PASS or FAIL token is read to reach
it. The PASS half of the recovery rule stays human, exactly as before.

What is NOT in this PR, and why — please read before reviewing scope

The dispatched surface was two files. The second, .claude/skills/pm-dispatch/references/contract-review.md
(the template lines plus one sentence about the guard), is not here, and could not be added inside the
dispatched surface. Measured, not assumed:

• check-skill-line-ratchet.mjs pins that file at 60 lines, and it is 60 lines — the gate's own
  verdict line is contract-review.md is 60 lines (ceiling 60; headroom 0). Any net growth is red.
• Both in-place payments are refused by standing rulings, so the growth cannot be self-funded. Re-wrap or
  densify to buy lines is 筹行, banned by the maintainer's 2026-08-17 ruling as recorded in SKILL.md:
  「⛔ re-wrap(折行合并)不得用作筹行 …… 新增以删减付账;密度优化仅随净减内容的 PR 顺带」. Deleting a
  ruled clause is refused on the state-machine precedent, recorded twice in this very file's own ceiling
  comments.
• The remaining route is the one this file's ceiling took on both prior occasions (51 to 57, then 57 to
  60): raise the ceiling, with the maintainer ruling quoted in the raising PR body — which means
  editing scripts/pm/check-skill-line-ratchet.mjs, a third file the dispatch did not authorize and
  explicitly said to stop on rather than improvise.

⚠️ It is also the wrong shape to improvise here specifically: granting my own diff an exemption from a
governance control, unilaterally, is the same act #14209 exists to record. So the guard ships and the
template waits for an authorization only the dispatching seat or the maintainer can give.

Consequence if this merges alone: none adverse. A verdict carrying neither line is silent by mandate,
so C4 simply does not fire until seats start writing the pair — the row is forward-compatible and inert
on today's board. The template half is what turns it on.

To finish the card on this branch: authorize the ceiling raise (60 to about 66), add the template
lines plus the guard sentence to the review-checklist section, record the raise above the CEILINGS entry
in the established comment form, and flip this PR's first line to the closing keyword.

Gates run

All readings at the pushed head 57f23063f (the final commit), every exit captured by
redirect-then-capture, never across a pipe.

• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack EXIT=0, repo assertion held,
  1 path vs merge base b992b1d64, three-dot, 199 families discovered, 13 matched plus 2
  convention-triggered (adds or edits a GATE SCRIPT).
• All 15 run. 14 EXIT=0: check:pm-clause2-carriers, check:pm-dispatch-gates,
  bare-root-worklist --self-test, check:agent-test-spelling, check:bash32-floor,
  check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard,
  check:pnpm-filter-targets, check:watch-hint-literal, check-cross-package-test-inputs.mjs,
  check-ci-filter-parity.mjs, check-shard-attestation.mjs.
• 1 NOT MEASURED, not a red: check-test-completeness.mjs EXIT=3, its own text — "The log comes from
  a test RUN. This gate does not run tests and cannot produce one … the local reading for this gate is
  NOT MEASURED." CI covers it.
• ⚠️check-ci-filter-parity.mjs and check-shard-attestation.mjs first returned EXIT=3 PREREQUISITE
  NOT MET ("the dependency yaml is not installed") because the worktree had no node_modules yet;
  both were re-run after pnpm install and are the EXIT=0 readings above. Recorded because a 3 read as a
  pass would have been the false green.
• Repo-wide, NOT narrowed: eslint . --no-inline-config --format json EXIT=0 — 5,644 files, 0 errors,
  0 warnings, with the edited file confirmed present in the linted set by its own JSON row.
• check-nul-bytes.mjs EXIT=0 (7,766 files). Control-character self-scan over the edited file with
  grep -naP returned rc=1, no matches.
• check-skill-line-ratchet.mjs EXIT=0 — unchanged, since no ceilinged file is touched.
• Self-test: 138 cases pass, up from 98 on the base commit — 40 new, of which 30 are C4's.

Ablation — the new cases can actually fail

Run from the committed implementation, so the restore leg had something true to restore to. The C4
comparison was neutered (if (implementedBy !== reviewedBy) replaced by if (true), marker appended).
Mutation confirmed ON DISK before running, not from the editor's exit code: the original anchor's
grep -cF count went 1 to 0 and the injected marker's 0 to 1. Ablated run: EXIT=1, 11 of 138 cases
failed, including "a same-session verdict FIRES C4" and "a self-reviewed pair is adverse even when
every carrier reading is clean". Restore by git checkout HEAD -- (absolute path) under an EXIT/INT/TERM
trap, then proved rather than assumed: git diff HEAD empty, marker count back to 0, and the worktree
blob hash equal to the HEAD blob hash (2ea30125… both sides). Self-test green again at 138.

No rebuild leg applies and none is claimed: this script is plain ESM executed from source, with no dist
between the edit and the run.

Landing shape

Draft, and it stays draft — .claude/-adjacent PM tooling under the governed four-step, which the
dispatching seat runs after this report. No auto-merge, no ready flip from here. skip-changeset applies
and is set: the diff is confined to scripts/pm/**, which publishes from no package.

---

Generated by Claude Code

[os-support-ai]

Part of #14209 — direction A's guard half. #14209 stays open: its template half is deferred on a
governance blocker named under "What is NOT in this PR", and merging this alone must not close the card.

Ruling being implemented (maintainer, 2026-09-01, verbatim and untranslated): 「同意 A」 — the
contract-review verdict template carries an Implemented-by: / Reviewed-by: session-ID pair, and the
guard refuses to recognise a verdict whose two IDs are the same session.

What changed

One file: scripts/pm/check-clause2-carriers.mjs, one new finding row C4, report-only like every
other row. No existing row is weakened or reordered, no label is ever written (the file's standing
NEVER_WRITES rule), and no sibling script is touched.

C4 reports a pair whose governing contract-review verdict names the SAME session on both authorship
lines — a self-review, which does not count as an independent review. The clause it finally carries is
references/contract-review.md's own: the in-seat path is scoped to 「低档实现者的契约增量,非自身产物」,
and its isolation sub-rule will not feed a reviewer even 「派发席自己的结论(污染即失独立性)」.

Four states, exactly as the card's scope sets them:

verdict on the card thread	C4
both lines, same session ID	fires — self-review
both lines, distinct session IDs	silent — this is the shape the clause asks for
neither line (a legacy verdict)	silent — absence never turns a historic pair red
one line only	fires as its own MALFORMED state — half a pair compares to nothing

The four design choices worth reviewing

1. The discriminator is a VERDICT: key line, picked from the live corpus rather than invented: real
   verdicts open a fenced block whose first line is VERDICT: PASS, beside REVIEWED-HEAD: and
   CLAUSE-2-PATH:. The same board supplies the near miss that makes the colon load-bearing — an os-dev
   report writes `VERDICT command-exit 0` in prose, repeatedly. Both are pinned as self-test
   fixtures, so a discriminator that matched the bare WORD would read a build log as a review verdict.
2. Spelling strictness mirrors the Clause-②: reader one section up: case-sensitive key, the session
   token immediately after the colon, trailing reasoning tolerated, the same markdown decoration allowed.
   One convention for machine spellings in this file, not two. Its residual hole is stated in the row
   rather than hidden: both IDs are SELF-DECLARED, and this file compares them to each other without
   cross-checking either against the implementation claim — it catches the honest self-review.
3. The NEWEST verdict carrying the pair governs. Load-bearing, not tidy: a self-review followed by an
   independent re-review is precisely the remedy the row asks for, so judging every verdict ever posted
   would leave a remediated pair red on every later sweep — the defect [finding] check-clause2-carriers.mjs --pair answers C3 / exit 4 on a LEGITIMATELY cleared clause-② pair — the completed state (declaration outlives the label) is indistinguishable from the fail-open it hunts #14155 had to repair in C3, where
   a row that could never clear made the landing check's own precondition unsatisfiable.
4. It costs no new request. C4 reads the card comment thread the declaration limb already fetches.

The file header's boundary sentence was narrowed to match, not quietly broken: it read "it does not read
verdict comments"; it now reads "it reads no verdict VALUE", with a starred paragraph saying that the
authorship pair is the one thing read out of a verdict and that no PASS or FAIL token is read to reach
it. The PASS half of the recovery rule stays human, exactly as before.

What is NOT in this PR, and why — please read before reviewing scope

The dispatched surface was two files. The second, .claude/skills/pm-dispatch/references/contract-review.md
(the template lines plus one sentence about the guard), is not here, and could not be added inside the
dispatched surface. Measured, not assumed:

• check-skill-line-ratchet.mjs pins that file at 60 lines, and it is 60 lines — the gate's own
  verdict line is contract-review.md is 60 lines (ceiling 60; headroom 0). Any net growth is red.
• Both in-place payments are refused by standing rulings, so the growth cannot be self-funded. Re-wrap or
  densify to buy lines is 筹行, banned by the maintainer's 2026-08-17 ruling as recorded in SKILL.md:
  「⛔ re-wrap(折行合并)不得用作筹行 …… 新增以删减付账;密度优化仅随净减内容的 PR 顺带」. Deleting a
  ruled clause is refused on the state-machine precedent, recorded twice in this very file's own ceiling
  comments.
• The remaining route is the one this file's ceiling took on both prior occasions (51 to 57, then 57 to
  60): raise the ceiling, with the maintainer ruling quoted in the raising PR body — which means
  editing scripts/pm/check-skill-line-ratchet.mjs, a third file the dispatch did not authorize and
  explicitly said to stop on rather than improvise.

⚠️ It is also the wrong shape to improvise here specifically: granting my own diff an exemption from a
governance control, unilaterally, is the same act #14209 exists to record. So the guard ships and the
template waits for an authorization only the dispatching seat or the maintainer can give.

Consequence if this merges alone: none adverse. A verdict carrying neither line is silent by mandate,
so C4 simply does not fire until seats start writing the pair — the row is forward-compatible and inert
on today's board. The template half is what turns it on.

To finish the card on this branch: authorize the ceiling raise (60 to about 66), add the template
lines plus the guard sentence to the review-checklist section, record the raise above the CEILINGS entry
in the established comment form, and flip this PR's first line to the closing keyword.

Gates run

All readings at the pushed head 57f23063f (the final commit), every exit captured by
redirect-then-capture, never across a pipe.

• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack EXIT=0, repo assertion held,
  1 path vs merge base b992b1d64, three-dot, 199 families discovered, 13 matched plus 2
  convention-triggered (adds or edits a GATE SCRIPT).
• All 15 run. 14 EXIT=0: check:pm-clause2-carriers, check:pm-dispatch-gates,
  bare-root-worklist --self-test, check:agent-test-spelling, check:bash32-floor,
  check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard,
  check:pnpm-filter-targets, check:watch-hint-literal, check-cross-package-test-inputs.mjs,
  check-ci-filter-parity.mjs, check-shard-attestation.mjs.
• 1 NOT MEASURED, not a red: check-test-completeness.mjs EXIT=3, its own text — "The log comes from
  a test RUN. This gate does not run tests and cannot produce one … the local reading for this gate is
  NOT MEASURED." CI covers it.
• ⚠️check-ci-filter-parity.mjs and check-shard-attestation.mjs first returned EXIT=3 PREREQUISITE
  NOT MET ("the dependency yaml is not installed") because the worktree had no node_modules yet;
  both were re-run after pnpm install and are the EXIT=0 readings above. Recorded because a 3 read as a
  pass would have been the false green.
• Repo-wide, NOT narrowed: eslint . --no-inline-config --format json EXIT=0 — 5,644 files, 0 errors,
  0 warnings, with the edited file confirmed present in the linted set by its own JSON row.
• check-nul-bytes.mjs EXIT=0 (7,766 files). Control-character self-scan over the edited file with
  grep -naP returned rc=1, no matches.
• check-skill-line-ratchet.mjs EXIT=0 — unchanged, since no ceilinged file is touched.
• Self-test: 138 cases pass, up from 98 on the base commit — 40 new, of which 30 are C4's.

Ablation — the new cases can actually fail

Run from the committed implementation, so the restore leg had something true to restore to. The C4
comparison was neutered (if (implementedBy !== reviewedBy) replaced by if (true), marker appended).
Mutation confirmed ON DISK before running, not from the editor's exit code: the original anchor's
grep -cF count went 1 to 0 and the injected marker's 0 to 1. Ablated run: EXIT=1, 11 of 138 cases
failed, including "a same-session verdict FIRES C4" and "a self-reviewed pair is adverse even when
every carrier reading is clean". Restore by git checkout HEAD -- (absolute path) under an EXIT/INT/TERM
trap, then proved rather than assumed: git diff HEAD empty, marker count back to 0, and the worktree
blob hash equal to the HEAD blob hash (2ea30125… both sides). Self-test green again at 138.

No rebuild leg applies and none is claimed: this script is plain ESM executed from source, with no dist
between the edit and the run.

Landing shape

Draft, and it stays draft — .claude/-adjacent PM tooling under the governed four-step, which the
dispatching seat runs after this report. No auto-merge, no ready flip from here. skip-changeset applies
and is set: the diff is confined to scripts/pm/**, which publishes from no package.

---

Generated by Claude Code