fix(pm): the contract-review tier constant names the served tier and is the only place the tier's value lives (#14303)

[os-litant]

Fixes#14303

Governed surface (scripts/pm/**, .claude/**) — draft-only, human merge; needs:contract-review rides on the PR. Releases nothing: the diff is scripts/pm/** + .claude/skills/**, both inside scripts/check-empty-changeset.mjs's own release-nothing enumeration (.claude/, skills/, a CI-internal script) — hence skip-changeset.

What changed

Exactly the limb triage queued (issue comment 5503739916): the constant is bumped to the served tier, and every other site under .claude/skills/pm-dispatch/** and scripts/pm/** NAMES CONTRACT_REVIEW_TIER instead of spelling the model. The comparison stays exact — no family/prefix floor anywhere (that widening is the human floor's and is explicitly out of scope). SKILL.md:773's promise 「模型升级只改一行一个文件」 is now true: the model id is spelled as a value on one line of one file.

The diff carries the values; by design this body spells no model identifier. The served-tier get_session readings and the --tier output are on the card, in the flight's report comment.

Acceptance test — hit counts, not strings

git grep -n for the model-family pattern of the triage acceptance test over .claude/skills/pm-dispatch scripts/pm .claude/agents skills/objectstack-pm-dispatch:

tree	BEFORE (base a5b95ee6)	AFTER (head 2a8afbc0)
.claude/skills/pm-dispatch/SKILL.md	3 (:361:591:599)	0
scripts/pm/dispatch-gates.mjs	13	1 — the constant's definition line
.claude/agents/**	0	0
skills/objectstack-pm-dispatch/** (published twin)	0	0
total	16	1

Whole-repo git grep -c for the same pattern at head: one file, one hit (the same line).

Per-site: site | before | after (line numbers from base a5b95ee6; LITERAL stands for the spelled model id)

site	before	after
scripts/pm/dispatch-gates.mjs:8091 (now :7955)	export const CONTRACT_REVIEW_TIER = LITERAL;, declared AFTER the mandate table	value bumped to the served tier; definition and docblock hoisted above MANDATORY_TIER_GLOBS — the rows must read an initialised binding, and a const referenced before its declaration throws at import (import probe after the edit: constant and all three rows resolve to the same value). Docblock now states: one value site, exact comparison, no family/prefix floor
:8064:8069:8074 (mandate rows)	tier: LITERAL, three times	tier: CONTRACT_REVIEW_TIER — one definition, zero literals
:7970:7980 (header comment, clause ① and clause ②)	spells LITERAL	names CONTRACT_REVIEW_TIER
:15301:15302:15303:15306:15378 (self-test)	.tier === LITERAL	.tier === CONTRACT_REVIEW_TIER
:15319 (self-test)	mandLines.includes(LITERAL)	mandLines.includes(CONTRACT_REVIEW_TIER)
:15340 (self-test fixture, ambiguity refusal)	tier: LITERAL beside a tier: 'opus' row	tier: CONTRACT_REVIEW_TIER beside the same 'opus' row
:15408 (non-empty model id)	—	untouched
.claude/skills/pm-dispatch/SKILL.md:361 (+ :360)	:361 opened with LITERAL (the urgent-card triage subagent)	:360 ends 立即起 \CONTRACT_REVIEW_TIER` 档, :361opens分诊子代理,… — one sentence rebalanced across its own two lines (:361` was 119 bytes against the 120-byte cap; no words dropped)
SKILL.md:591 (+ :590)	clause ① model: "LITERAL"	一律 \CONTRACT_REVIEW_TIER` 档(`--tier` 输出) — names the constant AND the command whose output the seat types (node scripts/pm/dispatch-gates.mjs --tier, spelled in full in the claim-comment template at :546); ① 凡改moved to the tail of:590` for the byte cap, same paragraph
SKILL.md:599	clause ② 一律 LITERAL	一律 \CONTRACT_REVIEW_TIER` 档, the form references/lanes/director.md:13` already uses

Line-neutral under the ratchet: SKILL.md is 989 lines before and after (ceiling 1005, headroom 16), widest table row 642 bytes (pin 642, unchanged), max-line-bytes scan 0 offenders; touched lines measure 118 / 101 / 110 / 115 / 85 bytes (:360:361:590:591:599). scripts/pm/check-skill-line-ratchet.mjs untouched.

Self-test assertions rewritten, and what each still proves

• :15301:15302:15303 — each protocol-semantic file derives a mandate whose tier equals the single-source constant: still an exact string equality, still fails on a missing row or a row spelling any other value.
• :15306 — a mixed surface is mandatory and its tier equals the constant.
• :15319 — the mandatory rendering contains the constant's VALUE (the claim comment quotes those lines).
• :15340 — the ambiguity fixture still mandates two DIFFERENT tiers (the constant vs 'opus'), so the refusal it pins is unchanged.
• :15378 — every frame-sync-enforced copy derives a tier equal to the constant.
• :15408 — unchanged (non-empty model id).

Nothing weakened: every comparison remains an exact equality against one concrete string; only the string's source moved from a second literal to the constant.

premise_false (skipped, listed, never forced)

• references/contract-review.md:51, references/platform-readings.md — name the constant, no literal at this base; untouched (comparison text stays "against the constant"; "floor" never written).
• scripts/pm/ensure-pm-labels.sh:264, scripts/pm/check-governed-queue-guard.mjs:267 — comments naming the constant/pattern, no value; untouched.
• .claude/agents/os-dev.md — zero hits at this base; untouched.
• skills/objectstack-pm-dispatch/** — zero hits at this base; follow-up for objectstack-pm-dispatch: none.
• Frames: the check:skill-frame-sync COPIES anchors in SKILL.md sit at :880–:897; all three edited sites are outside every frame and the other three copies carry no model id — the model name is not part of any frame, so the published twin does not have to move.
• Verbatim maintainer rulings that mention the model family as prose (SKILL.md:586, references/dispatch-runbook.md:17) are quotations, not values, are not matched by the acceptance pattern, and stay verbatim.

Gates — union derived by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at the merge-base (22 commands) plus the PM-named extras, run in order at head 2a8afbc0 under scripts/pm/os-verify-lock.sh (slot issue-14303), each exit code captured before any pipe

#	command	exit	the gate's own verdict line
01	node scripts/check-ci-filter-parity.mjs	0 (0s)	OK: all 130 declared cross-package glob(s) (92 unique) are covered by core or crosspkg, every crosspkg entry still covers one, and the test jo
02	node scripts/check-cross-package-test-inputs.mjs	0 (1s)	OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
03	node scripts/check-self-test-wired.mjs	0 (1s)	✓ check-self-test-wired: every one of the 164 script(s) CI runs that ship a --self-test has that self-test run by CI.
04	node scripts/check-shard-attestation.mjs	0 (0s)	✓ check-shard-attestation: 2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s).
05	node scripts/check-test-completeness.mjs	3 (0s)	NOT MEASURED — its own text: "Nothing was measured: this gate exited before parsing a single summary line"; prerequisite: a saved turbo run test log, which CI's own run supplies
06	pnpm --filter @objectstack/lint run check:doc-formula-expressions	3 (2s)	NOT MEASURED — its own Fix line: pnpm exec turbo run build --filter=@objectstack/formula; prerequisite: a built @objectstack/formula — CI builds the closure and supplies the reading (a local build attempt was cut by the container command cap and is not a reading)
07	pnpm check:agent-test-spelling	0 (2s)	✓ check-agent-test-spelling: 0 violations — 428 file(s) · 5633 bare -- token(s) · 1380 launcher-rooted run(s) · 9 separator(s) JUDGED · 5 vitest-bac
08	pnpm check:bash32-floor	0 (1s)	✓ check-bash32-floor: 26 tracked shell file(s) under scripts/, .claude/hooks/, .githooks/** name no bash 4+ construct outside a comment, a guarded
09	pnpm check:cli-command-ids	0 (7s)	✓ check-cli-command-ids: 315 command-id literal(s) across 112 file(s) outside packages/cli all resolve to a real command path (73 ids derived; 3 decla
10	pnpm check:cross-package-test-inputs	0 (2s)	OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
11	pnpm check:declared-population-live	0 (12s)	✓ check:declared-population-live — 158 of 202 famil(ies) declare a path population, and every one of them reaches this tree's 7986 tracked file(s).
12	pnpm check:doc-authoring	0 (6s)	✓ doc authoring guard: sibling-package prose ids hold the baseline — 831 pinned site(s) across 231 file(s), 82730 string(s) read in 1124 parsed source
13	pnpm check:entry-guard	0 (18s)	✓ check:entry-guard: 199 scripts/ file(s) — every entry guard goes through invoked-as.mjs; 150 export bindings, 148 of them inert on import (2 known-u
14	pnpm check:parse-guard	0 (2s)	✓ check:parse-guard: 198 scripts/ file(s) — every TypeScript parse goes through ts-parse.mjs.
15	pnpm check:pm-governed-merges	0 (3s)	✓ check-governed-merges --self-test: 243 assertions (the unified governed predicate + near misses, subject→PR spellings, window parsing, the #12633 la
16	pnpm check:pm-governed-prose	0 (1s)	✓ check-governed-prose: 2 instruction surface(s) name all 5 registered governed surfaces (docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md
17	pnpm check:pm-skill-id-lint	0 (1s)	✓ check-skill-id-lint: 23 file(s) clean (pattern /#[0-9]{3,}/g).
18	pnpm check:pm-skill-ratchet	0 (1s)	✓ check-skill-line-ratchet: CLAUDE.md is 86 lines (ceiling 86; headroom 0).
19	pnpm check:pnpm-filter-targets	0 (2s)	✓ check:pnpm-filter-targets: 142/181 --filter occurrence(s) across 32 file(s) resolve against 79 workspace package(s); 39 not judged (2 foreign, 17
20	pnpm check:skill-frame-sync	0 (1s)	✓ check-skill-frame-sync: 4 copies of the decision frame are structurally isomorphic across 3 files
21	pnpm check:watch-hint-literal	0 (3s)	✓ check-watch-hint-literal: 45 declaration(s) across 4 rostered name(s) -- ROOT_DIR_WATCH_HINTS 29, ROOT_FILE_WATCH_HINTS 9, ROOT_WATCH_HINTS 2, DECLA
22	pnpm check:skill-frame-freshness	0 (3s)	✓ check-skill-frame-freshness: the decision frame in this tree is current with origin/main (fetched just now).
23	pnpm check:nul-bytes	0 (2s)	check-nul-bytes: OK (scanned 7979 text file(s) -- 7979 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
24	node scripts/pm/check-governed-queue-guard.mjs --self-test	0 (0s)	✓ check-governed-queue-guard self-test: 129 cases pass (register-driven verdicts, the queue/PR event split, latest-decisive approval reduction, the 20
25	pnpm check:pm-dispatch-gates	0 (309s)	✓ dispatch-gates self-test: 1240 cases pass.

Lock wrapper's own VERDICT: command-exit 0 · held the lock 380s (6m20s) · waited 0s. check:pm-dispatch-gates streamed 1241 ✓ / 0 ✗ case lines. The line-ratchet gate was also run standalone right after the edit (self-test 111 cases pass; SKILL.md 989 lines, widest row 642).

NOT MEASURED

• node scripts/check-test-completeness.mjs — exit 3. Prerequisite: a saved turbo run test log; CI's run supplies it. Not a red, nothing to fix locally.
• pnpm --filter @objectstack/lint run check:doc-formula-expressions — exit 3. Prerequisite: a built @objectstack/formula (pnpm exec turbo run build --filter=@objectstack/formula); CI builds the closure and supplies the reading. Neither gate reads the two files this PR touches.

Session (durable attribution): https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[os-litant]

Fixes#14303

Governed surface (scripts/pm/**, .claude/**) — draft-only, human merge; needs:contract-review rides on the PR. Releases nothing: the diff is scripts/pm/** + .claude/skills/**, both inside scripts/check-empty-changeset.mjs's own release-nothing enumeration (.claude/, skills/, a CI-internal script) — hence skip-changeset.

What changed

Exactly the limb triage queued (issue comment 5503739916): the constant is bumped to the served tier, and every other site under .claude/skills/pm-dispatch/** and scripts/pm/** NAMES CONTRACT_REVIEW_TIER instead of spelling the model. The comparison stays exact — no family/prefix floor anywhere (that widening is the human floor's and is explicitly out of scope). SKILL.md:773's promise 「模型升级只改一行一个文件」 is now true: the model id is spelled as a value on one line of one file.

The diff carries the values; by design this body spells no model identifier. The served-tier get_session readings and the --tier output are on the card, in the flight's report comment.

Acceptance test — hit counts, not strings

git grep -n for the model-family pattern of the triage acceptance test over .claude/skills/pm-dispatch scripts/pm .claude/agents skills/objectstack-pm-dispatch:

tree	BEFORE (base a5b95ee6)	AFTER (head 2a8afbc0)
.claude/skills/pm-dispatch/SKILL.md	3 (:361:591:599)	0
scripts/pm/dispatch-gates.mjs	13	1 — the constant's definition line
.claude/agents/**	0	0
skills/objectstack-pm-dispatch/** (published twin)	0	0
total	16	1

Whole-repo git grep -c for the same pattern at head: one file, one hit (the same line).

Per-site: site | before | after (line numbers from base a5b95ee6; LITERAL stands for the spelled model id)

site	before	after
scripts/pm/dispatch-gates.mjs:8091 (now :7955)	export const CONTRACT_REVIEW_TIER = LITERAL;, declared AFTER the mandate table	value bumped to the served tier; definition and docblock hoisted above MANDATORY_TIER_GLOBS — the rows must read an initialised binding, and a const referenced before its declaration throws at import (import probe after the edit: constant and all three rows resolve to the same value). Docblock now states: one value site, exact comparison, no family/prefix floor
:8064:8069:8074 (mandate rows)	tier: LITERAL, three times	tier: CONTRACT_REVIEW_TIER — one definition, zero literals
:7970:7980 (header comment, clause ① and clause ②)	spells LITERAL	names CONTRACT_REVIEW_TIER
:15301:15302:15303:15306:15378 (self-test)	.tier === LITERAL	.tier === CONTRACT_REVIEW_TIER
:15319 (self-test)	mandLines.includes(LITERAL)	mandLines.includes(CONTRACT_REVIEW_TIER)
:15340 (self-test fixture, ambiguity refusal)	tier: LITERAL beside a tier: 'opus' row	tier: CONTRACT_REVIEW_TIER beside the same 'opus' row
:15408 (non-empty model id)	—	untouched
.claude/skills/pm-dispatch/SKILL.md:361 (+ :360)	:361 opened with LITERAL (the urgent-card triage subagent)	:360 ends 立即起 \CONTRACT_REVIEW_TIER` 档, :361opens分诊子代理,… — one sentence rebalanced across its own two lines (:361` was 119 bytes against the 120-byte cap; no words dropped)
SKILL.md:591 (+ :590)	clause ① model: "LITERAL"	一律 \CONTRACT_REVIEW_TIER` 档(`--tier` 输出) — names the constant AND the command whose output the seat types (node scripts/pm/dispatch-gates.mjs --tier, spelled in full in the claim-comment template at :546); ① 凡改moved to the tail of:590` for the byte cap, same paragraph
SKILL.md:599	clause ② 一律 LITERAL	一律 \CONTRACT_REVIEW_TIER` 档, the form references/lanes/director.md:13` already uses

Line-neutral under the ratchet: SKILL.md is 989 lines before and after (ceiling 1005, headroom 16), widest table row 642 bytes (pin 642, unchanged), max-line-bytes scan 0 offenders; touched lines measure 118 / 101 / 110 / 115 / 85 bytes (:360:361:590:591:599). scripts/pm/check-skill-line-ratchet.mjs untouched.

Self-test assertions rewritten, and what each still proves

• :15301:15302:15303 — each protocol-semantic file derives a mandate whose tier equals the single-source constant: still an exact string equality, still fails on a missing row or a row spelling any other value.
• :15306 — a mixed surface is mandatory and its tier equals the constant.
• :15319 — the mandatory rendering contains the constant's VALUE (the claim comment quotes those lines).
• :15340 — the ambiguity fixture still mandates two DIFFERENT tiers (the constant vs 'opus'), so the refusal it pins is unchanged.
• :15378 — every frame-sync-enforced copy derives a tier equal to the constant.
• :15408 — unchanged (non-empty model id).

Nothing weakened: every comparison remains an exact equality against one concrete string; only the string's source moved from a second literal to the constant.

premise_false (skipped, listed, never forced)

• references/contract-review.md:51, references/platform-readings.md — name the constant, no literal at this base; untouched (comparison text stays "against the constant"; "floor" never written).
• scripts/pm/ensure-pm-labels.sh:264, scripts/pm/check-governed-queue-guard.mjs:267 — comments naming the constant/pattern, no value; untouched.
• .claude/agents/os-dev.md — zero hits at this base; untouched.
• skills/objectstack-pm-dispatch/** — zero hits at this base; follow-up for objectstack-pm-dispatch: none.
• Frames: the check:skill-frame-sync COPIES anchors in SKILL.md sit at :880–:897; all three edited sites are outside every frame and the other three copies carry no model id — the model name is not part of any frame, so the published twin does not have to move.
• Verbatim maintainer rulings that mention the model family as prose (SKILL.md:586, references/dispatch-runbook.md:17) are quotations, not values, are not matched by the acceptance pattern, and stay verbatim.

Gates — union derived by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at the merge-base (22 commands) plus the PM-named extras, run in order at head 2a8afbc0 under scripts/pm/os-verify-lock.sh (slot issue-14303), each exit code captured before any pipe

#	command	exit	the gate's own verdict line
01	node scripts/check-ci-filter-parity.mjs	0 (0s)	OK: all 130 declared cross-package glob(s) (92 unique) are covered by core or crosspkg, every crosspkg entry still covers one, and the test jo
02	node scripts/check-cross-package-test-inputs.mjs	0 (1s)	OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
03	node scripts/check-self-test-wired.mjs	0 (1s)	✓ check-self-test-wired: every one of the 164 script(s) CI runs that ship a --self-test has that self-test run by CI.
04	node scripts/check-shard-attestation.mjs	0 (0s)	✓ check-shard-attestation: 2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s).
05	node scripts/check-test-completeness.mjs	3 (0s)	NOT MEASURED — its own text: "Nothing was measured: this gate exited before parsing a single summary line"; prerequisite: a saved turbo run test log, which CI's own run supplies
06	pnpm --filter @objectstack/lint run check:doc-formula-expressions	3 (2s)	NOT MEASURED — its own Fix line: pnpm exec turbo run build --filter=@objectstack/formula; prerequisite: a built @objectstack/formula — CI builds the closure and supplies the reading (a local build attempt was cut by the container command cap and is not a reading)
07	pnpm check:agent-test-spelling	0 (2s)	✓ check-agent-test-spelling: 0 violations — 428 file(s) · 5633 bare -- token(s) · 1380 launcher-rooted run(s) · 9 separator(s) JUDGED · 5 vitest-bac
08	pnpm check:bash32-floor	0 (1s)	✓ check-bash32-floor: 26 tracked shell file(s) under scripts/, .claude/hooks/, .githooks/** name no bash 4+ construct outside a comment, a guarded
09	pnpm check:cli-command-ids	0 (7s)	✓ check-cli-command-ids: 315 command-id literal(s) across 112 file(s) outside packages/cli all resolve to a real command path (73 ids derived; 3 decla
10	pnpm check:cross-package-test-inputs	0 (2s)	OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
11	pnpm check:declared-population-live	0 (12s)	✓ check:declared-population-live — 158 of 202 famil(ies) declare a path population, and every one of them reaches this tree's 7986 tracked file(s).
12	pnpm check:doc-authoring	0 (6s)	✓ doc authoring guard: sibling-package prose ids hold the baseline — 831 pinned site(s) across 231 file(s), 82730 string(s) read in 1124 parsed source
13	pnpm check:entry-guard	0 (18s)	✓ check:entry-guard: 199 scripts/ file(s) — every entry guard goes through invoked-as.mjs; 150 export bindings, 148 of them inert on import (2 known-u
14	pnpm check:parse-guard	0 (2s)	✓ check:parse-guard: 198 scripts/ file(s) — every TypeScript parse goes through ts-parse.mjs.
15	pnpm check:pm-governed-merges	0 (3s)	✓ check-governed-merges --self-test: 243 assertions (the unified governed predicate + near misses, subject→PR spellings, window parsing, the #12633 la
16	pnpm check:pm-governed-prose	0 (1s)	✓ check-governed-prose: 2 instruction surface(s) name all 5 registered governed surfaces (docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md
17	pnpm check:pm-skill-id-lint	0 (1s)	✓ check-skill-id-lint: 23 file(s) clean (pattern /#[0-9]{3,}/g).
18	pnpm check:pm-skill-ratchet	0 (1s)	✓ check-skill-line-ratchet: CLAUDE.md is 86 lines (ceiling 86; headroom 0).
19	pnpm check:pnpm-filter-targets	0 (2s)	✓ check:pnpm-filter-targets: 142/181 --filter occurrence(s) across 32 file(s) resolve against 79 workspace package(s); 39 not judged (2 foreign, 17
20	pnpm check:skill-frame-sync	0 (1s)	✓ check-skill-frame-sync: 4 copies of the decision frame are structurally isomorphic across 3 files
21	pnpm check:watch-hint-literal	0 (3s)	✓ check-watch-hint-literal: 45 declaration(s) across 4 rostered name(s) -- ROOT_DIR_WATCH_HINTS 29, ROOT_FILE_WATCH_HINTS 9, ROOT_WATCH_HINTS 2, DECLA
22	pnpm check:skill-frame-freshness	0 (3s)	✓ check-skill-frame-freshness: the decision frame in this tree is current with origin/main (fetched just now).
23	pnpm check:nul-bytes	0 (2s)	check-nul-bytes: OK (scanned 7979 text file(s) -- 7979 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
24	node scripts/pm/check-governed-queue-guard.mjs --self-test	0 (0s)	✓ check-governed-queue-guard self-test: 129 cases pass (register-driven verdicts, the queue/PR event split, latest-decisive approval reduction, the 20
25	pnpm check:pm-dispatch-gates	0 (309s)	✓ dispatch-gates self-test: 1240 cases pass.

Lock wrapper's own VERDICT: command-exit 0 · held the lock 380s (6m20s) · waited 0s. check:pm-dispatch-gates streamed 1241 ✓ / 0 ✗ case lines. The line-ratchet gate was also run standalone right after the edit (self-test 111 cases pass; SKILL.md 989 lines, widest row 642).

NOT MEASURED

• node scripts/check-test-completeness.mjs — exit 3. Prerequisite: a saved turbo run test log; CI's run supplies it. Not a red, nothing to fix locally.
• pnpm --filter @objectstack/lint run check:doc-formula-expressions — exit 3. Prerequisite: a built @objectstack/formula (pnpm exec turbo run build --filter=@objectstack/formula); CI builds the closure and supplies the reading. Neither gate reads the two files this PR touches.

Session (durable attribution): https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[os-litant]

Fixes#14303

Governed surface (scripts/pm/**, .claude/**) — draft-only, human merge; needs:contract-review rides on the PR. Releases nothing: the diff is scripts/pm/** + .claude/skills/**, both inside scripts/check-empty-changeset.mjs's own release-nothing enumeration (.claude/, skills/, a CI-internal script) — hence skip-changeset.

What changed

Exactly the limb triage queued (issue comment 5503739916): the constant is bumped to the served tier, and every other site under .claude/skills/pm-dispatch/** and scripts/pm/** NAMES CONTRACT_REVIEW_TIER instead of spelling the model. The comparison stays exact — no family/prefix floor anywhere (that widening is the human floor's and is explicitly out of scope). SKILL.md:773's promise 「模型升级只改一行一个文件」 is now true: the model id is spelled as a value on one line of one file.

The diff carries the values; by design this body spells no model identifier. The served-tier get_session readings and the --tier output are on the card, in the flight's report comment.

Acceptance test — hit counts, not strings

git grep -n for the model-family pattern of the triage acceptance test over .claude/skills/pm-dispatch scripts/pm .claude/agents skills/objectstack-pm-dispatch:

tree	BEFORE (base a5b95ee6)	AFTER (head 2a8afbc0)
.claude/skills/pm-dispatch/SKILL.md	3 (:361:591:599)	0
scripts/pm/dispatch-gates.mjs	13	1 — the constant's definition line
.claude/agents/**	0	0
skills/objectstack-pm-dispatch/** (published twin)	0	0
total	16	1

Whole-repo git grep -c for the same pattern at head: one file, one hit (the same line).

Per-site: site | before | after (line numbers from base a5b95ee6; LITERAL stands for the spelled model id)

site	before	after
scripts/pm/dispatch-gates.mjs:8091 (now :7955)	export const CONTRACT_REVIEW_TIER = LITERAL;, declared AFTER the mandate table	value bumped to the served tier; definition and docblock hoisted above MANDATORY_TIER_GLOBS — the rows must read an initialised binding, and a const referenced before its declaration throws at import (import probe after the edit: constant and all three rows resolve to the same value). Docblock now states: one value site, exact comparison, no family/prefix floor
:8064:8069:8074 (mandate rows)	tier: LITERAL, three times	tier: CONTRACT_REVIEW_TIER — one definition, zero literals
:7970:7980 (header comment, clause ① and clause ②)	spells LITERAL	names CONTRACT_REVIEW_TIER
:15301:15302:15303:15306:15378 (self-test)	.tier === LITERAL	.tier === CONTRACT_REVIEW_TIER
:15319 (self-test)	mandLines.includes(LITERAL)	mandLines.includes(CONTRACT_REVIEW_TIER)
:15340 (self-test fixture, ambiguity refusal)	tier: LITERAL beside a tier: 'opus' row	tier: CONTRACT_REVIEW_TIER beside the same 'opus' row
:15408 (non-empty model id)	—	untouched
.claude/skills/pm-dispatch/SKILL.md:361 (+ :360)	:361 opened with LITERAL (the urgent-card triage subagent)	:360 ends 立即起 \CONTRACT_REVIEW_TIER` 档, :361opens分诊子代理,… — one sentence rebalanced across its own two lines (:361` was 119 bytes against the 120-byte cap; no words dropped)
SKILL.md:591 (+ :590)	clause ① model: "LITERAL"	一律 \CONTRACT_REVIEW_TIER` 档(`--tier` 输出) — names the constant AND the command whose output the seat types (node scripts/pm/dispatch-gates.mjs --tier, spelled in full in the claim-comment template at :546); ① 凡改moved to the tail of:590` for the byte cap, same paragraph
SKILL.md:599	clause ② 一律 LITERAL	一律 \CONTRACT_REVIEW_TIER` 档, the form references/lanes/director.md:13` already uses

Line-neutral under the ratchet: SKILL.md is 989 lines before and after (ceiling 1005, headroom 16), widest table row 642 bytes (pin 642, unchanged), max-line-bytes scan 0 offenders; touched lines measure 118 / 101 / 110 / 115 / 85 bytes (:360:361:590:591:599). scripts/pm/check-skill-line-ratchet.mjs untouched.

Self-test assertions rewritten, and what each still proves

• :15301:15302:15303 — each protocol-semantic file derives a mandate whose tier equals the single-source constant: still an exact string equality, still fails on a missing row or a row spelling any other value.
• :15306 — a mixed surface is mandatory and its tier equals the constant.
• :15319 — the mandatory rendering contains the constant's VALUE (the claim comment quotes those lines).
• :15340 — the ambiguity fixture still mandates two DIFFERENT tiers (the constant vs 'opus'), so the refusal it pins is unchanged.
• :15378 — every frame-sync-enforced copy derives a tier equal to the constant.
• :15408 — unchanged (non-empty model id).

Nothing weakened: every comparison remains an exact equality against one concrete string; only the string's source moved from a second literal to the constant.

premise_false (skipped, listed, never forced)

• references/contract-review.md:51, references/platform-readings.md — name the constant, no literal at this base; untouched (comparison text stays "against the constant"; "floor" never written).
• scripts/pm/ensure-pm-labels.sh:264, scripts/pm/check-governed-queue-guard.mjs:267 — comments naming the constant/pattern, no value; untouched.
• .claude/agents/os-dev.md — zero hits at this base; untouched.
• skills/objectstack-pm-dispatch/** — zero hits at this base; follow-up for objectstack-pm-dispatch: none.
• Frames: the check:skill-frame-sync COPIES anchors in SKILL.md sit at :880–:897; all three edited sites are outside every frame and the other three copies carry no model id — the model name is not part of any frame, so the published twin does not have to move.
• Verbatim maintainer rulings that mention the model family as prose (SKILL.md:586, references/dispatch-runbook.md:17) are quotations, not values, are not matched by the acceptance pattern, and stay verbatim.

Gates — union derived by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at the merge-base (22 commands) plus the PM-named extras, run in order at head 2a8afbc0 under scripts/pm/os-verify-lock.sh (slot issue-14303), each exit code captured before any pipe

#	command	exit	the gate's own verdict line
01	node scripts/check-ci-filter-parity.mjs	0 (0s)	OK: all 130 declared cross-package glob(s) (92 unique) are covered by core or crosspkg, every crosspkg entry still covers one, and the test jo
02	node scripts/check-cross-package-test-inputs.mjs	0 (1s)	OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
03	node scripts/check-self-test-wired.mjs	0 (1s)	✓ check-self-test-wired: every one of the 164 script(s) CI runs that ship a --self-test has that self-test run by CI.
04	node scripts/check-shard-attestation.mjs	0 (0s)	✓ check-shard-attestation: 2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s).
05	node scripts/check-test-completeness.mjs	3 (0s)	NOT MEASURED — its own text: "Nothing was measured: this gate exited before parsing a single summary line"; prerequisite: a saved turbo run test log, which CI's own run supplies
06	pnpm --filter @objectstack/lint run check:doc-formula-expressions	3 (2s)	NOT MEASURED — its own Fix line: pnpm exec turbo run build --filter=@objectstack/formula; prerequisite: a built @objectstack/formula — CI builds the closure and supplies the reading (a local build attempt was cut by the container command cap and is not a reading)
07	pnpm check:agent-test-spelling	0 (2s)	✓ check-agent-test-spelling: 0 violations — 428 file(s) · 5633 bare -- token(s) · 1380 launcher-rooted run(s) · 9 separator(s) JUDGED · 5 vitest-bac
08	pnpm check:bash32-floor	0 (1s)	✓ check-bash32-floor: 26 tracked shell file(s) under scripts/, .claude/hooks/, .githooks/** name no bash 4+ construct outside a comment, a guarded
09	pnpm check:cli-command-ids	0 (7s)	✓ check-cli-command-ids: 315 command-id literal(s) across 112 file(s) outside packages/cli all resolve to a real command path (73 ids derived; 3 decla
10	pnpm check:cross-package-test-inputs	0 (2s)	OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
11	pnpm check:declared-population-live	0 (12s)	✓ check:declared-population-live — 158 of 202 famil(ies) declare a path population, and every one of them reaches this tree's 7986 tracked file(s).
12	pnpm check:doc-authoring	0 (6s)	✓ doc authoring guard: sibling-package prose ids hold the baseline — 831 pinned site(s) across 231 file(s), 82730 string(s) read in 1124 parsed source
13	pnpm check:entry-guard	0 (18s)	✓ check:entry-guard: 199 scripts/ file(s) — every entry guard goes through invoked-as.mjs; 150 export bindings, 148 of them inert on import (2 known-u
14	pnpm check:parse-guard	0 (2s)	✓ check:parse-guard: 198 scripts/ file(s) — every TypeScript parse goes through ts-parse.mjs.
15	pnpm check:pm-governed-merges	0 (3s)	✓ check-governed-merges --self-test: 243 assertions (the unified governed predicate + near misses, subject→PR spellings, window parsing, the #12633 la
16	pnpm check:pm-governed-prose	0 (1s)	✓ check-governed-prose: 2 instruction surface(s) name all 5 registered governed surfaces (docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md
17	pnpm check:pm-skill-id-lint	0 (1s)	✓ check-skill-id-lint: 23 file(s) clean (pattern /#[0-9]{3,}/g).
18	pnpm check:pm-skill-ratchet	0 (1s)	✓ check-skill-line-ratchet: CLAUDE.md is 86 lines (ceiling 86; headroom 0).
19	pnpm check:pnpm-filter-targets	0 (2s)	✓ check:pnpm-filter-targets: 142/181 --filter occurrence(s) across 32 file(s) resolve against 79 workspace package(s); 39 not judged (2 foreign, 17
20	pnpm check:skill-frame-sync	0 (1s)	✓ check-skill-frame-sync: 4 copies of the decision frame are structurally isomorphic across 3 files
21	pnpm check:watch-hint-literal	0 (3s)	✓ check-watch-hint-literal: 45 declaration(s) across 4 rostered name(s) -- ROOT_DIR_WATCH_HINTS 29, ROOT_FILE_WATCH_HINTS 9, ROOT_WATCH_HINTS 2, DECLA
22	pnpm check:skill-frame-freshness	0 (3s)	✓ check-skill-frame-freshness: the decision frame in this tree is current with origin/main (fetched just now).
23	pnpm check:nul-bytes	0 (2s)	check-nul-bytes: OK (scanned 7979 text file(s) -- 7979 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
24	node scripts/pm/check-governed-queue-guard.mjs --self-test	0 (0s)	✓ check-governed-queue-guard self-test: 129 cases pass (register-driven verdicts, the queue/PR event split, latest-decisive approval reduction, the 20
25	pnpm check:pm-dispatch-gates	0 (309s)	✓ dispatch-gates self-test: 1240 cases pass.

Lock wrapper's own VERDICT: command-exit 0 · held the lock 380s (6m20s) · waited 0s. check:pm-dispatch-gates streamed 1241 ✓ / 0 ✗ case lines. The line-ratchet gate was also run standalone right after the edit (self-test 111 cases pass; SKILL.md 989 lines, widest row 642).

NOT MEASURED

• node scripts/check-test-completeness.mjs — exit 3. Prerequisite: a saved turbo run test log; CI's run supplies it. Not a red, nothing to fix locally.
• pnpm --filter @objectstack/lint run check:doc-formula-expressions — exit 3. Prerequisite: a built @objectstack/formula (pnpm exec turbo run build --filter=@objectstack/formula); CI builds the closure and supplies the reading. Neither gate reads the two files this PR touches.

Session (durable attribution): https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[os-litant]

Fixes#14303

Governed surface (scripts/pm/**, .claude/**) — draft-only, human merge; needs:contract-review rides on the PR. Releases nothing: the diff is scripts/pm/** + .claude/skills/**, both inside scripts/check-empty-changeset.mjs's own release-nothing enumeration (.claude/, skills/, a CI-internal script) — hence skip-changeset.

What changed

Exactly the limb triage queued (issue comment 5503739916): the constant is bumped to the served tier, and every other site under .claude/skills/pm-dispatch/** and scripts/pm/** NAMES CONTRACT_REVIEW_TIER instead of spelling the model. The comparison stays exact — no family/prefix floor anywhere (that widening is the human floor's and is explicitly out of scope). SKILL.md:773's promise 「模型升级只改一行一个文件」 is now true: the model id is spelled as a value on one line of one file.

The diff carries the values; by design this body spells no model identifier. The served-tier get_session readings and the --tier output are on the card, in the flight's report comment.

Acceptance test — hit counts, not strings

git grep -n for the model-family pattern of the triage acceptance test over .claude/skills/pm-dispatch scripts/pm .claude/agents skills/objectstack-pm-dispatch:

tree	BEFORE (base a5b95ee6)	AFTER (head 2a8afbc0)
.claude/skills/pm-dispatch/SKILL.md	3 (:361:591:599)	0
scripts/pm/dispatch-gates.mjs	13	1 — the constant's definition line
.claude/agents/**	0	0
skills/objectstack-pm-dispatch/** (published twin)	0	0
total	16	1

Whole-repo git grep -c for the same pattern at head: one file, one hit (the same line).

Per-site: site | before | after (line numbers from base a5b95ee6; LITERAL stands for the spelled model id)

site	before	after
scripts/pm/dispatch-gates.mjs:8091 (now :7955)	export const CONTRACT_REVIEW_TIER = LITERAL;, declared AFTER the mandate table	value bumped to the served tier; definition and docblock hoisted above MANDATORY_TIER_GLOBS — the rows must read an initialised binding, and a const referenced before its declaration throws at import (import probe after the edit: constant and all three rows resolve to the same value). Docblock now states: one value site, exact comparison, no family/prefix floor
:8064:8069:8074 (mandate rows)	tier: LITERAL, three times	tier: CONTRACT_REVIEW_TIER — one definition, zero literals
:7970:7980 (header comment, clause ① and clause ②)	spells LITERAL	names CONTRACT_REVIEW_TIER
:15301:15302:15303:15306:15378 (self-test)	.tier === LITERAL	.tier === CONTRACT_REVIEW_TIER
:15319 (self-test)	mandLines.includes(LITERAL)	mandLines.includes(CONTRACT_REVIEW_TIER)
:15340 (self-test fixture, ambiguity refusal)	tier: LITERAL beside a tier: 'opus' row	tier: CONTRACT_REVIEW_TIER beside the same 'opus' row
:15408 (non-empty model id)	—	untouched
.claude/skills/pm-dispatch/SKILL.md:361 (+ :360)	:361 opened with LITERAL (the urgent-card triage subagent)	:360 ends 立即起 \CONTRACT_REVIEW_TIER` 档, :361opens分诊子代理,… — one sentence rebalanced across its own two lines (:361` was 119 bytes against the 120-byte cap; no words dropped)
SKILL.md:591 (+ :590)	clause ① model: "LITERAL"	一律 \CONTRACT_REVIEW_TIER` 档(`--tier` 输出) — names the constant AND the command whose output the seat types (node scripts/pm/dispatch-gates.mjs --tier, spelled in full in the claim-comment template at :546); ① 凡改moved to the tail of:590` for the byte cap, same paragraph
SKILL.md:599	clause ② 一律 LITERAL	一律 \CONTRACT_REVIEW_TIER` 档, the form references/lanes/director.md:13` already uses

Line-neutral under the ratchet: SKILL.md is 989 lines before and after (ceiling 1005, headroom 16), widest table row 642 bytes (pin 642, unchanged), max-line-bytes scan 0 offenders; touched lines measure 118 / 101 / 110 / 115 / 85 bytes (:360:361:590:591:599). scripts/pm/check-skill-line-ratchet.mjs untouched.

Self-test assertions rewritten, and what each still proves

• :15301:15302:15303 — each protocol-semantic file derives a mandate whose tier equals the single-source constant: still an exact string equality, still fails on a missing row or a row spelling any other value.
• :15306 — a mixed surface is mandatory and its tier equals the constant.
• :15319 — the mandatory rendering contains the constant's VALUE (the claim comment quotes those lines).
• :15340 — the ambiguity fixture still mandates two DIFFERENT tiers (the constant vs 'opus'), so the refusal it pins is unchanged.
• :15378 — every frame-sync-enforced copy derives a tier equal to the constant.
• :15408 — unchanged (non-empty model id).

Nothing weakened: every comparison remains an exact equality against one concrete string; only the string's source moved from a second literal to the constant.

premise_false (skipped, listed, never forced)

• references/contract-review.md:51, references/platform-readings.md — name the constant, no literal at this base; untouched (comparison text stays "against the constant"; "floor" never written).
• scripts/pm/ensure-pm-labels.sh:264, scripts/pm/check-governed-queue-guard.mjs:267 — comments naming the constant/pattern, no value; untouched.
• .claude/agents/os-dev.md — zero hits at this base; untouched.
• skills/objectstack-pm-dispatch/** — zero hits at this base; follow-up for objectstack-pm-dispatch: none.
• Frames: the check:skill-frame-sync COPIES anchors in SKILL.md sit at :880–:897; all three edited sites are outside every frame and the other three copies carry no model id — the model name is not part of any frame, so the published twin does not have to move.
• Verbatim maintainer rulings that mention the model family as prose (SKILL.md:586, references/dispatch-runbook.md:17) are quotations, not values, are not matched by the acceptance pattern, and stay verbatim.

Gates — union derived by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at the merge-base (22 commands) plus the PM-named extras, run in order at head 2a8afbc0 under scripts/pm/os-verify-lock.sh (slot issue-14303), each exit code captured before any pipe

#	command	exit	the gate's own verdict line
01	node scripts/check-ci-filter-parity.mjs	0 (0s)	OK: all 130 declared cross-package glob(s) (92 unique) are covered by core or crosspkg, every crosspkg entry still covers one, and the test jo
02	node scripts/check-cross-package-test-inputs.mjs	0 (1s)	OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
03	node scripts/check-self-test-wired.mjs	0 (1s)	✓ check-self-test-wired: every one of the 164 script(s) CI runs that ship a --self-test has that self-test run by CI.
04	node scripts/check-shard-attestation.mjs	0 (0s)	✓ check-shard-attestation: 2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s).
05	node scripts/check-test-completeness.mjs	3 (0s)	NOT MEASURED — its own text: "Nothing was measured: this gate exited before parsing a single summary line"; prerequisite: a saved turbo run test log, which CI's own run supplies
06	pnpm --filter @objectstack/lint run check:doc-formula-expressions	3 (2s)	NOT MEASURED — its own Fix line: pnpm exec turbo run build --filter=@objectstack/formula; prerequisite: a built @objectstack/formula — CI builds the closure and supplies the reading (a local build attempt was cut by the container command cap and is not a reading)
07	pnpm check:agent-test-spelling	0 (2s)	✓ check-agent-test-spelling: 0 violations — 428 file(s) · 5633 bare -- token(s) · 1380 launcher-rooted run(s) · 9 separator(s) JUDGED · 5 vitest-bac
08	pnpm check:bash32-floor	0 (1s)	✓ check-bash32-floor: 26 tracked shell file(s) under scripts/, .claude/hooks/, .githooks/** name no bash 4+ construct outside a comment, a guarded
09	pnpm check:cli-command-ids	0 (7s)	✓ check-cli-command-ids: 315 command-id literal(s) across 112 file(s) outside packages/cli all resolve to a real command path (73 ids derived; 3 decla
10	pnpm check:cross-package-test-inputs	0 (2s)	OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
11	pnpm check:declared-population-live	0 (12s)	✓ check:declared-population-live — 158 of 202 famil(ies) declare a path population, and every one of them reaches this tree's 7986 tracked file(s).
12	pnpm check:doc-authoring	0 (6s)	✓ doc authoring guard: sibling-package prose ids hold the baseline — 831 pinned site(s) across 231 file(s), 82730 string(s) read in 1124 parsed source
13	pnpm check:entry-guard	0 (18s)	✓ check:entry-guard: 199 scripts/ file(s) — every entry guard goes through invoked-as.mjs; 150 export bindings, 148 of them inert on import (2 known-u
14	pnpm check:parse-guard	0 (2s)	✓ check:parse-guard: 198 scripts/ file(s) — every TypeScript parse goes through ts-parse.mjs.
15	pnpm check:pm-governed-merges	0 (3s)	✓ check-governed-merges --self-test: 243 assertions (the unified governed predicate + near misses, subject→PR spellings, window parsing, the #12633 la
16	pnpm check:pm-governed-prose	0 (1s)	✓ check-governed-prose: 2 instruction surface(s) name all 5 registered governed surfaces (docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md
17	pnpm check:pm-skill-id-lint	0 (1s)	✓ check-skill-id-lint: 23 file(s) clean (pattern /#[0-9]{3,}/g).
18	pnpm check:pm-skill-ratchet	0 (1s)	✓ check-skill-line-ratchet: CLAUDE.md is 86 lines (ceiling 86; headroom 0).
19	pnpm check:pnpm-filter-targets	0 (2s)	✓ check:pnpm-filter-targets: 142/181 --filter occurrence(s) across 32 file(s) resolve against 79 workspace package(s); 39 not judged (2 foreign, 17
20	pnpm check:skill-frame-sync	0 (1s)	✓ check-skill-frame-sync: 4 copies of the decision frame are structurally isomorphic across 3 files
21	pnpm check:watch-hint-literal	0 (3s)	✓ check-watch-hint-literal: 45 declaration(s) across 4 rostered name(s) -- ROOT_DIR_WATCH_HINTS 29, ROOT_FILE_WATCH_HINTS 9, ROOT_WATCH_HINTS 2, DECLA
22	pnpm check:skill-frame-freshness	0 (3s)	✓ check-skill-frame-freshness: the decision frame in this tree is current with origin/main (fetched just now).
23	pnpm check:nul-bytes	0 (2s)	check-nul-bytes: OK (scanned 7979 text file(s) -- 7979 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
24	node scripts/pm/check-governed-queue-guard.mjs --self-test	0 (0s)	✓ check-governed-queue-guard self-test: 129 cases pass (register-driven verdicts, the queue/PR event split, latest-decisive approval reduction, the 20
25	pnpm check:pm-dispatch-gates	0 (309s)	✓ dispatch-gates self-test: 1240 cases pass.

Lock wrapper's own VERDICT: command-exit 0 · held the lock 380s (6m20s) · waited 0s. check:pm-dispatch-gates streamed 1241 ✓ / 0 ✗ case lines. The line-ratchet gate was also run standalone right after the edit (self-test 111 cases pass; SKILL.md 989 lines, widest row 642).

NOT MEASURED

• node scripts/check-test-completeness.mjs — exit 3. Prerequisite: a saved turbo run test log; CI's run supplies it. Not a red, nothing to fix locally.
• pnpm --filter @objectstack/lint run check:doc-formula-expressions — exit 3. Prerequisite: a built @objectstack/formula (pnpm exec turbo run build --filter=@objectstack/formula); CI builds the closure and supplies the reading. Neither gate reads the two files this PR touches.

Session (durable attribution): https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[os-litant]

Fixes#14303

Governed surface (scripts/pm/**, .claude/**) — draft-only, human merge; needs:contract-review rides on the PR. Releases nothing: the diff is scripts/pm/** + .claude/skills/**, both inside scripts/check-empty-changeset.mjs's own release-nothing enumeration (.claude/, skills/, a CI-internal script) — hence skip-changeset.

What changed

Exactly the limb triage queued (issue comment 5503739916): the constant is bumped to the served tier, and every other site under .claude/skills/pm-dispatch/** and scripts/pm/** NAMES CONTRACT_REVIEW_TIER instead of spelling the model. The comparison stays exact — no family/prefix floor anywhere (that widening is the human floor's and is explicitly out of scope). SKILL.md:773's promise 「模型升级只改一行一个文件」 is now true: the model id is spelled as a value on one line of one file.

The diff carries the values; by design this body spells no model identifier. The served-tier get_session readings and the --tier output are on the card, in the flight's report comment.

Acceptance test — hit counts, not strings

git grep -n for the model-family pattern of the triage acceptance test over .claude/skills/pm-dispatch scripts/pm .claude/agents skills/objectstack-pm-dispatch:

tree	BEFORE (base a5b95ee6)	AFTER (head 2a8afbc0)
.claude/skills/pm-dispatch/SKILL.md	3 (:361:591:599)	0
scripts/pm/dispatch-gates.mjs	13	1 — the constant's definition line
.claude/agents/**	0	0
skills/objectstack-pm-dispatch/** (published twin)	0	0
total	16	1

Whole-repo git grep -c for the same pattern at head: one file, one hit (the same line).

Per-site: site | before | after (line numbers from base a5b95ee6; LITERAL stands for the spelled model id)

site	before	after
scripts/pm/dispatch-gates.mjs:8091 (now :7955)	export const CONTRACT_REVIEW_TIER = LITERAL;, declared AFTER the mandate table	value bumped to the served tier; definition and docblock hoisted above MANDATORY_TIER_GLOBS — the rows must read an initialised binding, and a const referenced before its declaration throws at import (import probe after the edit: constant and all three rows resolve to the same value). Docblock now states: one value site, exact comparison, no family/prefix floor
:8064:8069:8074 (mandate rows)	tier: LITERAL, three times	tier: CONTRACT_REVIEW_TIER — one definition, zero literals
:7970:7980 (header comment, clause ① and clause ②)	spells LITERAL	names CONTRACT_REVIEW_TIER
:15301:15302:15303:15306:15378 (self-test)	.tier === LITERAL	.tier === CONTRACT_REVIEW_TIER
:15319 (self-test)	mandLines.includes(LITERAL)	mandLines.includes(CONTRACT_REVIEW_TIER)
:15340 (self-test fixture, ambiguity refusal)	tier: LITERAL beside a tier: 'opus' row	tier: CONTRACT_REVIEW_TIER beside the same 'opus' row
:15408 (non-empty model id)	—	untouched
.claude/skills/pm-dispatch/SKILL.md:361 (+ :360)	:361 opened with LITERAL (the urgent-card triage subagent)	:360 ends 立即起 \CONTRACT_REVIEW_TIER` 档, :361opens分诊子代理,… — one sentence rebalanced across its own two lines (:361` was 119 bytes against the 120-byte cap; no words dropped)
SKILL.md:591 (+ :590)	clause ① model: "LITERAL"	一律 \CONTRACT_REVIEW_TIER` 档(`--tier` 输出) — names the constant AND the command whose output the seat types (node scripts/pm/dispatch-gates.mjs --tier, spelled in full in the claim-comment template at :546); ① 凡改moved to the tail of:590` for the byte cap, same paragraph
SKILL.md:599	clause ② 一律 LITERAL	一律 \CONTRACT_REVIEW_TIER` 档, the form references/lanes/director.md:13` already uses

Line-neutral under the ratchet: SKILL.md is 989 lines before and after (ceiling 1005, headroom 16), widest table row 642 bytes (pin 642, unchanged), max-line-bytes scan 0 offenders; touched lines measure 118 / 101 / 110 / 115 / 85 bytes (:360:361:590:591:599). scripts/pm/check-skill-line-ratchet.mjs untouched.

Self-test assertions rewritten, and what each still proves

• :15301:15302:15303 — each protocol-semantic file derives a mandate whose tier equals the single-source constant: still an exact string equality, still fails on a missing row or a row spelling any other value.
• :15306 — a mixed surface is mandatory and its tier equals the constant.
• :15319 — the mandatory rendering contains the constant's VALUE (the claim comment quotes those lines).
• :15340 — the ambiguity fixture still mandates two DIFFERENT tiers (the constant vs 'opus'), so the refusal it pins is unchanged.
• :15378 — every frame-sync-enforced copy derives a tier equal to the constant.
• :15408 — unchanged (non-empty model id).

Nothing weakened: every comparison remains an exact equality against one concrete string; only the string's source moved from a second literal to the constant.

premise_false (skipped, listed, never forced)

• references/contract-review.md:51, references/platform-readings.md — name the constant, no literal at this base; untouched (comparison text stays "against the constant"; "floor" never written).
• scripts/pm/ensure-pm-labels.sh:264, scripts/pm/check-governed-queue-guard.mjs:267 — comments naming the constant/pattern, no value; untouched.
• .claude/agents/os-dev.md — zero hits at this base; untouched.
• skills/objectstack-pm-dispatch/** — zero hits at this base; follow-up for objectstack-pm-dispatch: none.
• Frames: the check:skill-frame-sync COPIES anchors in SKILL.md sit at :880–:897; all three edited sites are outside every frame and the other three copies carry no model id — the model name is not part of any frame, so the published twin does not have to move.
• Verbatim maintainer rulings that mention the model family as prose (SKILL.md:586, references/dispatch-runbook.md:17) are quotations, not values, are not matched by the acceptance pattern, and stay verbatim.

Gates — union derived by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at the merge-base (22 commands) plus the PM-named extras, run in order at head 2a8afbc0 under scripts/pm/os-verify-lock.sh (slot issue-14303), each exit code captured before any pipe

#	command	exit	the gate's own verdict line
01	node scripts/check-ci-filter-parity.mjs	0 (0s)	OK: all 130 declared cross-package glob(s) (92 unique) are covered by core or crosspkg, every crosspkg entry still covers one, and the test jo
02	node scripts/check-cross-package-test-inputs.mjs	0 (1s)	OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
03	node scripts/check-self-test-wired.mjs	0 (1s)	✓ check-self-test-wired: every one of the 164 script(s) CI runs that ship a --self-test has that self-test run by CI.
04	node scripts/check-shard-attestation.mjs	0 (0s)	✓ check-shard-attestation: 2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s).
05	node scripts/check-test-completeness.mjs	3 (0s)	NOT MEASURED — its own text: "Nothing was measured: this gate exited before parsing a single summary line"; prerequisite: a saved turbo run test log, which CI's own run supplies
06	pnpm --filter @objectstack/lint run check:doc-formula-expressions	3 (2s)	NOT MEASURED — its own Fix line: pnpm exec turbo run build --filter=@objectstack/formula; prerequisite: a built @objectstack/formula — CI builds the closure and supplies the reading (a local build attempt was cut by the container command cap and is not a reading)
07	pnpm check:agent-test-spelling	0 (2s)	✓ check-agent-test-spelling: 0 violations — 428 file(s) · 5633 bare -- token(s) · 1380 launcher-rooted run(s) · 9 separator(s) JUDGED · 5 vitest-bac
08	pnpm check:bash32-floor	0 (1s)	✓ check-bash32-floor: 26 tracked shell file(s) under scripts/, .claude/hooks/, .githooks/** name no bash 4+ construct outside a comment, a guarded
09	pnpm check:cli-command-ids	0 (7s)	✓ check-cli-command-ids: 315 command-id literal(s) across 112 file(s) outside packages/cli all resolve to a real command path (73 ids derived; 3 decla
10	pnpm check:cross-package-test-inputs	0 (2s)	OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
11	pnpm check:declared-population-live	0 (12s)	✓ check:declared-population-live — 158 of 202 famil(ies) declare a path population, and every one of them reaches this tree's 7986 tracked file(s).
12	pnpm check:doc-authoring	0 (6s)	✓ doc authoring guard: sibling-package prose ids hold the baseline — 831 pinned site(s) across 231 file(s), 82730 string(s) read in 1124 parsed source
13	pnpm check:entry-guard	0 (18s)	✓ check:entry-guard: 199 scripts/ file(s) — every entry guard goes through invoked-as.mjs; 150 export bindings, 148 of them inert on import (2 known-u
14	pnpm check:parse-guard	0 (2s)	✓ check:parse-guard: 198 scripts/ file(s) — every TypeScript parse goes through ts-parse.mjs.
15	pnpm check:pm-governed-merges	0 (3s)	✓ check-governed-merges --self-test: 243 assertions (the unified governed predicate + near misses, subject→PR spellings, window parsing, the #12633 la
16	pnpm check:pm-governed-prose	0 (1s)	✓ check-governed-prose: 2 instruction surface(s) name all 5 registered governed surfaces (docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md
17	pnpm check:pm-skill-id-lint	0 (1s)	✓ check-skill-id-lint: 23 file(s) clean (pattern /#[0-9]{3,}/g).
18	pnpm check:pm-skill-ratchet	0 (1s)	✓ check-skill-line-ratchet: CLAUDE.md is 86 lines (ceiling 86; headroom 0).
19	pnpm check:pnpm-filter-targets	0 (2s)	✓ check:pnpm-filter-targets: 142/181 --filter occurrence(s) across 32 file(s) resolve against 79 workspace package(s); 39 not judged (2 foreign, 17
20	pnpm check:skill-frame-sync	0 (1s)	✓ check-skill-frame-sync: 4 copies of the decision frame are structurally isomorphic across 3 files
21	pnpm check:watch-hint-literal	0 (3s)	✓ check-watch-hint-literal: 45 declaration(s) across 4 rostered name(s) -- ROOT_DIR_WATCH_HINTS 29, ROOT_FILE_WATCH_HINTS 9, ROOT_WATCH_HINTS 2, DECLA
22	pnpm check:skill-frame-freshness	0 (3s)	✓ check-skill-frame-freshness: the decision frame in this tree is current with origin/main (fetched just now).
23	pnpm check:nul-bytes	0 (2s)	check-nul-bytes: OK (scanned 7979 text file(s) -- 7979 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
24	node scripts/pm/check-governed-queue-guard.mjs --self-test	0 (0s)	✓ check-governed-queue-guard self-test: 129 cases pass (register-driven verdicts, the queue/PR event split, latest-decisive approval reduction, the 20
25	pnpm check:pm-dispatch-gates	0 (309s)	✓ dispatch-gates self-test: 1240 cases pass.

Lock wrapper's own VERDICT: command-exit 0 · held the lock 380s (6m20s) · waited 0s. check:pm-dispatch-gates streamed 1241 ✓ / 0 ✗ case lines. The line-ratchet gate was also run standalone right after the edit (self-test 111 cases pass; SKILL.md 989 lines, widest row 642).

NOT MEASURED

• node scripts/check-test-completeness.mjs — exit 3. Prerequisite: a saved turbo run test log; CI's run supplies it. Not a red, nothing to fix locally.
• pnpm --filter @objectstack/lint run check:doc-formula-expressions — exit 3. Prerequisite: a built @objectstack/formula (pnpm exec turbo run build --filter=@objectstack/formula); CI builds the closure and supplies the reading. Neither gate reads the two files this PR touches.

Session (durable attribution): https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[os-litant]

Fixes#14303

Governed surface (scripts/pm/**, .claude/**) — draft-only, human merge; needs:contract-review rides on the PR. Releases nothing: the diff is scripts/pm/** + .claude/skills/**, both inside scripts/check-empty-changeset.mjs's own release-nothing enumeration (.claude/, skills/, a CI-internal script) — hence skip-changeset.

What changed

Exactly the limb triage queued (issue comment 5503739916): the constant is bumped to the served tier, and every other site under .claude/skills/pm-dispatch/** and scripts/pm/** NAMES CONTRACT_REVIEW_TIER instead of spelling the model. The comparison stays exact — no family/prefix floor anywhere (that widening is the human floor's and is explicitly out of scope). SKILL.md:773's promise 「模型升级只改一行一个文件」 is now true: the model id is spelled as a value on one line of one file.

The diff carries the values; by design this body spells no model identifier. The served-tier get_session readings and the --tier output are on the card, in the flight's report comment.

Acceptance test — hit counts, not strings

git grep -n for the model-family pattern of the triage acceptance test over .claude/skills/pm-dispatch scripts/pm .claude/agents skills/objectstack-pm-dispatch:

tree	BEFORE (base a5b95ee6)	AFTER (head 2a8afbc0)
.claude/skills/pm-dispatch/SKILL.md	3 (:361:591:599)	0
scripts/pm/dispatch-gates.mjs	13	1 — the constant's definition line
.claude/agents/**	0	0
skills/objectstack-pm-dispatch/** (published twin)	0	0
total	16	1

Whole-repo git grep -c for the same pattern at head: one file, one hit (the same line).

Per-site: site | before | after (line numbers from base a5b95ee6; LITERAL stands for the spelled model id)

site	before	after
scripts/pm/dispatch-gates.mjs:8091 (now :7955)	export const CONTRACT_REVIEW_TIER = LITERAL;, declared AFTER the mandate table	value bumped to the served tier; definition and docblock hoisted above MANDATORY_TIER_GLOBS — the rows must read an initialised binding, and a const referenced before its declaration throws at import (import probe after the edit: constant and all three rows resolve to the same value). Docblock now states: one value site, exact comparison, no family/prefix floor
:8064:8069:8074 (mandate rows)	tier: LITERAL, three times	tier: CONTRACT_REVIEW_TIER — one definition, zero literals
:7970:7980 (header comment, clause ① and clause ②)	spells LITERAL	names CONTRACT_REVIEW_TIER
:15301:15302:15303:15306:15378 (self-test)	.tier === LITERAL	.tier === CONTRACT_REVIEW_TIER
:15319 (self-test)	mandLines.includes(LITERAL)	mandLines.includes(CONTRACT_REVIEW_TIER)
:15340 (self-test fixture, ambiguity refusal)	tier: LITERAL beside a tier: 'opus' row	tier: CONTRACT_REVIEW_TIER beside the same 'opus' row
:15408 (non-empty model id)	—	untouched
.claude/skills/pm-dispatch/SKILL.md:361 (+ :360)	:361 opened with LITERAL (the urgent-card triage subagent)	:360 ends 立即起 \CONTRACT_REVIEW_TIER` 档, :361opens分诊子代理,… — one sentence rebalanced across its own two lines (:361` was 119 bytes against the 120-byte cap; no words dropped)
SKILL.md:591 (+ :590)	clause ① model: "LITERAL"	一律 \CONTRACT_REVIEW_TIER` 档(`--tier` 输出) — names the constant AND the command whose output the seat types (node scripts/pm/dispatch-gates.mjs --tier, spelled in full in the claim-comment template at :546); ① 凡改moved to the tail of:590` for the byte cap, same paragraph
SKILL.md:599	clause ② 一律 LITERAL	一律 \CONTRACT_REVIEW_TIER` 档, the form references/lanes/director.md:13` already uses

Line-neutral under the ratchet: SKILL.md is 989 lines before and after (ceiling 1005, headroom 16), widest table row 642 bytes (pin 642, unchanged), max-line-bytes scan 0 offenders; touched lines measure 118 / 101 / 110 / 115 / 85 bytes (:360:361:590:591:599). scripts/pm/check-skill-line-ratchet.mjs untouched.

Self-test assertions rewritten, and what each still proves

• :15301:15302:15303 — each protocol-semantic file derives a mandate whose tier equals the single-source constant: still an exact string equality, still fails on a missing row or a row spelling any other value.
• :15306 — a mixed surface is mandatory and its tier equals the constant.
• :15319 — the mandatory rendering contains the constant's VALUE (the claim comment quotes those lines).
• :15340 — the ambiguity fixture still mandates two DIFFERENT tiers (the constant vs 'opus'), so the refusal it pins is unchanged.
• :15378 — every frame-sync-enforced copy derives a tier equal to the constant.
• :15408 — unchanged (non-empty model id).

Nothing weakened: every comparison remains an exact equality against one concrete string; only the string's source moved from a second literal to the constant.

premise_false (skipped, listed, never forced)

• references/contract-review.md:51, references/platform-readings.md — name the constant, no literal at this base; untouched (comparison text stays "against the constant"; "floor" never written).
• scripts/pm/ensure-pm-labels.sh:264, scripts/pm/check-governed-queue-guard.mjs:267 — comments naming the constant/pattern, no value; untouched.
• .claude/agents/os-dev.md — zero hits at this base; untouched.
• skills/objectstack-pm-dispatch/** — zero hits at this base; follow-up for objectstack-pm-dispatch: none.
• Frames: the check:skill-frame-sync COPIES anchors in SKILL.md sit at :880–:897; all three edited sites are outside every frame and the other three copies carry no model id — the model name is not part of any frame, so the published twin does not have to move.
• Verbatim maintainer rulings that mention the model family as prose (SKILL.md:586, references/dispatch-runbook.md:17) are quotations, not values, are not matched by the acceptance pattern, and stay verbatim.

Gates — union derived by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at the merge-base (22 commands) plus the PM-named extras, run in order at head 2a8afbc0 under scripts/pm/os-verify-lock.sh (slot issue-14303), each exit code captured before any pipe

#	command	exit	the gate's own verdict line
01	node scripts/check-ci-filter-parity.mjs	0 (0s)	OK: all 130 declared cross-package glob(s) (92 unique) are covered by core or crosspkg, every crosspkg entry still covers one, and the test jo
02	node scripts/check-cross-package-test-inputs.mjs	0 (1s)	OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
03	node scripts/check-self-test-wired.mjs	0 (1s)	✓ check-self-test-wired: every one of the 164 script(s) CI runs that ship a --self-test has that self-test run by CI.
04	node scripts/check-shard-attestation.mjs	0 (0s)	✓ check-shard-attestation: 2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s).
05	node scripts/check-test-completeness.mjs	3 (0s)	NOT MEASURED — its own text: "Nothing was measured: this gate exited before parsing a single summary line"; prerequisite: a saved turbo run test log, which CI's own run supplies
06	pnpm --filter @objectstack/lint run check:doc-formula-expressions	3 (2s)	NOT MEASURED — its own Fix line: pnpm exec turbo run build --filter=@objectstack/formula; prerequisite: a built @objectstack/formula — CI builds the closure and supplies the reading (a local build attempt was cut by the container command cap and is not a reading)
07	pnpm check:agent-test-spelling	0 (2s)	✓ check-agent-test-spelling: 0 violations — 428 file(s) · 5633 bare -- token(s) · 1380 launcher-rooted run(s) · 9 separator(s) JUDGED · 5 vitest-bac
08	pnpm check:bash32-floor	0 (1s)	✓ check-bash32-floor: 26 tracked shell file(s) under scripts/, .claude/hooks/, .githooks/** name no bash 4+ construct outside a comment, a guarded
09	pnpm check:cli-command-ids	0 (7s)	✓ check-cli-command-ids: 315 command-id literal(s) across 112 file(s) outside packages/cli all resolve to a real command path (73 ids derived; 3 decla
10	pnpm check:cross-package-test-inputs	0 (2s)	OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
11	pnpm check:declared-population-live	0 (12s)	✓ check:declared-population-live — 158 of 202 famil(ies) declare a path population, and every one of them reaches this tree's 7986 tracked file(s).
12	pnpm check:doc-authoring	0 (6s)	✓ doc authoring guard: sibling-package prose ids hold the baseline — 831 pinned site(s) across 231 file(s), 82730 string(s) read in 1124 parsed source
13	pnpm check:entry-guard	0 (18s)	✓ check:entry-guard: 199 scripts/ file(s) — every entry guard goes through invoked-as.mjs; 150 export bindings, 148 of them inert on import (2 known-u
14	pnpm check:parse-guard	0 (2s)	✓ check:parse-guard: 198 scripts/ file(s) — every TypeScript parse goes through ts-parse.mjs.
15	pnpm check:pm-governed-merges	0 (3s)	✓ check-governed-merges --self-test: 243 assertions (the unified governed predicate + near misses, subject→PR spellings, window parsing, the #12633 la
16	pnpm check:pm-governed-prose	0 (1s)	✓ check-governed-prose: 2 instruction surface(s) name all 5 registered governed surfaces (docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md
17	pnpm check:pm-skill-id-lint	0 (1s)	✓ check-skill-id-lint: 23 file(s) clean (pattern /#[0-9]{3,}/g).
18	pnpm check:pm-skill-ratchet	0 (1s)	✓ check-skill-line-ratchet: CLAUDE.md is 86 lines (ceiling 86; headroom 0).
19	pnpm check:pnpm-filter-targets	0 (2s)	✓ check:pnpm-filter-targets: 142/181 --filter occurrence(s) across 32 file(s) resolve against 79 workspace package(s); 39 not judged (2 foreign, 17
20	pnpm check:skill-frame-sync	0 (1s)	✓ check-skill-frame-sync: 4 copies of the decision frame are structurally isomorphic across 3 files
21	pnpm check:watch-hint-literal	0 (3s)	✓ check-watch-hint-literal: 45 declaration(s) across 4 rostered name(s) -- ROOT_DIR_WATCH_HINTS 29, ROOT_FILE_WATCH_HINTS 9, ROOT_WATCH_HINTS 2, DECLA
22	pnpm check:skill-frame-freshness	0 (3s)	✓ check-skill-frame-freshness: the decision frame in this tree is current with origin/main (fetched just now).
23	pnpm check:nul-bytes	0 (2s)	check-nul-bytes: OK (scanned 7979 text file(s) -- 7979 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
24	node scripts/pm/check-governed-queue-guard.mjs --self-test	0 (0s)	✓ check-governed-queue-guard self-test: 129 cases pass (register-driven verdicts, the queue/PR event split, latest-decisive approval reduction, the 20
25	pnpm check:pm-dispatch-gates	0 (309s)	✓ dispatch-gates self-test: 1240 cases pass.

Lock wrapper's own VERDICT: command-exit 0 · held the lock 380s (6m20s) · waited 0s. check:pm-dispatch-gates streamed 1241 ✓ / 0 ✗ case lines. The line-ratchet gate was also run standalone right after the edit (self-test 111 cases pass; SKILL.md 989 lines, widest row 642).

NOT MEASURED

• node scripts/check-test-completeness.mjs — exit 3. Prerequisite: a saved turbo run test log; CI's run supplies it. Not a red, nothing to fix locally.
• pnpm --filter @objectstack/lint run check:doc-formula-expressions — exit 3. Prerequisite: a built @objectstack/formula (pnpm exec turbo run build --filter=@objectstack/formula); CI builds the closure and supplies the reading. Neither gate reads the two files this PR touches.

Session (durable attribution): https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[os-litant]

Fixes#14303

Governed surface (scripts/pm/**, .claude/**) — draft-only, human merge; needs:contract-review rides on the PR. Releases nothing: the diff is scripts/pm/** + .claude/skills/**, both inside scripts/check-empty-changeset.mjs's own release-nothing enumeration (.claude/, skills/, a CI-internal script) — hence skip-changeset.

What changed

Exactly the limb triage queued (issue comment 5503739916): the constant is bumped to the served tier, and every other site under .claude/skills/pm-dispatch/** and scripts/pm/** NAMES CONTRACT_REVIEW_TIER instead of spelling the model. The comparison stays exact — no family/prefix floor anywhere (that widening is the human floor's and is explicitly out of scope). SKILL.md:773's promise 「模型升级只改一行一个文件」 is now true: the model id is spelled as a value on one line of one file.

The diff carries the values; by design this body spells no model identifier. The served-tier get_session readings and the --tier output are on the card, in the flight's report comment.

Acceptance test — hit counts, not strings

git grep -n for the model-family pattern of the triage acceptance test over .claude/skills/pm-dispatch scripts/pm .claude/agents skills/objectstack-pm-dispatch:

tree	BEFORE (base a5b95ee6)	AFTER (head 2a8afbc0)
.claude/skills/pm-dispatch/SKILL.md	3 (:361:591:599)	0
scripts/pm/dispatch-gates.mjs	13	1 — the constant's definition line
.claude/agents/**	0	0
skills/objectstack-pm-dispatch/** (published twin)	0	0
total	16	1

Whole-repo git grep -c for the same pattern at head: one file, one hit (the same line).

Per-site: site | before | after (line numbers from base a5b95ee6; LITERAL stands for the spelled model id)

site	before	after
scripts/pm/dispatch-gates.mjs:8091 (now :7955)	export const CONTRACT_REVIEW_TIER = LITERAL;, declared AFTER the mandate table	value bumped to the served tier; definition and docblock hoisted above MANDATORY_TIER_GLOBS — the rows must read an initialised binding, and a const referenced before its declaration throws at import (import probe after the edit: constant and all three rows resolve to the same value). Docblock now states: one value site, exact comparison, no family/prefix floor
:8064:8069:8074 (mandate rows)	tier: LITERAL, three times	tier: CONTRACT_REVIEW_TIER — one definition, zero literals
:7970:7980 (header comment, clause ① and clause ②)	spells LITERAL	names CONTRACT_REVIEW_TIER
:15301:15302:15303:15306:15378 (self-test)	.tier === LITERAL	.tier === CONTRACT_REVIEW_TIER
:15319 (self-test)	mandLines.includes(LITERAL)	mandLines.includes(CONTRACT_REVIEW_TIER)
:15340 (self-test fixture, ambiguity refusal)	tier: LITERAL beside a tier: 'opus' row	tier: CONTRACT_REVIEW_TIER beside the same 'opus' row
:15408 (non-empty model id)	—	untouched
.claude/skills/pm-dispatch/SKILL.md:361 (+ :360)	:361 opened with LITERAL (the urgent-card triage subagent)	:360 ends 立即起 \CONTRACT_REVIEW_TIER` 档, :361opens分诊子代理,… — one sentence rebalanced across its own two lines (:361` was 119 bytes against the 120-byte cap; no words dropped)
SKILL.md:591 (+ :590)	clause ① model: "LITERAL"	一律 \CONTRACT_REVIEW_TIER` 档(`--tier` 输出) — names the constant AND the command whose output the seat types (node scripts/pm/dispatch-gates.mjs --tier, spelled in full in the claim-comment template at :546); ① 凡改moved to the tail of:590` for the byte cap, same paragraph
SKILL.md:599	clause ② 一律 LITERAL	一律 \CONTRACT_REVIEW_TIER` 档, the form references/lanes/director.md:13` already uses

Line-neutral under the ratchet: SKILL.md is 989 lines before and after (ceiling 1005, headroom 16), widest table row 642 bytes (pin 642, unchanged), max-line-bytes scan 0 offenders; touched lines measure 118 / 101 / 110 / 115 / 85 bytes (:360:361:590:591:599). scripts/pm/check-skill-line-ratchet.mjs untouched.

Self-test assertions rewritten, and what each still proves

• :15301:15302:15303 — each protocol-semantic file derives a mandate whose tier equals the single-source constant: still an exact string equality, still fails on a missing row or a row spelling any other value.
• :15306 — a mixed surface is mandatory and its tier equals the constant.
• :15319 — the mandatory rendering contains the constant's VALUE (the claim comment quotes those lines).
• :15340 — the ambiguity fixture still mandates two DIFFERENT tiers (the constant vs 'opus'), so the refusal it pins is unchanged.
• :15378 — every frame-sync-enforced copy derives a tier equal to the constant.
• :15408 — unchanged (non-empty model id).

Nothing weakened: every comparison remains an exact equality against one concrete string; only the string's source moved from a second literal to the constant.

premise_false (skipped, listed, never forced)

• references/contract-review.md:51, references/platform-readings.md — name the constant, no literal at this base; untouched (comparison text stays "against the constant"; "floor" never written).
• scripts/pm/ensure-pm-labels.sh:264, scripts/pm/check-governed-queue-guard.mjs:267 — comments naming the constant/pattern, no value; untouched.
• .claude/agents/os-dev.md — zero hits at this base; untouched.
• skills/objectstack-pm-dispatch/** — zero hits at this base; follow-up for objectstack-pm-dispatch: none.
• Frames: the check:skill-frame-sync COPIES anchors in SKILL.md sit at :880–:897; all three edited sites are outside every frame and the other three copies carry no model id — the model name is not part of any frame, so the published twin does not have to move.
• Verbatim maintainer rulings that mention the model family as prose (SKILL.md:586, references/dispatch-runbook.md:17) are quotations, not values, are not matched by the acceptance pattern, and stay verbatim.

Gates — union derived by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at the merge-base (22 commands) plus the PM-named extras, run in order at head 2a8afbc0 under scripts/pm/os-verify-lock.sh (slot issue-14303), each exit code captured before any pipe

#	command	exit	the gate's own verdict line
01	node scripts/check-ci-filter-parity.mjs	0 (0s)	OK: all 130 declared cross-package glob(s) (92 unique) are covered by core or crosspkg, every crosspkg entry still covers one, and the test jo
02	node scripts/check-cross-package-test-inputs.mjs	0 (1s)	OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
03	node scripts/check-self-test-wired.mjs	0 (1s)	✓ check-self-test-wired: every one of the 164 script(s) CI runs that ship a --self-test has that self-test run by CI.
04	node scripts/check-shard-attestation.mjs	0 (0s)	✓ check-shard-attestation: 2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s).
05	node scripts/check-test-completeness.mjs	3 (0s)	NOT MEASURED — its own text: "Nothing was measured: this gate exited before parsing a single summary line"; prerequisite: a saved turbo run test log, which CI's own run supplies
06	pnpm --filter @objectstack/lint run check:doc-formula-expressions	3 (2s)	NOT MEASURED — its own Fix line: pnpm exec turbo run build --filter=@objectstack/formula; prerequisite: a built @objectstack/formula — CI builds the closure and supplies the reading (a local build attempt was cut by the container command cap and is not a reading)
07	pnpm check:agent-test-spelling	0 (2s)	✓ check-agent-test-spelling: 0 violations — 428 file(s) · 5633 bare -- token(s) · 1380 launcher-rooted run(s) · 9 separator(s) JUDGED · 5 vitest-bac
08	pnpm check:bash32-floor	0 (1s)	✓ check-bash32-floor: 26 tracked shell file(s) under scripts/, .claude/hooks/, .githooks/** name no bash 4+ construct outside a comment, a guarded
09	pnpm check:cli-command-ids	0 (7s)	✓ check-cli-command-ids: 315 command-id literal(s) across 112 file(s) outside packages/cli all resolve to a real command path (73 ids derived; 3 decla
10	pnpm check:cross-package-test-inputs	0 (2s)	OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
11	pnpm check:declared-population-live	0 (12s)	✓ check:declared-population-live — 158 of 202 famil(ies) declare a path population, and every one of them reaches this tree's 7986 tracked file(s).
12	pnpm check:doc-authoring	0 (6s)	✓ doc authoring guard: sibling-package prose ids hold the baseline — 831 pinned site(s) across 231 file(s), 82730 string(s) read in 1124 parsed source
13	pnpm check:entry-guard	0 (18s)	✓ check:entry-guard: 199 scripts/ file(s) — every entry guard goes through invoked-as.mjs; 150 export bindings, 148 of them inert on import (2 known-u
14	pnpm check:parse-guard	0 (2s)	✓ check:parse-guard: 198 scripts/ file(s) — every TypeScript parse goes through ts-parse.mjs.
15	pnpm check:pm-governed-merges	0 (3s)	✓ check-governed-merges --self-test: 243 assertions (the unified governed predicate + near misses, subject→PR spellings, window parsing, the #12633 la
16	pnpm check:pm-governed-prose	0 (1s)	✓ check-governed-prose: 2 instruction surface(s) name all 5 registered governed surfaces (docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md
17	pnpm check:pm-skill-id-lint	0 (1s)	✓ check-skill-id-lint: 23 file(s) clean (pattern /#[0-9]{3,}/g).
18	pnpm check:pm-skill-ratchet	0 (1s)	✓ check-skill-line-ratchet: CLAUDE.md is 86 lines (ceiling 86; headroom 0).
19	pnpm check:pnpm-filter-targets	0 (2s)	✓ check:pnpm-filter-targets: 142/181 --filter occurrence(s) across 32 file(s) resolve against 79 workspace package(s); 39 not judged (2 foreign, 17
20	pnpm check:skill-frame-sync	0 (1s)	✓ check-skill-frame-sync: 4 copies of the decision frame are structurally isomorphic across 3 files
21	pnpm check:watch-hint-literal	0 (3s)	✓ check-watch-hint-literal: 45 declaration(s) across 4 rostered name(s) -- ROOT_DIR_WATCH_HINTS 29, ROOT_FILE_WATCH_HINTS 9, ROOT_WATCH_HINTS 2, DECLA
22	pnpm check:skill-frame-freshness	0 (3s)	✓ check-skill-frame-freshness: the decision frame in this tree is current with origin/main (fetched just now).
23	pnpm check:nul-bytes	0 (2s)	check-nul-bytes: OK (scanned 7979 text file(s) -- 7979 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
24	node scripts/pm/check-governed-queue-guard.mjs --self-test	0 (0s)	✓ check-governed-queue-guard self-test: 129 cases pass (register-driven verdicts, the queue/PR event split, latest-decisive approval reduction, the 20
25	pnpm check:pm-dispatch-gates	0 (309s)	✓ dispatch-gates self-test: 1240 cases pass.

Lock wrapper's own VERDICT: command-exit 0 · held the lock 380s (6m20s) · waited 0s. check:pm-dispatch-gates streamed 1241 ✓ / 0 ✗ case lines. The line-ratchet gate was also run standalone right after the edit (self-test 111 cases pass; SKILL.md 989 lines, widest row 642).

NOT MEASURED

• node scripts/check-test-completeness.mjs — exit 3. Prerequisite: a saved turbo run test log; CI's run supplies it. Not a red, nothing to fix locally.
• pnpm --filter @objectstack/lint run check:doc-formula-expressions — exit 3. Prerequisite: a built @objectstack/formula (pnpm exec turbo run build --filter=@objectstack/formula); CI builds the closure and supplies the reading. Neither gate reads the two files this PR touches.

Session (durable attribution): https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[os-litant]

Fixes#14303

Governed surface (scripts/pm/**, .claude/**) — draft-only, human merge; needs:contract-review rides on the PR. Releases nothing: the diff is scripts/pm/** + .claude/skills/**, both inside scripts/check-empty-changeset.mjs's own release-nothing enumeration (.claude/, skills/, a CI-internal script) — hence skip-changeset.

What changed

Exactly the limb triage queued (issue comment 5503739916): the constant is bumped to the served tier, and every other site under .claude/skills/pm-dispatch/** and scripts/pm/** NAMES CONTRACT_REVIEW_TIER instead of spelling the model. The comparison stays exact — no family/prefix floor anywhere (that widening is the human floor's and is explicitly out of scope). SKILL.md:773's promise 「模型升级只改一行一个文件」 is now true: the model id is spelled as a value on one line of one file.

The diff carries the values; by design this body spells no model identifier. The served-tier get_session readings and the --tier output are on the card, in the flight's report comment.

Acceptance test — hit counts, not strings

git grep -n for the model-family pattern of the triage acceptance test over .claude/skills/pm-dispatch scripts/pm .claude/agents skills/objectstack-pm-dispatch:

tree	BEFORE (base a5b95ee6)	AFTER (head 2a8afbc0)
.claude/skills/pm-dispatch/SKILL.md	3 (:361:591:599)	0
scripts/pm/dispatch-gates.mjs	13	1 — the constant's definition line
.claude/agents/**	0	0
skills/objectstack-pm-dispatch/** (published twin)	0	0
total	16	1

Whole-repo git grep -c for the same pattern at head: one file, one hit (the same line).

Per-site: site | before | after (line numbers from base a5b95ee6; LITERAL stands for the spelled model id)

site	before	after
scripts/pm/dispatch-gates.mjs:8091 (now :7955)	export const CONTRACT_REVIEW_TIER = LITERAL;, declared AFTER the mandate table	value bumped to the served tier; definition and docblock hoisted above MANDATORY_TIER_GLOBS — the rows must read an initialised binding, and a const referenced before its declaration throws at import (import probe after the edit: constant and all three rows resolve to the same value). Docblock now states: one value site, exact comparison, no family/prefix floor
:8064:8069:8074 (mandate rows)	tier: LITERAL, three times	tier: CONTRACT_REVIEW_TIER — one definition, zero literals
:7970:7980 (header comment, clause ① and clause ②)	spells LITERAL	names CONTRACT_REVIEW_TIER
:15301:15302:15303:15306:15378 (self-test)	.tier === LITERAL	.tier === CONTRACT_REVIEW_TIER
:15319 (self-test)	mandLines.includes(LITERAL)	mandLines.includes(CONTRACT_REVIEW_TIER)
:15340 (self-test fixture, ambiguity refusal)	tier: LITERAL beside a tier: 'opus' row	tier: CONTRACT_REVIEW_TIER beside the same 'opus' row
:15408 (non-empty model id)	—	untouched
.claude/skills/pm-dispatch/SKILL.md:361 (+ :360)	:361 opened with LITERAL (the urgent-card triage subagent)	:360 ends 立即起 \CONTRACT_REVIEW_TIER` 档, :361opens分诊子代理,… — one sentence rebalanced across its own two lines (:361` was 119 bytes against the 120-byte cap; no words dropped)
SKILL.md:591 (+ :590)	clause ① model: "LITERAL"	一律 \CONTRACT_REVIEW_TIER` 档(`--tier` 输出) — names the constant AND the command whose output the seat types (node scripts/pm/dispatch-gates.mjs --tier, spelled in full in the claim-comment template at :546); ① 凡改moved to the tail of:590` for the byte cap, same paragraph
SKILL.md:599	clause ② 一律 LITERAL	一律 \CONTRACT_REVIEW_TIER` 档, the form references/lanes/director.md:13` already uses

Line-neutral under the ratchet: SKILL.md is 989 lines before and after (ceiling 1005, headroom 16), widest table row 642 bytes (pin 642, unchanged), max-line-bytes scan 0 offenders; touched lines measure 118 / 101 / 110 / 115 / 85 bytes (:360:361:590:591:599). scripts/pm/check-skill-line-ratchet.mjs untouched.

Self-test assertions rewritten, and what each still proves

• :15301:15302:15303 — each protocol-semantic file derives a mandate whose tier equals the single-source constant: still an exact string equality, still fails on a missing row or a row spelling any other value.
• :15306 — a mixed surface is mandatory and its tier equals the constant.
• :15319 — the mandatory rendering contains the constant's VALUE (the claim comment quotes those lines).
• :15340 — the ambiguity fixture still mandates two DIFFERENT tiers (the constant vs 'opus'), so the refusal it pins is unchanged.
• :15378 — every frame-sync-enforced copy derives a tier equal to the constant.
• :15408 — unchanged (non-empty model id).

Nothing weakened: every comparison remains an exact equality against one concrete string; only the string's source moved from a second literal to the constant.

premise_false (skipped, listed, never forced)

• references/contract-review.md:51, references/platform-readings.md — name the constant, no literal at this base; untouched (comparison text stays "against the constant"; "floor" never written).
• scripts/pm/ensure-pm-labels.sh:264, scripts/pm/check-governed-queue-guard.mjs:267 — comments naming the constant/pattern, no value; untouched.
• .claude/agents/os-dev.md — zero hits at this base; untouched.
• skills/objectstack-pm-dispatch/** — zero hits at this base; follow-up for objectstack-pm-dispatch: none.
• Frames: the check:skill-frame-sync COPIES anchors in SKILL.md sit at :880–:897; all three edited sites are outside every frame and the other three copies carry no model id — the model name is not part of any frame, so the published twin does not have to move.
• Verbatim maintainer rulings that mention the model family as prose (SKILL.md:586, references/dispatch-runbook.md:17) are quotations, not values, are not matched by the acceptance pattern, and stay verbatim.

Gates — union derived by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at the merge-base (22 commands) plus the PM-named extras, run in order at head 2a8afbc0 under scripts/pm/os-verify-lock.sh (slot issue-14303), each exit code captured before any pipe

#	command	exit	the gate's own verdict line
01	node scripts/check-ci-filter-parity.mjs	0 (0s)	OK: all 130 declared cross-package glob(s) (92 unique) are covered by core or crosspkg, every crosspkg entry still covers one, and the test jo
02	node scripts/check-cross-package-test-inputs.mjs	0 (1s)	OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
03	node scripts/check-self-test-wired.mjs	0 (1s)	✓ check-self-test-wired: every one of the 164 script(s) CI runs that ship a --self-test has that self-test run by CI.
04	node scripts/check-shard-attestation.mjs	0 (0s)	✓ check-shard-attestation: 2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s).
05	node scripts/check-test-completeness.mjs	3 (0s)	NOT MEASURED — its own text: "Nothing was measured: this gate exited before parsing a single summary line"; prerequisite: a saved turbo run test log, which CI's own run supplies
06	pnpm --filter @objectstack/lint run check:doc-formula-expressions	3 (2s)	NOT MEASURED — its own Fix line: pnpm exec turbo run build --filter=@objectstack/formula; prerequisite: a built @objectstack/formula — CI builds the closure and supplies the reading (a local build attempt was cut by the container command cap and is not a reading)
07	pnpm check:agent-test-spelling	0 (2s)	✓ check-agent-test-spelling: 0 violations — 428 file(s) · 5633 bare -- token(s) · 1380 launcher-rooted run(s) · 9 separator(s) JUDGED · 5 vitest-bac
08	pnpm check:bash32-floor	0 (1s)	✓ check-bash32-floor: 26 tracked shell file(s) under scripts/, .claude/hooks/, .githooks/** name no bash 4+ construct outside a comment, a guarded
09	pnpm check:cli-command-ids	0 (7s)	✓ check-cli-command-ids: 315 command-id literal(s) across 112 file(s) outside packages/cli all resolve to a real command path (73 ids derived; 3 decla
10	pnpm check:cross-package-test-inputs	0 (2s)	OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
11	pnpm check:declared-population-live	0 (12s)	✓ check:declared-population-live — 158 of 202 famil(ies) declare a path population, and every one of them reaches this tree's 7986 tracked file(s).
12	pnpm check:doc-authoring	0 (6s)	✓ doc authoring guard: sibling-package prose ids hold the baseline — 831 pinned site(s) across 231 file(s), 82730 string(s) read in 1124 parsed source
13	pnpm check:entry-guard	0 (18s)	✓ check:entry-guard: 199 scripts/ file(s) — every entry guard goes through invoked-as.mjs; 150 export bindings, 148 of them inert on import (2 known-u
14	pnpm check:parse-guard	0 (2s)	✓ check:parse-guard: 198 scripts/ file(s) — every TypeScript parse goes through ts-parse.mjs.
15	pnpm check:pm-governed-merges	0 (3s)	✓ check-governed-merges --self-test: 243 assertions (the unified governed predicate + near misses, subject→PR spellings, window parsing, the #12633 la
16	pnpm check:pm-governed-prose	0 (1s)	✓ check-governed-prose: 2 instruction surface(s) name all 5 registered governed surfaces (docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md
17	pnpm check:pm-skill-id-lint	0 (1s)	✓ check-skill-id-lint: 23 file(s) clean (pattern /#[0-9]{3,}/g).
18	pnpm check:pm-skill-ratchet	0 (1s)	✓ check-skill-line-ratchet: CLAUDE.md is 86 lines (ceiling 86; headroom 0).
19	pnpm check:pnpm-filter-targets	0 (2s)	✓ check:pnpm-filter-targets: 142/181 --filter occurrence(s) across 32 file(s) resolve against 79 workspace package(s); 39 not judged (2 foreign, 17
20	pnpm check:skill-frame-sync	0 (1s)	✓ check-skill-frame-sync: 4 copies of the decision frame are structurally isomorphic across 3 files
21	pnpm check:watch-hint-literal	0 (3s)	✓ check-watch-hint-literal: 45 declaration(s) across 4 rostered name(s) -- ROOT_DIR_WATCH_HINTS 29, ROOT_FILE_WATCH_HINTS 9, ROOT_WATCH_HINTS 2, DECLA
22	pnpm check:skill-frame-freshness	0 (3s)	✓ check-skill-frame-freshness: the decision frame in this tree is current with origin/main (fetched just now).
23	pnpm check:nul-bytes	0 (2s)	check-nul-bytes: OK (scanned 7979 text file(s) -- 7979 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
24	node scripts/pm/check-governed-queue-guard.mjs --self-test	0 (0s)	✓ check-governed-queue-guard self-test: 129 cases pass (register-driven verdicts, the queue/PR event split, latest-decisive approval reduction, the 20
25	pnpm check:pm-dispatch-gates	0 (309s)	✓ dispatch-gates self-test: 1240 cases pass.

Lock wrapper's own VERDICT: command-exit 0 · held the lock 380s (6m20s) · waited 0s. check:pm-dispatch-gates streamed 1241 ✓ / 0 ✗ case lines. The line-ratchet gate was also run standalone right after the edit (self-test 111 cases pass; SKILL.md 989 lines, widest row 642).

NOT MEASURED

• node scripts/check-test-completeness.mjs — exit 3. Prerequisite: a saved turbo run test log; CI's run supplies it. Not a red, nothing to fix locally.
• pnpm --filter @objectstack/lint run check:doc-formula-expressions — exit 3. Prerequisite: a built @objectstack/formula (pnpm exec turbo run build --filter=@objectstack/formula); CI builds the closure and supplies the reading. Neither gate reads the two files this PR touches.

Session (durable attribution): https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code