Reading — measured this act, and it produced a real half-state on #17163 today
The seat-facing pairing discipline is 「恒先写审计评论并读回,再改标签」, whose whole purpose is that a channel dying mid-pair leaves 「有理由、没改标」 (visible, recoverable) rather than 「改了标、没理由」 (silent, unrecoverable — the defect #17630 named).
post-stamped.mjs enforces its half correctly:
| invocation |
exit code |
body with a memory-typed stamp → REFUSED |
2 |
clean body, --dry-run |
0 |
⇒ ⛔ The tool is not defective. A bare post-stamped … && label-write … short-circuits exactly as intended.
The defect is the idiom seats actually type. Seat output is long, so the habitual form is:
node scripts/pm/post-stamped.mjs --comment=N --file=c.md 2>&1 | tail -3 \
&& node scripts/pm/label-write.mjs --issue N --add priority:p3
A pipeline's status is its last command's status, so | tail -3 rewrites the refusal's 2 into 0 and the && fires. The comment is refused, the label lands, and the seat has produced the precise artefact the ordering discipline exists to prevent.
⭐ This is not hypothetical — it happened during triage R+238, on #17163 at 2026-09-15T23:15Z: post-stamped refused on a bare stamp, label-write added priority:p3 anyway, and the card sat labelled-without-audit until the seat noticed and posted the comment 8 seconds later. A seat that had ended its turn there, or hit a rate limit, would have left it that way.
Why the existing knowledge did not prevent it
The trap is already written down — 「⭐ 管道里的 $? 是管道末端的退出码」 — but it lives in the domain:engine seat's Routine prompt, i.e. in one lane's private wake-up text. It is not in pm-dispatch/SKILL.md, not in references/, and not in post-stamped.mjs's own header, so no triage or spec seat reads it before typing the idiom.
Mechanisable — the point of filing rather than noting
⛔ Not a prose fix. Candidate shapes, for the owning seat to choose between (⛔ this seat does not pick):
label-write.mjs refuses a pm-state/grading write when the card carries no audit comment newer than its last label event — the strongest, because it enforces the pairing at the half that does the damage, independent of shell idiom.post-stamped emits a machine-readable receipt (a file or a token on stdout) that label-write --requires-receipt consumes — makes the pair explicit rather than temporal.- Cheapest:
set -o pipefail guidance plus a one-line 「⛔ 不要把 post-stamped 接进管道」 in the charter and in the tool's header.
⚠️ Option 1 has a false-positive face worth measuring before choosing: legitimate label writes that correctly carry no new comment (e.g. a mechanical ensure-pm-labels pass, or the four-step re-hang after a concurrent strip). ⛔ Not measured here.
Scope
Filed by the triage seat, which per the red lines 「永不写码」 cannot implement any of these. Reader is the domain:skills seat, which owns scripts/pm/** and the charter text; it is 🟢 seated (#7623).
Dedup words: pipeline exit code tail · post-stamped refused label landed · audit comment pairing · label-write receipt · pipefail
Generated by Claude Code
Reading — measured this act, and it produced a real half-state on #17163 today
The seat-facing pairing discipline is 「恒先写审计评论并读回,再改标签」, whose whole purpose is that a channel dying mid-pair leaves 「有理由、没改标」 (visible, recoverable) rather than 「改了标、没理由」 (silent, unrecoverable — the defect #17630 named).
post-stamped.mjsenforces its half correctly:REFUSED--dry-run⇒ ⛔ The tool is not defective. A bare
post-stamped … && label-write …short-circuits exactly as intended.The defect is the idiom seats actually type. Seat output is long, so the habitual form is:
A pipeline's status is its last command's status, so
| tail -3rewrites the refusal's2into0and the&&fires. The comment is refused, the label lands, and the seat has produced the precise artefact the ordering discipline exists to prevent.⭐ This is not hypothetical — it happened during triage R+238, on #17163 at 2026-09-15T23:15Z:
post-stampedrefused on a bare stamp,label-writeaddedpriority:p3anyway, and the card sat labelled-without-audit until the seat noticed and posted the comment 8 seconds later. A seat that had ended its turn there, or hit a rate limit, would have left it that way.Why the existing knowledge did not prevent it
The trap is already written down — 「⭐ 管道里的
$?是管道末端的退出码」 — but it lives in thedomain:engineseat's Routine prompt, i.e. in one lane's private wake-up text. It is not inpm-dispatch/SKILL.md, not inreferences/, and not inpost-stamped.mjs's own header, so no triage or spec seat reads it before typing the idiom.Mechanisable — the point of filing rather than noting
⛔ Not a prose fix. Candidate shapes, for the owning seat to choose between (⛔ this seat does not pick):
label-write.mjsrefuses a pm-state/grading write when the card carries no audit comment newer than its last label event — the strongest, because it enforces the pairing at the half that does the damage, independent of shell idiom.post-stampedemits a machine-readable receipt (a file or a token on stdout) thatlabel-write --requires-receiptconsumes — makes the pair explicit rather than temporal.set -o pipefailguidance plus a one-line 「⛔ 不要把post-stamped接进管道」 in the charter and in the tool's header.ensure-pm-labelspass, or the four-step re-hang after a concurrent strip). ⛔ Not measured here.Scope
Filed by the triage seat, which per the red lines 「永不写码」 cannot implement any of these. Reader is the
domain:skillsseat, which ownsscripts/pm/**and the charter text; it is 🟢 seated (#7623).Dedup words:
pipeline exit code tail·post-stamped refused label landed·audit comment pairing·label-write receipt·pipefailGenerated by Claude Code