[PM seat] domain:engine — 🟢 os-musk · session_01RuoNSXUbBoWHkNS4AknTrM · R2 · 31 landed · 1 in flight · 1 → 决策箱 #6367

⚠️ This post is the RECORD of state, not the state. Every round, re-read the labels. ⛔ Never read the counts here as current.

📌 Job description is versioned at .claude/skills/pm-dispatch/references/lanes/engine.md. ⛔ Not hand-copied per term.

1. Current PM — 🟢 os-musk

• Session session_01RuoNSXUbBoWHkNS4AknTrM · R1 · seated 2026-09-10T23:3xZ via maintainer invocation /pm-dispatch engine.
• Mutual-exclusion readings at seating (all four, before the first write): ① R3's 收班简报 5623087745 @ 17:55:24Z is the newest seat event; ② no 开轮标记 after it; ③ no Claim: newer than the brief on any pm:dispatched/pm:queue card in this lane, and git ls-remote shows no branch for any queue card; ④ newest CLOSED lane card ([finding] driver-sql and both migration generators default an absent or unknown field type to DIFFERENT families — string versus text, so the unvalidated authoring door produces two different columns #16319) carries R3's own session. ⇒ Brief is the latest event ⇒ 立即坐席.
• ⛔⛔ 宪章已在本班中途移动 —— 席位坐下时那句「no re-read owed」现在是假的,此行即为更正。 坐席时三份宪章同为 06df3271cc;到 2026-09-12T14:5xZ 实测:SKILL.md 与 core-rules.md 都被 ba37216081(skills(pm-dispatch): a zero-hit control must be scoped to the claim's own subject or the zero is void #17837「零命中控制项必须与主张同主体」)改过 —— 而那正是本班 fix(platform-objects,cli): the generated i18n staleness predicate judges every section a run generated #17839 落地提交的父提交,另有 0cd841a166(skills(pm-dispatch): an out-of-tier seat hands a skills-face hunk's review to the skills seat #17806)、de47b98967(skills(pm-dispatch): write the maintainer's base adjudication principle into the four-axis frame #17734)。contract-review.md 被 bc2bf01c8a(pm-dispatch: make check-clause2-carriers C4 recognise the live contract-review verdict dialect, and name the session a reviewer writes #17368)改过。⚠️ 且共享检出的工作树对这三份都与 origin/main 不同(sha256 前 12 位三对全不等)⇒ ⛔ 本班前段有若干条规则是从过期的本地副本上读的。⇒ ⭐ 规则:宪章不是坐席时读一次的常量;每次要据它裁决前,从 git show origin/main: 读,⛔ 不读工作树。

Standing parameters: in-flight ceiling 3 (maintainer, 2026-09-09). ⭐ A clause-② dispatch needs no slot held back for a reviewer — #17294 made this lane's review in-seat.

⛔⛔ Tier: this seat reviews its own clause-② work, at default tier

SKILL.md:641 「余席默认档自审加门禁」 · contract-review.md:28 · :50 puts it outside the downgrade fuse. ⇒ ⭐ The path limb decides WHETHER a clause-② review is owed; :641 decides WHO and at what tier — this seat, default tier, plus the gates. ⚠️ A lifted TIER does not drop the needs:contract-review LABEL: the label marks that a review is owed, the tier decides who performs it.

2. Ledger — read at 2026-09-10T23:3xZ

origin/main = f721ef0ff2 at seating. ⛔ Re-fetch before any tree claim.

⚠️⚠️ R3's "ZERO dispatchable" is FALSIFIED on re-establishment — the lane holds ~21 queue cards

R3 signed off at 17:55Z reporting pm:queue = 2 and 「0 可派,逐卡建立」. Re-establishing card-by-card at seating, label:domain:engine state:open returns 61 cards of which ~21 carry pm:queue with no assignee, no needs-user-decision and no pm:retriage. Most were graded into this lane by the triage seat between 14:22Z and 15:21Z on 09-10 — i.e. while R3 held the seat.

⭐ This is exactly the failure the 「⛔ 零可派是一个结论,不是空转执照,下一任要逐卡重新建立」 rule exists to catch, and it caught it. ⛔ A lane read taken at the START of a shift is not a lane state at the END of one. R3 re-read its cards but not its lane.

Landed this round — 3, each verified by TWO readings

card	PR	commit	parent count
#17501	#17580	29d00cc539	1 ⇒ squash
#17343	#17577	82cb69fede	1 ⇒ squash
#17177	#17588	07f93e089c	1 ⇒ squash
#17341	#17607	0918c44118	1 ⇒ squash
#17175	#17617	04333d05a5	1 ⇒ squash
#17586	#17637	d46deba195	1 ⇒ squash
#7898	#17669	4c42fd1c36	1 ⇒ squash
#17584	#17684	e743fb591	1 ⇒ squash
#17277	#17689	88a933088e	1 ⇒ squash
#17596	#17694	e7ff9c2a95	1 ⇒ squash
#17290	#17688	ada286979f	1 ⇒ squash
#17144	#17701	7173d7d142	1 ⇒ squash
#16884	#17702	baf974527d	1 ⇒ squash
#17167	#17709	dc709b2cfd	1 ⇒ squash
#17291	#17717	a8f0853ad0	1 ⇒ squash
#17713	#17826	54e82349f4	1 ⇒ squash
#16872	#17839	9c577c18a3	1 ⇒ squash
#17639	#17858	7c2c5aedd9	1 ⇒ squash
#15989	#17859	fe71032cf7	1 ⇒ squash
#17690	#17876	be5c60291c	1 ⇒ squash
#17759	#17887	c744c0af33	1 ⇒ squash
#17621	#17890	7e74af3df8	1 ⇒ squash
#17885	#17899	134b410a90	1 ⇒ squash
#17409	#17904	de62769eb0	1 ⇒ squash
#17590	#17829	e04a0aff25	1 ⇒ squash
#16917	#17907	7ce3154e6e	1 ⇒ squash
#17857	#17945	9ccc4179ee	1 ⇒ squash
#17879	#17967	eb93349150	1 ⇒ squash
#17930	#17980	4dab2bc5c3	1 ⇒ squash
#17813	#17996	c45ea8c396	1 ⇒ squash
#17655	#18004	bd5cf6374a	1 ⇒ squash

Each: content located by symbol on origin/main with a firing control and the pre-fix base reading 0; Fixes auto-close residue (pm:* + assignee) cleared in the same pass. ⛔ The merged boolean was not used as a reading, and all three auto_merge echoes said merge while every landing was a squash.

R2 — in flight 0 — read 2026-09-13T00:4xZ

card	PR	状态
—	—	⚠️ #15104（p2，本车道 order 头名）故意未派 —— 它属 #5499 冻结族，而分诊刚判入队，两条裁定相矛盾（#5499 常设规则：该族不入 pm:queue）。已报 5649072365，等分诊二选一。⭐ 本席量了一条供判断的读数：driver-memory 包之外有 11 个测试文件共现 $field 与 memory driver（含 #5499 自己点名的主力消费方 packages/objectql/），⚠️ 但那是共现而非测量。冻结唤醒判据重读：141 ⇒ 未唤醒（对照项 59）。
—	—	⭐ #17621 已落地(7e74af3df8,含一轮返工)。要害由服务端证据结案:CI 的 postgres 容器日志带着 os17621_absent_table 的 ERROR,而该标识符全树只在那一个新测试里。⛔ 本席两处被证伪并接受:① changeset 预期 skip-changeset 错(package.json 本身随 npm pack 发运 ⇒ patch);② 本席一直在传播的「skip-changeset 会被 PUT 抹掉」已过期(见下条更正)。
—	—	⭐ #17759 已落地(c744c0af33)。两个陷阱落地后均成立:手表写了/生成表 0;四条目三摘要行。⛔ 本席欠的后续卡已兑现 ⇒ #17891(两个机制对贡献式导航条目结构性失明;⚠️ 含「扩到 ACCOUNT_APP 会在新键上变红」这个必须先答的问题)。
—	—	⭐ #17885 已落地（134b410a90，含一轮因容器重启而重派的更正）。席内契约复核 5648857603 PASS；双载体剥除前先做了 --pair-json 离线演练（SUBJECT exit 0 + C6-RECORD，CONTROL exit 4 + C3）。⛔ 本席本轮更正了自己三个错误模型，见下文。残留承接已兑现 ⇒ #17901。

已落地:#17713 → 54e82349f4(parent count 1 ⇒ squash;新守卫 assertDispatchableHookEvent 在 origin/main 上 in-code 2,控制项 DISPATCHABLE_HOOK_EVENTS in-code 6)。auto-close 残留已清。
→ 决策箱:#17676(needs-user-decision,四棱块 + 六项写法齐备)。新立:#17840($contains 作者可见契约,裁定 B 的执行)。新立:#17853(vitest --project 过滤器落空即静默成功 —— 由 #16872 的席内复核 ③ 项升级另立,裸立不分级)。

R1 dispatched 8, landed 8. Two needed a rework round; both reworks were the seat's diagnosis being wrong, ⛔ not the dev's work.

⭐ The scoreboard that matters more than 6/6

Four dispatch premises were falsified by measurement; three were this seat's.

card	what was falsified	who paid
#17501	seat ruled C; option A measured to weaken 24 types (required −265) ⇒ re-ruled D, blast radius 1	measured before any code
#16746	seat's suggested route changes nothing (app gate fires first); the only reachable combination opens 14 Setup entries	measured before any code
#17175	the card's own "logged at ERROR" — it is warn; that closed the ruling's shape (b) outright	one measurement
#17175	seat said the PG arm was pinnable on the live-dialect job — it is not, and the seat's own read-only fence closed the only door ⇒ #17621	one measurement
#17409	⭐ TRIAGE's premise, not the seat's: 「the gate that exists to catch the author certifies the thing that will crash」. ⛔ It does not — @objectstack/lint ships fieldRuleRootIssue + FIELD_RULE_BOUND_ROOTS (validate-expressions.ts:688/:790, exported at index.ts:53) which rejects data at all three field-rule slots, with a shipped test named for that case. SCOPE_ROOTS is a 「never faults」 baseline published so a per-surface gate can compute its COMPLEMENT (cel-engine.ts:88), ⛔ not an accept set	measured before any code; ⭐ and the seat's own Zone 3 was stale — the per-scope accept set it floated as a design idea had already shipped in #13935
#17586	seat's rework hypothesis (Postgres aggregate cast) — the real cause was the PR's own new assertion hitting json having no equality operator	one rework round, and the hypothesis got measured on the way out

⚠️ And the sharpest premise trap, found on #17584: a card's guidance can be stale in BOTH directions at once. Triage had correctly caught that the card's 「every boundary applies the bound」 was wider than the tree, and instructed 「⛔ you cannot reproduce a truncated 501」. By dispatch time #16146 had landed and the door read boundedDeclaredRefusalMessage ⇒ triage's own correction was stale and the reproduction WAS available. ⇒ ⛔ Re-measure both the card and its triage comment; a correction is not more current than the thing it corrected. The round's end-to-end red exists only because it did.

⚠️ And one ordering trap, found on #7898: it carries no priority:* label, so a label sort puts it last — while the total order puts it second only to p0, because pm:blocking is computed from the reverse Blocked-by: index (#17625 declares it; fan-out 1 over all 78 open pm:blocked cards). ⇒ ⛔ Never take the queue's priority column as the order. A ruled, security-boundary, downstream-blocking card sat at the bottom of it. Grading gap reported to triage, ⛔ not re-graded here.

⇒ ⭐ The lesson is not "the seat is unreliable"; it is that labelling an assumption as a reading rather than a measurement, and ordering the dev to falsify it, is what converts a wrong instruction into one cheap measurement instead of a wrong landing. Every one of the five above was caught that way.

✅ #17587 执行完毕 — the director ruling, and what the sweep it ordered turned up

Six writes, each read back by an independent second GET (⛔ not from the PATCH echo): #5499's body gained the criterion; #17446 · #17348 · #17301 · #17286 · #14082 each carry exactly one Restart-when: line, byte-identical (232 B) to #5499's, with the old 6-file proxy string gone and labels/state/footer-count unchanged. One audit comment per card. #17587 closed completed, pm:queue dropped.

⭐ #14082 is the interesting one: its criterion had lived only in a comment (R1's own half-state heal 5629831637, which said in as many words 「consistency now, one correction point later」). This was that correction point — the line now lives in the body and the comment's copy is declared void.

⭐⭐ The ruling's 「and any other hold citing #5499」 clause forced a repo-wide sweep, and it paid:

• Population closed: 104 open pm:on-hold cards repo-wide (two pages — ⛔ the first page returns exactly 100 and stopping there would have been a silent truncation), of which exactly 5 cite [裁决] driver-memory / driver-mongodb 投入冻结 —— 维护者 2026-08-05 口径（跨单锚点） #5499 = the ruling's list. No sixth.
• ⚠️ driver-mongodb: bulkUpdate's single bulkWrite is only atomic when the caller supplies a session — a mid-batch refusal without one leaves earlier ops applied #14169 (driver-mongodb) sits inside [裁决] driver-memory / driver-mongodb 投入冻结 —— 维护者 2026-08-05 口径（跨单锚点） #5499's subject (that freeze covers mongodb too) but ⛔ does not cite it, and [裁决] driver-memory / driver-mongodb 投入冻结 —— 维护者 2026-08-05 口径（跨单锚点） #5499's criterion talks only about driver-memory. ⇒ ⛔ the seat did not apply the line to it — that would be exactly the 「各自发明代理判据」 the ruling forbids. Whether the mongodb half has any wake criterion at all is a question this ruling did not answer; raised to triage on Every card held under the #5499 driver-memory freeze has no fireable wake condition — the anchor is tracking and never closes, the freeze's stated wake has no card, and the sole existing hold carries no Restart-when: at all #17587.
• ⚠️ 51 of 104 open holds carry no Restart-when: in the body (49%). ⛔ That is a body-level reading, NOT a legality verdict — driver-memory / driver-mongodb execute() answer without running the command and without refusing — a declared, NON-optional contract member that no caller can tell apart from "ran and found nothing" #14082 proves a comment can carry it, and 9 of the 51 carry a target:* label (whether 「等 v18」 is a legal spelling is a口径 question, ⛔ not this seat's). The seat verified only its own lane: 7 engine holds lack a body line → 5 carry it in a comment (driver-mongodb: bulkUpdate's single bulkWrite is only atomic when the caller supplies a session — a mid-batch refusal without one leaves earlier ops applied #14169 · [finding] metadata: database-loader spells its own driver-capability predicate inline, duplicating resolveDriverExec one directory away #14121 · finding(objectql): the sibling [Registry] Collision warning ("ships from package") also double-quotes the package id #12789 · [finding] On SQLite, applyMigrationEntries runs a FULL table rebuild even when zero entries in the batch are honourable #12132 · [finding] The drift category vocabulary has no "report only" state, so a finding the platform will never reconcile must borrow needs_confirm and be declined by the reconciler #11721 — a locatability problem, ⛔ not illegality) · 2 carry it nowhere.
• ✅ docs: two prose notes still describe PHASE2_IMPLEMENTATION.md sections 4 and 5 as teaching the unresolvable @objectstack/core/security subpath, which PR #16205 repaired #16208 — the seat's OWN illegal hold, healed. R1 set pm:on-hold there on 2026-09-06 (5590656553) and ⛔ never wrote a Restart-when:. Fixed this round (5634608131) by mechanising triage's existing ruling (「站点二在该文件下次因别的原因被触碰时顺手改掉」) rather than inventing one: git log --oneline 5abca1792e..origin/main -- packages/core/src/security/security-scanner-retirement.pin.test.ts returns ANY commit. ⭐ Note the inverted direction — non-empty wakes it, ⛔ not returns 0. Today: 0 commits (control: same window over packages/core/src = 10 ⇒ ⛔ not a false zero); the stale parenthetical is still on main at :46 ⇒ the card's substance stands.
• ⛔ Reject specs that do not round-trip through JSON at put() — the option-1 tightening deferred by #7856 #8006 — deliberately NOT touched. Its restart condition is prose inside a maintainer ruling (5271020238, 2026-08-12). The gap is the spelling, not the criterion, and ⛔ rewriting a maintainer's words is not an execution seat's act. Raised to triage.
• ⚠️ driver-memory analytics 面的 generateSql 对 in/notIn/set/notSet 输出错误 SQL:回退成 = 且只取第一个值($in: ['100','200'] → WHERE code = '100') #5433 · driver-memory analytics 面:同一字段上的多个算子互相覆盖,{qty: {$gte:150, $lte:250}} 只剩最后一个 —— 区间塌成单边,结果被放大 #5440 · driver-memory analytics 面:flattenFilterCondition 对所有算子一律摊平数组比较数,{qty: {$eq: [100]}} 变成 $eq: 100(find() 取 0 行,analytics 取 1 行) #5442 · driver-memory analytics 面的 generateSql 把 contains 回显成 LIKE 'et'(没有 % 通配符)—— 回显的是等值匹配,执行的是子串匹配 #5444 · driver-memory 的两个过滤面对**比较值的种类**给出相反答案:{f: /re/}(正则)与 {f: ['x']}(数组)各差一个方向 —— 实测 #5354 still carry pm:on-hold while closed/not_planned — ⛔ left in place on purpose: those five ARE [裁决] driver-memory / driver-mongodb 投入冻结 —— 维护者 2026-08-05 口径（跨单锚点） #5499's prescribed batch close, and the label records that they were disposed of while held. Erasing it erases the disposition record. Recorded here so the next round does not re-discover it as a bug.

⚠️ Carried forward — things the next occupant should NOT rediscover

• ⛔⛔ mcp__github__get_job_logs 只返回日志的 TAIL —— 失败断言在中段就够不着。 fix(platform-objects,cli): the generated i18n staleness predicate judges every section a run generated #17839 的 Test Core (6/6) 全量日志 29,317 字符,本席用四个不同的 tail_lines 调了四次,每次拿回同一段收尾(artifact 上传 → Post job cleanup)⇒ ⛔ 看不到哪个测试失败。⚠️ 而 dev 侧的 egress 也拦着 blob host(productionresultssa19.blob.core.windows.net,connect_rejected)⇒ 两边都读不到 ⇒ ⭐ 失败断言只能本地复现,⛔ 不能靠查日志。 ⇒ 把 CI 红送回 dev 时,必须把「我拿不到中段」明说,否则它会以为席位藏了信息。
  ⭐ 日志尾部仍有可用读数,别因为拿不到中段就当白板:check-test-completeness: OK (8 of 8 package(s) reported … 5173 test(s) declared and all accounted for) ⇒ 不是超时、不是没跑到,是断言失败;report-test-timings 捕获 309 file timings ⇒ 进程正常结束。这两条把嫌疑区从「环境」缩到「断言」。
• ⭐⭐ 判断一个红是不是本 PR 的,先读 BASE 的同名检查 —— 一次调用,⛔ 不要猜。 fix(platform-objects,cli): the generated i18n staleness predicate judges every section a run generated #17839 红时本席读 origin/main 6059b29c03:Test Core 六个分片 + 汇总门全绿,总红数 0 ⇒ 红是本 PR 的,⛔ 不是基线。这条比任何推理都便宜。
• ⚠️ dev 报「本地全绿」时要问它跑的是哪个 TIER。 fix(platform-objects,cli): the generated i18n staleness predicate judges every section a run generated #17839 的轮次跑了 @objectstack/cli 的 unit tier(198 files / 2830 tests),而 CI 的 shard 6/6 跑 8 个 package / 5173 tests ⇒ 差额就是嫌疑区。⛔ 「本地全绿」不是「CI 会绿」,⭐ 派发令该要求 dev 报出它跑的 tier 与用例数,而不只是「passed」。
• ⛔⛔⛔ 「export 自模块 ≠ 到达 entry」只在 entry 是 SELECTIVE 时成立 —— 星号链会把导出原样带过去,而字面 grep 模块路径永远看不见它。 R2 在 Generated non-objects i18n groups carry no provenance from EITHER mechanism — --no-objects-only fills leaves from source that no predicate judges #16872 上用坏方法判了 Clause-②: no,轮次证伪:packages/platform-objects/src/index.ts:27 是 export * from './apps/index.js',链下去的 barrel 显式带出那三个符号,构建产物 dist/index.d.ts:5 字面列出三者,./apps 还是独立已发布子路径。
  ⛔⛔ 而本席的控制项读到的正是反证,却被计为正证:控制项是「entry 有 10 条 export ⇒ 它是选择性的」,而那 10 条里 8 条是 export * —— 星号再导出是「选择性」的反面。⇒ ⭐⭐ 一个控制项必须能区分它要区分的两种情况;数 export 的条数区分不了具名与星号。
  ⇒ ⭐ 正确工具(轮次给的,已采用):grep 构建后的 entry .d.ts 找 SYMBOL NAME,带伪造名负控制项。 源码侧的快速判据只有先数 ^export \* 为 0 才可用。
  ⭐ 追溯检查 [finding] packages/objectql carries the last two live source copies of the falsified 'the strip is schema-uniform' premise — one of them contradicts its own file #17291(昨日同一坏方法,且已落地):安全。 packages/objectql/src/index.ts 有 0 条 export *、82 条全具名 ⇒ 该 entry 确实选择性,且那一轮另用真实构建独立验证(dist 命中 0,正控制项命中 4)。⇒ 方法是坏的,那个结果恰好是对的 —— ⛔ 不要因为结果对就留着方法。
• ⭐⭐ Clause-② 问的不是「闸门会不会红」,是「席内契约复核是否必过」。 Generated non-objects i18n groups carry no provenance from EITHER mechanism — --no-objects-only fills leaves from source that no predicate judges #16872 的轮次论证 path limb 与 T3 widening tell 都是 spec-scoped、本 diff 不碰 ⇒ 闸门不会红 —— 论证正确,但答的是另一个问题。裁 yes 的依据是:① 与 [finding] aggregate() IS on the IDataDriver contract and is masked as Promise[any] on both SQL drivers — #15267's census and its dispatch order both say it is not #17277(已发布类型面移动判 yes)同类,⛔ 同一类变更不能两天两判;② 「拿不准 ⇒ yes」。
• ⚠️ 一张卡可能带着另一个车道的过期 Claim:。 Generated non-objects i18n groups carry no provenance from EITHER mechanism — --no-objects-only fills leaves from source that no predicate judges #16872 上 domain:cli 席 09-11T21:31 的 claim 仍在,names 一个从未被推过的分支;该席 23:18 主动释放(剥 pm:dispatched + unassign),分诊 01:47 重路由,本席 09:43 认领 ⇒ ⭐ 无竞态,但两条 claim 会让 dev 在「验证最新 claim 是否 names 我的分支」时困惑 ⇒ 发一条交接说明把时间线写清(5645105865)。
• ⚠️⚠️ 读数也会被共享检出误导 —— 不只是写。 车道规矩是「⛔ 永不编辑共享检出」,但 A writable package created via POST /api/v1/packages is registered in memory only — it does not survive a restart, and leaves its published metadata orphaned #17676 的轮次第一遍在共享检出(HEAD f721ef0ff2)上读行号,把一条警告报成 protocol.ts:22146;在 worktree 的派发基 c9eb773bab 上重取,真值是 22353。同一读数,不同的树。 ⇒ ⭐ 任何要写进卡或裁决的行号,必须在派发基上取,并在报告里写明取自哪个 sha。
• ⭐⭐ 一个 pin 可以为「缺陷不可能发生的那个组合」建模,于是永远是绿的。 A writable package created via POST /api/v1/packages is registered in memory only — it does not survive a restart, and leaves its published metadata orphaned #17676 的 durable-package.test.ts 把 services map 硬编码成 new Map([['package', …]]),overrides 只能换实现、⛔ 不能移除服务 ⇒ 7 个测试全部跑 service-存在分支,而发出缺陷日志的 service-缺席分支从该文件结构性不可达。⇒ ⭐ 问一个 pin「它覆盖了什么」时,真正的问题是 「它的 fixture 能不能表达出缺陷发生的那个组合」 —— 覆盖率数字答不了这个。
• ⛔⛔ stripComments 是「留白不删」,所以比它输出的 BYTE LENGTH 就是在比注释的尺寸,⛔ 不是在比代码。 本席在 fix(platform-objects,cli): the generated i18n staleness predicate judges every section a run generated #17839 上第一遍就是这么读的:三个手维护的 <locale>.source-hashes.ts 各 +19 行,stripComments 后 base 9343 → head 9362 ⇒ 判「有代码变化」。错。 那 19 字节全是被空白化的注释行留下的空白足迹。⇒ ⭐ 正确的可执行词条流 = 去空白后的非空行有序序列 —— 换这个仪器后三个文件全部 IDENTICAL = true,129 × 3 = 387 条摘要一条未动,控制项(改一条真摘要里的一个字符)发火。⛔ 一个「读出了差异」的仪器同样可能是坏的:假红与假绿一样是坏读数,只是这次代价只有一轮复测。
• ⭐⭐ 判断「dev 是不是把测试改松来迁就缺陷」,靠的是它没动的那一半。 fix(platform-objects,cli): the generated i18n staleness predicate judges every section a run generated #17839 把 i18n-extract-companion-orphan.test.ts 的一个用例从读两条记录改成读三条 —— 单看就是一个被改宽的期望。真正的读数在兄弟用例:同一文件里的 --objects-only 那条,base 与 head 逐字节相同(sha256 前 16 位两侧都是 b66d8b8d27c9b90b),断言仍是两条。⇒ 这对读数说的是「改动移的是待命路径,不是在役路径」。⭐ 控制项:同一个比较器拿 head 的兄弟例对 base 的被改例比,DIFFERS ⇒ 仪器发火,IDENTICAL 不是沉默。⇒ ⛔ 别只盯着被改的那一行问「合不合理」,去找那条本来就该不动、而且确实没动的。
• ⚠️⚠️ vitest run --project unit <某个 integration 文件> 把它报成一个通过的文件、跑零个用例、并静默从文件计数里减掉 —— 而这正是 packages/cli/vitest.config.ts:506 自己写的「本地默认」。 Generated non-objects i18n groups carry no provenance from EITHER mechanism — --no-objects-only fills leaves from source that no predicate judges #16872 的 dev 就是这么做的交付前验证(读到全绿),CI 于是在全层 vitest run 上红。机制是定义级的:两个 project 的 include 都是精确路径表(:611「an exact-path list matches nothing it does not name」),与命令行点名求交必然为空。⇒ 已立 [finding] vitest 的 --project 过滤器落空即静默成功 —— 点名一个 integration 文件跑 --project unit,报它是通过的文件、执行零个用例,并把它从文件计数里减掉 #17853(裸立不分级)。⭐ 计数读数归属 dev —— 本席在共享检出里 npx vitest 直接 ERR_MODULE_NOT_FOUND(未装依赖),⛔ 没有自量,卡上如实写明了归属与复现命令。
• ⭐ 同轴的第二件事,已写进 [finding] vitest 的 --project 过滤器落空即静默成功 —— 点名一个 integration 文件跑 --project unit,报它是通过的文件、执行零个用例,并把它从文件计数里减掉 #17853 待裁:agent 契约的 integration 层豁免按 diff 触到哪些文件判,而该层的实际触及范围是派生命令执行到的东西。 Generated non-objects i18n groups carry no provenance from EITHER mechanism — --no-objects-only fills leaves from source that no predicate judges #16872 的 diff 没碰 i18n-extract-companion-orphan.test.ts,它的运行碰了 —— 两者不是同一个集合。
• ⛔⛔⛔ 一个「测出了缺陷」的否定读数,和一个测不出缺陷的读数,一样需要控制项 —— 本席这一轮用一个坏仪器公开指控了两道闸门。 本席在 Generated non-objects i18n groups carry no provenance from EITHER mechanism — --no-objects-only fills leaves from source that no predicate judges #16872 上找 claim 用的过滤器是 body.split('\n')[0].startswith('Claim:') —— 只看第 0 行。它只命中过期的 domain:cli claim,于是本席得出「本卡没有指向正确分支的 claim」,并发评论断言 CI 闸门与 check-clause2-carriers 双双假绿。⛔ 错。 逐行重读评论 5645093960:Branch: 在第 21 行、Claim: 在第 23 行,都在列 0,分支正是关闭该卡的 PR fix(platform-objects,cli): the generated i18n staleness predicate judges every section a run generated #17839 的分支。⇒ 闸门是对的,读数是错的。 已整条撤回并更正(5646108844,原文保留引述,⛔ 不删)。实际偏差只是 AGENTS.md:394-401 要求的「首行以 Claim: 开头」被条款②改判说明占了首行 —— 一处顺序偏差,⛔ 不是缺席。
  ⇒ ⭐⭐ 规则补一条方向:「控制项不发火 ⇒ 读数作废」此前只对肯定结论执行。一个否定结论(「X 不存在」)在拿去指控任何机制之前,必须先用一个已知为真的正例把过滤器点着 —— 问「如果 X 存在,我这个过滤器看得见它吗」。本席没问,代价是一条错误的公开指控。
• ⭐⭐⭐ Clause-②: yes 不是免费的保守选择 —— 它机械地强制一个 minor。 scripts/check-changeset-no-major.mjs:814 逐字:「A PR that declares clause-② yes must grade AT LEAST ONE package whose packages/**/src/** it moves at **minor or above**」,而 :1537:「The review seat's needs:contract-reviewcarrier **declaresyeson its own and needs no line**」。⇒ 挂载体 + 打patch= **必红**,清红只有「升minor」或「改判 no」两条。⚠️ 本席在 #17639 的 claim 里按「拿不准 ⇒ yes」挂了标,**派发前自查时发现那会逼出一个 minor** —— 而该卡是已发布包里的缺陷修复,该打 patch;升 minor会在 changelog 里断言一次**并不存在的公开面加宽**。⇒ 已发5646120626取代原 claim、改判no、同笔摘除载体,并把三条去伪指令写进派发令。 ⇒ ⛔ **「拿不准 ⇒ yes」适用于*未解决*的不确定,⛔ 不是「挂上去总没错」。** 本卡的形状是 conformance —— 让第三道读门发出**已发布**的 ADR-0112 信封(status/code 是已声明字段,find()#8931 与aggregate()` driver-sql (PG): sum/avg/min/max over a boolean column throw the raw PostgreSQL 42883 with no ADR-0112 envelope (status undefined) #11455 早已发出),⛔ 无新导出符号、⛔ 已发布载荷无新键、⛔ 接受集不动。这不是拿不准,是判得出。
• ⭐⭐ 「串行在某文件之后」是一个冲突成本判断,⛔ 不是闸门约束 —— 本席实测纠正了一条被继承的前提。 席位记录此前把 driver-sql: store the file family (file / image / avatar / video / audio) as the bare sys_file id in a string column — drop FILE_REFERENCE_TYPES from JSON_COLUMN_TYPES, per-deployment switch on the adr-0104-file-references flag (ruling on #15041, step 2) #15989 / driver-sql: distinct() leaks the raw backend error with status undefined — the ADR-0112 envelope #11455 gave aggregate() never reached the third read door #17639 / [finding] Nine more IDataDriver doors are still masked as any on the SQL drivers — the #17277 census answered triage's 「is aggregate the only one?」 with NO #17690 记为「串行在 PR fix(driver-sql,spec): compile $contains on a JSON column as a per-dialect MEMBERSHIP test #17829 之后」,读起来像机制。⛔ 不是:scripts/check-single-claim-paths.mjs 的 SINGLE_CLAIM_PATHS 实测只有一条条目 —— .objectui-sha(用该模块自身的 declaredPaths() 读出,⛔ 非阅读印象);sql-driver.ts / ci.yml / pnpm-lock.yaml 都不在。该文件头还明写:锁文件、根清单这类「仅仅是热」的路径故意不列,因为按全仓 diff 求交做闸门约 68/300 误报。⇒ 真正的读数是区域距离:sql-driver.ts 共 18,556 行,distinct 在 9333,fix(driver-sql,spec): compile $contains on a JSON column as a per-dialect MEMBERSHIP test #17829 的 hunk 在 3199 / 14239 / 14642 / 14655,最近约 6,100 行 ⇒ 无重叠,可并行。⛔ 三张 p2 卡此前白压在一张停靠等外席复核的 PR 后面。
• ⛔⛔ 一个 PR 的 diff 必须用三点 BASE...HEAD 读;两点 BASE HEAD 会把 base 之后落到 main 上的改动倒着算进这个 PR。 本席读 PR fix(driver-sql): envelope the distinct() backend fault (#17639) #17858 时第一次就是两点读的,拿回 20 个文件 / +639 −1149,里面赫然有 .claude/skills/pm-dispatch/SKILL.md、core-rules.md、os-dev.md,以及本席自己刚落地的 Generated non-objects i18n groups carry no provenance from EITHER mechanism — --no-objects-only fills leaves from source that no predicate judges #16872 那几个文件以反向出现 —— 差一步就要去质问 dev「你为什么改 skill 文件」。三点读的真值是 4 文件 / +480 −11,与 PR 自报一致。⇒ ⭐ git diff --stat BASE...HEAD,并且先 git merge-base 把分叉点打出来看一眼。
  ⇒ ⛔⛔⛔ 【2026-09-12 第三次犯——把真正的陷阱写出来】上面这条规则没拦住本席，因为它说的是「要算 merge-base」，而失败形态是「手里已经有一个 sha，于是压根没想起要算」。 GitHub API 的 pull.base.sha 长得就像 merge-base，它不是——它是建 PR（或上次同步）时 base 分支的顶。
  ⭐ 实测（PR fix(driver-sql,spec): compile $contains on a JSON column as a per-dialect MEMBERSHIP test #17829）：base.sha = ca16dc274a，两点 diff 得 16 个文件；git merge-base 算出的真分叉点是 c9eb773bab，三点读 7 个文件，与 API 的 changed_files: 7 一致。多出的 9 个是 packages/rest/**、packages/runtime/**、docs/adr/** —— 别人落到 main 上的活。
  ⇒ ⭐⭐ 可操作化版本（取代「记得算」）：⛔ 永远不把 pull.base.sha 传给 git diff。 要么 git merge-base <head> origin/main 自己算，要么用 GET /pulls/N/files（按构造即三点）。⭐ 今天落地判断未被污染，正是因为受管面门用的是后者（脚本自拉 /files）—— ⚠️ 但那是运气，不是纪律。
• ⭐⭐ 判断一个 pin 是被改松还是被改强,数的是断言条数与事实去向,⛔ 不是行数也不是 diff 观感。 fix(driver-sql): envelope the distinct() backend fault (#17639) #17858 动了 driver-sql: a multiple: true boolean/toggle column reads back as a single true — formatOutput's booleanFields pass collapses the parsed array, so a stored [false] presents as true #17586 的 pin,单看是「改掉了一条已有断言」。用 js-comment-mask 取可执行词条流的集合差:删 1 条(control.code toBe('42883'))、增 4 条(toBe('DATABASE_ERROR') · status toBe(500) · sqlstateOf(control) toBe('42883') · sqlstateOf(err) toBe(sqlstateOf(control)))。⇒ 42883 这个事实没消失,它被搬到了现在真正住的地方(cause),另加一条交叉校验。⇒ 删 1 增 4 = 变强。
  ⇒ ⭐ 而最省事的那一步仍然是读 pin 自己的文字:merge-base 上该 pin 写着「the SQLSTATE row goes red on purpose, so whoever fixes it comes and updates this pin」——⛔ 不必推理,它自己邀请了这次更新。与 Generated non-objects i18n groups carry no provenance from EITHER mechanism — --no-objects-only fills leaves from source that no predicate judges #16872 那条「去找本来就该不动、而且确实没动的那一半」互为正反两面。
• ⚠️ 平台读数:MCP issue_write CREATE 在 ISSUE BODY 上会静默吞掉结尾的 rule 行 + footer 块。 driver-sql: an unresolvable column on distinct() answers DATABASE_ERROR/500 where find()/count() answer INVALID_FILTER/400 — the #8790 refusal never reached the distinct door #17857 建出来 footer 计数为 0,本席用 REST PATCH 补上并读回确认恰好一条。对照:MCP create_pull_request 在 PR BODY 上会追加一条,update_pull_request 不会重复追加,而本会话全程用 REST 写的 footer 都活着。⇒ ⛔ 用 MCP 建卡后必须读回查 footer。承接者:platform-readings.md 的持有席(⛔ PM 不写文件,故本席只记在此)。
• ⛔⛔⛔ 粗体拼写缺陷复发了 —— R1 在 Branch: 行上栽过、记录过,本班换到 Implemented-by: / Reviewed-by: 上又犯一次。 fix(platform-objects,cli): the generated i18n staleness predicate judges every section a run generated #17839 的契约复核记录 5646034071 里本席写的是 **Implemented-by:** \值`;冒号后剩下 ** `claude/…`,而 SESSION_TOKEN/BRANCH_TOKEN都是^(?:**)?(?:`)?[ \t]*(…)——**被吃掉后可选反引号遇到的是**空格**,于是找claude/时撞上反引号 ⇒ **两行全部 ⛔ UNREADABLE**,而 PR 已经落地。**控制项**:同一对正则读裸写形式**都命中** ⇒ 仪器发火。已改回裸写并带编辑说明复核通过(判词与实质未动)。 ⇒ ⭐ 对照组说明这不是运气问题:**PR #17829 的复核5645216262把独立性对写在**代码围栏里的裸写形式**,机读两行全部命中。** ⇒ ⛔ **独立性对永远裸写,⛔ 永不加粗**;而今天落地的contract-review.md` 刚把这条写死:「值紧跟冒号,前置词即不可读」。
• ⛔⛔ 新宪章(ba37216081 / skills(pm-dispatch): a zero-hit control must be scoped to the claim's own subject or the zero is void #17837)把零命中的控制项标准收紧了,而本席当天就撞上: 「零命中须用必中词反查,且与主张同语料/路径形/包界/引法/失效形态,否则该零作废」。本席给 driver-sql: store the file family (file / image / avatar / video / audio) as the bare sys_file id in a string column — drop FILE_REFERENCE_TYPES from JSON_COLUMN_TYPES, per-deployment switch on the adr-0104-file-references flag (ruling on #15041, step 2) #15989 派发令里的「fileColumnsMoved 在 driver-sql 外命中 0」用的控制项是 SqlDriverConfig —— 它在 driver-sql 外只命中一个 CHANGELOG,不是接线点 ⇒ 不同主体,按新规该零作废。
  ⇒ ⭐ 重取(同主体):拿 SqlDriverConfig 自己的兄弟键做控制项(:4385 是 Knex.Config & {…},自有键从 :5278 解构读出)。源码文件数、排除 CHANGELOG:schemaMode 73 · autoMigrate 14 · sqliteAbsentFile 6(含 default-datasource-driver-factory.ts,正是宿主接线点)· sqliteJournalMode 0 · fileColumnsMoved 0。⇒ 控制项发火,结论不变。
  ⇒ ⚠️⚠️ 但重取顺带暴露了原先没说的一条:sqliteJournalMode 同样读 0,而它是真键。 ⇒ ⛔ 一个 0 本身不证明「这条缝是缺陷」,它也可能只是「没有宿主设置这个可选键」。缝该存在的依据是裁决 5643444495 第 2 条,⛔ 不是那个 0。已发 5646679197 更正卡面,并直接通知在跑的 dev。
• ⭐⭐⭐ 剥载体之前可以先离线演练一遍清标后的状态 —— --pair-json 让「清标是否会被机器认作合法」变成派发前就能测的事。 做法:把 live 的 pulls / cards / comments / events / files / commits 抓下来组成一份 doc,把 needs:contract-review 从两侧标签里去掉、draft 设为 false、并在两条 event 流末尾追加一条 unlabeled 事件,然后 --pair N --pair-json FILE。本席在 feat(driver-sql,objectql,cli)!: the ADR-0104 file-family column step and its kernel→driver supply (#15989) #17859 上这么做,拿到 exit 0 + C6-RECORD 点名 5647107178 与 head 303d7946e4 ⇒ 剥标前就知道复核记录会被找到。
  ⇒ ⛔ 两次失败的演练比成功那次更有价值,记下来: ① events 给空 ⇒ 触发 C3「the gate was NEVER HUNG on either carrier」—— ⭐ 该检查器是靠 label EVENT STREAM 区分「挂过又清」与「从来没挂」的,所以合法清标之所以合法,全靠历史里那条 labeled;② commits 给空 ⇒ exit 2 UNJUDGED(读不到 head 提交日期)⇒ ⭐ 该脚本把「环境答不了」与「判定不合格」分得很干净,2 ≠ 4。
• ⛔⛔ 聚合门报 failure、而它的子作业是 cancelled 且没有任何一个是 failure —— 这是「运行被取代」的特征,⛔ 不是红。 本席在 feat(driver-sql,objectql,cli)!: the ADR-0104 file-family column step and its kernel→driver supply (#15989) #17859 上差点据此去诊断代码:Test Core 与 TypeScript Type Check 在 8e5e7627a4 上报红,而 6 个 Test Core 分片里 2 个 success、4 个 cancelled,4 个 Type Check 子门里 2 个 success、2 个 cancelled,⛔ 没有一个是 failure。真相是本席自己那条计数更正请求触发了推送(303d7946e4 @ 16:12:50Z),GitHub 取消在飞作业,聚合门因依赖被取消而报 failure。⇒ ⭐ 先读 PR 的当前 head,再诊断代码;基线对照也同时说了话(origin/main 7c2c5aedd9 同名检查 51 success / 0 红)。
  ⇒ ⭐ 监视器也要按这个改:每轮重新读 PR 的 head,⛔ 不要把 sha 钉死在启动那一刻 —— 否则一次推送就让监视器守着一个死 head 报假红。本席已改。
• ⛔⛔ 【2026-09-12 更正】本席记了三次的「粗体即不可读」已经不再成立**—— [finding] check-clause2-carriers C4 is silent on every 2026-09-09 contract-review verdict — its VERDICT: discriminator and session-only Reviewed-by: grammar match neither the bold Verdict: heading dialect nor the isolated-subagent authorship the seats now write #17346 修好了它。** check-clause2-carriers.mjs（取自 origin/main）现在带 VALUE_DECORATION = /^(?:[ \t]+|\*\*|)+/，在两条 token 正则之前**把空格、**、反引号按任意顺序任意次数剥掉**。⭐ 本席今天用该文件**自己的**正则实测：- Implemented-by: claude/issue-9-x`` → 读出 claude/issue-9-x，⭕ **可读**。 ⇒ ⭐⭐ 真正的规则是【**一个词**会挡住它，装饰不会】。#17859 那次真正的缺陷是值位置上的**汉字「见下」**，⛔ 不是包着键的粗体 —— 本席当时结论对、**归因错**，而归因错的教训会被照搬到下一次。 ⇒ ⭐ **做法不变，控制项的期望值翻面：**每条要发的复核记录，发之前仍然用脚本自己的正则跑一遍；但【粗体控制项现在必须读**出**来】，而【不可读的控制项要换成**带词的**（如 Implemented-by: branch claude/x``）】。本席在 #17899 的复核上跑了四条控制项，四条全如预期。 ⇒ ⛔⛔ **正则必须从 git show origin/main:取，永远不从工作区取。** 今天实测：本仓工作区的scripts/pm/check-clause2-carriers.mjs与origin/main 相差 **1414 行删除**。拿陈旧那份跑演练或验证，整个读数作废。本席改成：git archive origin/main scripts | tar -x -C `，核对内容哈希后跑那份。
• ⚠️⚠️ 本席自己的写操作会污染自己的控制项 —— 「某席是否在工作」⛔ 不能读 updated_at，必须读 timeline 的 ACTOR。 在评论里引用一张卡，会给那张卡产生一条 cross-referenced 事件，从而抬高它的 updated_at。本席 2026-09-12T21:25:58Z 发的升级评论，就把它自己引用的 spec: ComponentPropsMap['object-calendar'] prescribes calendar: { ..., allDayField } — a shape its own CalendarConfigSchema refuses by name #17054 / spec: dashboard.json liveness row for widgets.chartConfig overstates its evidence, and the protocol must state whether an authored chartConfig axis or the dataset-derived one wins (ruling on objectui#4044) #17385 的 updated_at 抬到了同一秒 ⇒ ⭐ 几分钟后再拿同一个控制项重读，它会把本席自己的手读成「那个席在工作」。
  ⇒ ⭐⭐ 正确的做法（本席已改用）：拉 GET /issues/N/timeline，看最后几条事件的 actor 与 event。对 domain:spec 席重做后得到的是更强的读数：spec/ui: a retired-key prescription is NOT the top-level message at PUT /api/v1/meta/view — every ListViewSchema tombstone is buried in invalid_union sub-errors, the exact shape exportOptionsPdfUnionError exists to fix #17299 在 19:57:11Z 有完整 claim 对（pm:queue→pm:dispatched + assign + Claim:）、21:07:18Z 收 os-dev-report，actor 均为 os-bill ⇒ 不是「卡被碰过」而是「那个席正在派发并收报告」。
  ⇒ ⛔ 同理，列表查询（GET /issues?labels=…&sort=updated）的 updated_at 只能用来排序，⛔ 不能用来当证据说「这张卡有人在管」。
• ⛔⛔ 【分诊席实测纠正了本席一条裁定】「够不着就声明成 testimony」是对的，⛔ 但声明了还拿它当驳回理由，就是错的。 本席在 SCOPE_ROOTS accepts data at scope: 'record', and as of objectui#8166 the consumer now FAULTS on it — a permanent lint/runtime disagreement with no open owner #17409 的席位复核 5635004756 里明确写了自己够不着 objectui，却同时用「B 会给 objectui 作者留下 the exact false green」当作驳回选项 B 的理由。分诊席（两个仓都够得着）实测：那个 false green 早已被 objectui#8972关掉 —— celAuthoring.ts:184-283 的 rowCanonAdvisory 在 scope === 'record' 上对 wrong-layer data.* 出 warning 并给改写。
  ⇒ ⭐⭐ 一条自己测不了的断言，可以记成 testimony，⛔ 但不能成为自己裁定里的承重梁。 要么找够得着的席位去量（本例里分诊席就是），要么把裁定建在自己量得到的理由上。⭐ 本例里结论恰好没错（B 仍然是错的）—— ⚠️ 而「结论对、承重理由假」比结论错更隐蔽，因为没人会回头查一个“对的”裁定。分诊席的原话：「只读本卡的人会继承那个假前提」。
  ⇒ ⭐ 反向也成立：本席在 [PM seat] triage (objectstack-wide) — 🟢 os-sam · session_01U6nJJSVZb476ckbRxmaMCA · R+250 就座 2026-09-16T14:54Z(维护者当面召唤)· ✅ harness CURRENT,连续五任的 STALE 已解除 · 本轮 objectui:retriage 2→0 · finding 半状态 7→0 · ③ 22→15 · 决策箱 +3(#9593 #8236 #9240)· ⚠️ 欠账:裸 finding os 48/ui 39 · 裸卡 ① ui 55 未动 · 3 张 pm:queue 挂真人 assignee ⛔ 勿动 · cloud/objectos/hotcrm 未挂载 ⇒ governed 审计 INCOMPLETE #6015 敲门里给出的「actor 而非 updated_at」方法学被分诊席采纳，并被它用来回溯修正了自己一次旧推断。⇒ 席间互校是双向的，值得主动把方法学写进敲门里。
• ⛔⛔ 写一张卡的状态复盘之前，先重读那张卡 —— 尤其当「它的状态」就是评论的主题。 本席在 [routing] PR #17829 的 spec 增量复核由裁决指给 domain:spec 席,但承载卡挂 domain:engine —— 该请求在 spec 车道的任何查询里都不可见 #17882 的关闭评论里写「本卡至今未被分诊」，而分诊席在 1h45m 之前（21:59:43Z）就已给它挂上 priority:p1 + domain:spec + pm:queue；domain:spec 席 22:41 认领、22:57:48Z 已经把卡关了。本席 23:45 发的那条「按本卡条款关闭」因此是对已关闭卡的空操作，且与对方的 5649251330 重复。已在 5649478372 就地更正。
  ⇒ ⭐ 机制：本席手里有一个几小时前的读数（「裸立未分诊」），写复盘时直接从记忆里取了它。与「零可派是会过期的读数」同源：⛔ 任何关于看板状态的句子，写之前都要重取，否则就是在发布过期品。
• ⛔⛔ ⛔ 不把结果归功于自己的某个动作，除非数据能把它与别的动作分开。 同一条评论里本席把 driver-sql: the $contains MEMBERSHIP spelling on any multi-valued / JSON column is a DATABASE_ERROR 500 on live PostgreSQL (SQLSTATE 42883, operator does not exist: json ~~ text) — it has only ever been executed on SQLite #17590 的解封讲成「靠人工升级三级补上的，不是靠任何机制」。实读：分诊席 21:59 给 [routing] PR #17829 的 spec 增量复核由裁决指给 domain:spec 席,但承载卡挂 domain:engine —— 该请求在 spec 车道的任何查询里都不可见 #17882 挂上 domain:spec 的那一刻，路由缺口就被补上了 —— 该席 42 分钟内认领、55 分钟内交付。⭐ 那张路由卡的机制恰恰是生效了的，缺的从来只是那一个 domain:* 标签。
  ⇒ ⚠️ 而「是哪一级升级起了作用」本席 分不开：向总监席的升级（21:29Z）与向分诊席的敲门（21:35Z）相隔仅 6 分钟，⛔ 这个数据不支持任何一方的功劳主张。⇒ 写「我做了 X，所以 Y 发生了」之前，先问同时还发生了什么。
• ⛔⛔⛔ 【本班次第四次】本席写在派发令里的「背景事实」，比本席的裁定更容易错 —— 因为裁定会被复核，而背景事实不会，dev 默认它是真的。 今日四例：① metadata-protocol's live-DB CI step supplies only OS_TEST_MYSQL_URL, so the new catalog presence probe's PostgreSQL arm is pinned as TEXT and has never been executed #17621 的 skip-changeset（dev 实测 package.json 随 npm pack 发运 ⇒ patch）；② skip-changeset 会被 PUT 抹掉的预防措施（早已失效）；③ SCOPE_ROOTS accepts data at scope: 'record', and as of objectui#8166 the consumer now FAULTS on it — a permanent lint/runtime disagreement with no open owner #17409 里「B 会给 objectui 作者留下那个 false green」（分诊席实测已被 objectui#8972 关掉）；④ [finding] packages/cloud-connection/vitest.config.ts carries #16189's defect verbatim — "No test block" and "this file's only effect the alias above" are both false there too #16917 里「platform-objects has population floors this one does not」 —— 实测 cloud-connection 同样有 floor（canonical-expression-envelopes.test.ts:199-200），而且它的人口是磁盘遍历不是 vitest discovery ⇒ 该论证在那个包里更强，本席把方向说反了。
  ⇒ ⭐⭐ 可操作规则：派发令里的每一条事实声明，要么带上它的测量**（命令 + 读数），要么明标为【预期】。** 两者都不带的句子，在 dev 眼里与裁定同级，却没有任何东西拦它。
  ⇒ ⭐ 它真的有用：同一张卡的派发令里，本席把 skip-changeset 明标为【预期】并要求实测 ⇒ dev 跑了 npm pack 并带阳性对照，结论同方向但是测出来的；而同一份令里被写成平叙句的 population floors 就直接错了。差别不在本席知道多少，在于本席标没标。
  ⇒ ⭐ 另记一条好现象：四次里有三次是 dev 或另一席主动抬杠并实测后告知的，⛔ 不是您自己发现的 ⇒ 把停止条件写成析取式（而非合取式）、并允许 dev 反驳前提，是这四次都能被接住的原因。保持。
• ⛔⛔ 【已测】本席帖的末尾 attribution footer 会被服务端确定性地删掉** —— 所以巡检清单里「footer 恰好 1」这一条对卡面正文是不可满足的。** 2026-09-13T00:0xZ 两次独立尝试，都是：发出去 footer=1 / len=66066，存回来 footer=0 / len=66008 —— 同一个 58 字节差（\n\n---\n_Generated by …_）。其余正文全部完好（分簿 25 行、心跳条、ACTOR 条、新增条均在）⇒ ⛔ 不是截断，是定向剔除。
  ⇒ ⭐⭐ 一条永远不可能通过的检查，比没有检查更坏 —— 它每轮都发火，于是训练本席忽略它，连带着旁边真该看的那几项一起忽略。⇒ 已改巡检提示词：卡面正文不再查 footer；⚠️ 评论仍然要查（实测：评论的 footer 不被剔，本班次每一条复核/provenance/落地记录读回都是 1）。
  ⇒ ⚠️ 对照注意：本班次较早几次 PATCH 读回确实是 footer: 1，所以这是一个变化而非一直如此的事实。⛔ 本席不推测原因（可能是服务端改动、也可能是某个 hook），只记两次实测与时间。
• ⛔⛔ 一条探针读到 0，先问它是不是假阴性**，再问被测物在不在 —— 与「控制项不发火 ⇒ 读数作废」是同一条规则的两面。** 验证 [finding] packages/cloud-connection/vitest.config.ts carries #16189's defect verbatim — "No test block" and "this file's only effect the alias above" are both false there too #16917 落地时，本席第三条探针查 Paraphrased rather than quoted 读回 main=0，一度看着像「这句没落地」。实为跨行断开（:62 结尾 / :63 开头）的假阴性。
  ⇒ ⚠️⚠️ 而本席在派发令里正是逐字向 dev 警告了这个陷阱（卡面原文：行式 grep 会假阴性，[finding] platform-objects vitest.config.ts still says "No test block" and "this file's only effect the alias" — both false since the console-intercept disarm landed above it #16189 的一条分诊注记就这么差点关错卡），然后在自己的验证里撞了进去。⭐ 说明这类缺陷的生命力比记得它的人更长。
  ⇒ ⭐⭐ 机制性的修法：每一条探针都要自带对照。 本次前两条探针带了 base=0 / main=1 的两向对照，所以读数成立；第三条没有对照，所以它的 0 本来就不可采信 —— ⛔ 问题不在于本席忘了陷阱，而在于本席发了一条无对照的探针。
• ⛔⛔⛔ 【第四次死亡教的新东西】心跳死掉时，车道会在无人看管下堆积**，而记忆里的读数会静默地变成假的。** 实测：00:47Z 本席写下「0 可派」（6:25Z 重取已是 6 张可派 —— 分诊席在 00:56–06:20 之间入队了六张，并把 A writable package created via POST /api/v1/packages is registered in memory only — it does not survive a restart, and leaves its published metadata orphaned #17676 从 needs-user-decision 转入 pm:queue（总监席 02:23Z 裁决 A′，维护者「同意」）。同窗口分诊还自我更正了 [finding] driver-memory's own reference matcher has no $field arm — a cross-field comparand (bare or with addDays) reaching it is presumably compared as a literal object rather than resolved or refused (grep reading, to be measured) #15104：pm:queue → pm:on-hold，引 [裁决] driver-memory / driver-mongodb 投入冻结 —— 维护者 2026-08-05 口径（跨单锚点） #5499 —— 即本席 5649072365 报的那个矛盾，取了本席给的第 2 个选项。
  ⇒ ⭐⭐ 重启后第一轮，⛔ 不相信记忆里的任何车道读数，全部重取 —— 「零可派是会过期的读数」在这里第二次应验，而这一次是用户指出来的，⛔ 不是本席自己发现的。
• ⛔⛔ 跨席指派无载体——同一形状第二例，且比第一例更坏。 A writable package created via POST /api/v1/packages is registered in memory only — it does not survive a restart, and leaves its published metadata orphaned #17676 的裁决 5650202813 把 item 1（platform-capabilities.ts 拆出常驻核心能力）判给 domain:spec 席的妹妹 PR，而本卡的验收（item 5）依赖它。实测：platform-capabilities.ts:50 仍是 'marketplace'（未落地）；全扫 domain:spec 146 张开卡，四个关键词命中 0（暗对照 0）；本卡 sub_issues 0；20 个开 PR 无一指向它。⇒ 连一张卡都没有（driver-sql: the $contains MEMBERSHIP spelling on any multi-valued / JSON column is a DATABASE_ERROR 500 on live PostgreSQL (SQLSTATE 42883, operator does not exist: json ~~ text) — it has only ever been executed on SQLite #17590 那次至少还有个承载物）。已报 5651690676。
  ⇒ ⛔ 本席因此暂不派 A writable package created via POST /api/v1/packages is registered in memory only — it does not survive a restart, and leaves its published metadata orphaned #17676：派了会拿回一个验收条件无法演示的 PR。⛔ 也不自行把裁决的五条拆开 —— 拆它是裁决方的权。
• ⛔⛔⛔ 【第五次，而且这一次有个更锐的名字】⛔ 不要转述一个你点了名的判例 —— 要么引原文，要么叫 dev 自己去读。 driver-sql: an unresolvable column on distinct() answers DATABASE_ERROR/500 where find()/count() answer INVALID_FILTER/400 — the #8790 refusal never reached the distinct door #17857 的派发令里，本席点名让 dev 照搬 aggregateBackendFault（driver-sql: an unresolvable WHERE column on aggregate() answers DATABASE_ERROR/500 where find() and count() answer INVALID_FILTER/400 — the #8790 refusal never reached the third read door #11541），却把它的三条臂凭印象转述成「name 在 filters AST 里 / 两者皆非落终局」。
  ⇒ ⭐ 实读（本席复核时自取，sql-driver.ts:9443）：判例对列出的字段做正向判断，else 直接 unresolvableFilterColumnRefusal —— 是补集，else 之后才是终局。⇒ 本席转述的那版才是偏离判例的那个。
  ⇒ ⭐⭐ 代价不是抽象的：dev 把本席那版实现成消融腿 C 跑了 —— 扁平 filter 的 pin 全绿，而 { $or: [{ nosuchcol: 1 }] } 退回 DATABASE_ERROR 500：本卡要修的缺陷在嵌套一层处原样复发，而扁平 pin 看不见。
  ⇒ ⭐ 但这一次系统接住了它：dev ⛔ 没照做、⛔ 也没默默改掉，而是实现正确那个、把本席那个做成可鉴别的消融腿证伪、再作为 open question 交回。这正是「停止条件写成析取式并明说允许反驳前提」要买的东西 ⇒ 保持，并在每份派发令里继续写明。
  ⇒ ⭐ 另记一条正向的：本轮的 changeset 预期（patch）被实测证实而非推翻 —— 本班次头一次。区别在于那一条本席明标了【预期】。
• ⛔⛔ GitHub 写通道会返回一个不知道落没落地的错误 —— ⛔ 读回之前不重试，而且读回要用权威信号**。** 2026-09-13 一天中两次：
  · dev 建 PR 时 POST /pulls 连吃 500（REST）/ 502（MCP）三次、空 body，退避后才 201；
  · 本席对 test(platform-objects): widen app-nav translation parity to runtime-contributed nav ids #17980 挂 auto-merge 时 enable_pr_auto_merge 回 GraphQL 解析错误。
  ⇒ ⭐ 两次的正确动作都是同一个：先读回“它到底落没落地”，再决定要不要重试。 dev 先查 branch PR listing 证明不存在再重试；本席读 timeline 确认无 auto_merge_enabled 事件再重试，重试后又验了恰好一次。
  ⇒ ⚠️ 读回必须用权威信号：挂 auto-merge 这件事上，auto_merge 字段入队那一刻就变 null，所以「成功但已入队」与「根本没挂上」在该字段上读数相同 ⇒ 读 timeline。本席这次正是靠它分开的。
  ⇒ ⛔ 盲重试的代价是真的：重复创建的 PR / 双重挂载，都是事后很难发现的残骸。
• ⛔⛔ 标签路径里的冒号要 URL 编码：labels/pm%3Adispatched，⛔ 不是 labels/pm:dispatched。 2026-09-13 实测：裸冒号形态当天成功过六次，然后在 app-nav-translation-parity 的反方向断言只走静态声明 —— 贡献式导航条目在它眼里不存在,而天真地扩到 ACCOUNT_APP 会把一个正确的翻译键判成孤儿(从 #17891 拆出) #17930 上连续三次 500（每次读回标签都还在）；换成编码形态后，同一 token、同一端点、同一时刻一次 200。分辨过了：读操作全程 200、配额 14976 ⇒ ⛔ 不是服务端故障。
  ⇒ ⭐⭐ 重试的出路是换形态**，⛔ 不是加次数。** 三次重试每次读回的纪律是对的（它证明了写确实没落地），但再试第四次也不会好 —— 错的是请求形态。⭐ “它之前能用”⛔ 不是“它是对的”的证据。
• ⭐⭐ 【定级判据收紧】2026-09-13 席内裁定：skip-changeset 的判据是「改动的文本是否到达 dist」，⛔ 不是「任何 dist 字节是否位移」。 finding(metadata-protocol): repeatedQueryParamError's docblock says its wording is packages/rest's "verbatim" so one caller is told "the same thing twice" — measured, the two sentences differ, and the reason the copy exists is now half gone #17813 / PR docs(metadata-protocol): the repeated-parameter docblock stops calling its wording packages/rest's verbatim #17996 送上来一个真分叉：符号 grep 读到干净的 0（⇒ skip），但 dist/index.js.map / .cjs.map 确实变了字节（31 行注释插入使 mappings 位移）⇒ 字面读法是 patch。
  ⇒ ⭐ 判例定了它，⛔ 不是本席的偏好： docs(objectql): the last two carriers of the falsified "schema-uniform" premise state what the tree does #17717（落地 a8f0853ad0）改的是 packages/objectql/src/engine.ts 与 src/validation/rule-validator.ts —— 两个都在发运源码里（files: ['dist',…]、非 private）、注释-only、净增 16 行，而它没有 changeset 文件 ⇒ 当时判的就是 skip-changeset。它的 map 按构造同样位移过。
  ⇒ ⭐ 支撑前提（本席自验）：scripts/check-sourcemap-no-sources-content.mjs 头注原文「every built, non-private package's .map files carry no source text」（build: stop embedding source text in published source maps (sourcesContent: false across the tsup builds) and repair the cli package's dead sources references (build half of #15905 question 1) #16469）⇒ 注释文本不随 map 发运，消费者收到的内容零变化。
  ⇒ ⚠️ 反面的代价说清楚：若改成字面读法，每一次对发运源码的注释修改都要带 changeset，并使 docs(objectql): the last two carriers of the falsified "schema-uniform" premise state what the tree does #17717 成为错判 ⇒ 那是一个值得单独裁的口径变更，⛔ 不在一个 PR 里顺手改。
  ⇒ ⭐ 交付轮的测量里有一条值得照搬的对照：除了阳性/捐造对照，它还加了一条定位对照 —— 同一 docblock 内未触碰的散文，同样命中 0。它证明那个零不是“探针找不到这个位置”。
• ⛔⛔⛔ removed_from_merge_queue 在成功路径上也会触发** —— ⛔ 它不是弹出信号。** 2026-09-13 实测 docs(metadata-protocol): the repeated-parameter docblock stops calling its wording packages/rest's verbatim #17996：removed_from_merge_queue @ 11:10:26Z → merged @ 11:10:27Z（一秒后）。队列是因为合并了才把它移出。
  ⇒ ⛔ 弹出的正确判据 = removed_from_merge_queue 且同一份 timeline 里没有 merged；两者必须从同一次** fetch 读。** 本席的监视器把 merged 从另一次 fetch 读，两次取数之间隔着那一秒 ⇒ 报了一次假弹出。已修，并拿那份真实数据自检通过。
  ⇒ ⚠️⚠️ 更该记的是：本席今天早些时候在 test(metadata-protocol): execute the read-probe PostgreSQL arm on a live server (#17621) #17890 的对照里亲眼见过 merged → closed → removed_from_merge_queue 这个顺序，然后仍旧写了个把 removed 当弹出的检测。 ⭐ 见过 ≠ 用上 —— 一条读数只有被写进判据才算数，写进叙述不算。
  ⇒ ⭐ 同类型的对照：本席对 auto_merge 字段就做对了 —— 早就记下「入队那一刻它变 null」并改成读 timeline。差别在于那一条进了规则，这一条只停在观察。
• ⛔⛔ A CONTAINER RESTART SILENTLY KILLS THE SEAT'S HEARTBEAT — it has now happened FOUR times, and every time CronList came back EMPTY: ~2026-09-11T18:5xZ, ~2026-09-12T19:0xZ, ~2026-09-12T21:0xZ, ~2026-09-13T0x–06:2xZ — 静默 5h38m,当前作业 8ced28a1. Current job: 51acfc61（旧 24241477 已删）, hourly at :17. The hourly patrol is a session-only CronCreate job (send_later, the durable MCP channel, vanished mid-session earlier in R1 and has not returned). ⇒ ⭐ the loop can die without any error, at any moment, and nothing announces it — the seat simply stops waking.
  ⇒ ⭐⭐ Every patrol's FIRST act must be CronList: if it is empty, the container restarted — re-create the job immediately and record the loss. The rebuilt job carries that instruction in its own prompt text, so the next firing re-arms itself.
  ⭐ What a restart does NOT touch (measured, ⛔ not assumed): the seat post, every label and comment already written, the git checkout, the scratchpad — and GitHub-side merge state. docs(objectql): the last two carriers of the falsified "schema-uniform" premise state what the tree does #17717 was added_to_merge_queue at 18:42:38Z, the container died after, and the PR was still queued with 33/33 green and no removal event afterwards. ⇒ ⛔ never re-arm auto-merge on a restart; read the timeline first.
  ⚠️⚠️ What IS lost: the cron job itself, any run_in_background watcher, and ⭐⭐ every in-flight SUBAGENT — a dispatched dev dies mid-task with no error and leaves no trace on GitHub. The third death killed the app-hidden-to-unpublished is replayed at the artifact-ingestion door, rewriting an authored defineApp({ hidden: true }) into an unpublished app — the default-flip class its own docblock says the retirement flag excludes it from #17885 dev round outright: it had been sent a three-item correction for PR fix(metadata-core,spec): the artifact door stops replaying the default-flip class, so an authored hidden: true app is no longer registered unpublished #17899 and not one byte of it reached GitHub — head unmoved at d45189e476, commits: 2, body still Clause-②: no, no carrier label; the only 20:58 activity was the auto-labeler and the docs-drift bot. ⇒ ⛔ after any restart, RE-READ the PR before assuming a dispatched round got anywhere, then RE-DISPATCH — ⛔ the PM cannot finish a dev's work itself. ⭐ On the FIRST death a watcher was mid-flight (a seat-post PATCH + a landing watch) — the PATCH had already landed (verified by read-back, ⛔ not assumed), the watch did not. ⇒ verify, never assume, which half of an interrupted job completed.
• ⚠️⚠️ A negative control needs its ANCHOR drawn from the half it is testing — this seat botched the same control TWICE in one round. Proving a diff is comment-only with stripComments needs two controls: a code edit must read as a change, and a comment edit must read identical. Both times the seat wrote src.replace('export', …) as the code mutation, and both times the first export in the file sits inside a header COMMENT — so the mutation was stripped, the control returned false, and that limb was void. ⭐ The fix that works: take a line out of stripComments(src) itself (guaranteed code), verify it is unique in the raw source, then mutate that. ⇒ ⛔ never guess an anchor; draw it from the population you are testing, exactly as 「a control that FAILS to fire voids the reading」 already demands.
• ⭐⭐⭐ skip-changeset vs a patch changeset is decided by ONE measurement: does the diff publish a byte from a released package? AGENTS.md:1042 — 「A bug fix in a released package takes a patch changeset — never none, and ⛔ never skip-changeset: that label is for a diff that publishes nothing from any released package.」
  ⚠️⚠️ R1's three comment-only PRs split, and the split looks arbitrary until you read what each decision RESTED ON:
  · docs(metadata-protocol,objectql): the summary column comments state the post-#16318 representation #17701 (metadata-protocol) and docs(core,driver-sql): the three boot-refusal comments state the registered position, not the pre-#16404 one #17702 (core + driver-sql) → patch, because each dev measured after a real build that its corrected TSDoc reaches dist/index.d.ts.
  · docs(objectql): the last two carriers of the falsified "schema-uniform" premise state what the tree does #17717 (objectql, [finding] packages/objectql carries the last two live source copies of the falsified 'the strip is schema-uniform' premise — one of them contradicts its own file #17291) → skip-changeset, because the same measurement returns 0.
  ⇒ ⛔ They are NOT precedent for 「comment-only ⇒ patch」 — the round on [finding] packages/objectql carries the last two live source copies of the falsified 'the strip is schema-uniform' premise — one of them contradicts its own file #17291 read them that way and recommended patch; the seat ruled the other way and it was ⛔ not a departure. Same rule, opposite measurement, opposite outcome.
  ⭐ The mechanism, and the cheap second route that does not need a build: a comment reaches .d.ts only if its docblock sits on a symbol the package ENTRY re-exports. preserveAuditIgnoredOnInsertWarning is exported from rule-validator.ts but packages/objectql/src/index.ts:437 re-exports only three siblings from that same file — so it never reaches an entry, and neither does its docblock. Control: that entry carries 82 export statements, so it is selective, ⛔ not empty. ⚠️ And a comment inside a function body never reaches a .d.ts under any configuration.
  ⛔ files[] is not the discriminator — all three packages ship the identical ['dist','README.md','CHANGELOG.md'].
• ⛔⛔ ⚠️ 本条已过期,2026-09-12 实测更正 —— 而本席在过期之后还把它写进过派发令(metadata-protocol's live-DB CI step supplies only OS_TEST_MYSQL_URL, so the new catalog presence probe's PostgreSQL arm is pinned as TEXT and has never been executed #17621)。 旧文写的是:「skip-changeset 有一个已记录的 clobber(pr-automation.yml:77-84):加上去会被 size labeler 的 PUT 在数秒后抹掉 ⇒ 推送安定后再加标、再读回。」⇒ 那个 clobber 已经被修掉了。 实测 origin/main:pr-automation.yml:97 写「Both steps now call scripts/pr-labels.mjs, which issues POST and targeted DELETE only」,:103 写其 --self-test 断言它们 emit no PUT;而 scripts/pr-labels.mjs 里 :121 是 const FORBIDDEN_VERB = 'PUT',计划的类型签名(:332)只允许 'POST'|'DELETE',:661/:677 的自测断言实际发出的动词恰为 ['POST','DELETE'] 与 ['POST']。⇒ 那个整集 PUT 在类型上就不可表达了。⭐ 仍然为真、且值得留的是历史:它确实发生过(test(service-queue): pin db-queue-adapter's engine double to ObjectQL.delete's dispatch predicate (#5198) #5533 丢过同一个标),那正是 pr-labels.mjs 存在的理由。⛔ 过期的是预防措施,不是那段历史。⇒ ⭐⭐ 教训是关于席位自身的:一条写进席位帖的「已记录的危害」会被原样搬进后续派发令,于是修好之后仍在传播。⇒ 任何带「已记录的 clobber/陷阱」的条目,在引用前先去树上量一次它是否还活着 —— 本条就是 metadata-protocol's live-DB CI step supplies only OS_TEST_MYSQL_URL, so the new catalog presence probe's PostgreSQL arm is pinned as TEXT and has never been executed #17621 的轮次在交付里顺手测出来并退回给本席的。
• ⭐⭐⭐ Check Changeset's clause-② axis reads TWO carriers, and the LABEL ALONE forces yes — a no in the PR body CANNOT clear the red while needs:contract-review is on the PR. scripts/check-changeset-no-major.mjs:

  if (carrier || (line?.kind === 'declared' && line.value === 'yes')) return { value: 'yes', ... };

  ⇒ on fix(metadata-protocol): the seed-tenancy organization probe records the operator channel as is, empty included #17709 the body read no and the axis still read yes, and the gate reported them 「disagreeing inside one PR」. The round drove both legs locally on the real tree differing in the label alone — present → exit 1, absent → exit 0 — so the label is the cause and the control fires. ⭐ The remedy is the seat stripping both carriers, which is the gate's own words: the carrier 「is the review seat's to place and to clear」. ⛔ A dev cannot clear this red, and asking them to try wastes a round.
  ⭐ And the strip DOES re-fire the gate: pr-automation.yml subscribes to label events (and to edited, 「load-bearing, not decoration」 Check Changeset concludes success when it measured nothing, and no edited trigger ever re-reads a Clause-②: line added after the last push — a correct seat action leaves the level axis unjudged behind a green check #16776). Measured: strip at ~16:53Z → new run at 16:53:59Z → success.
• ⭐⭐ A local gate sweep CANNOT see the clause-② level axis — it reads GREEN on a PR that CI will refuse. With no --event payload, check-changeset-no-major.mjs takes the no-pull-request branch and exits 0: there is no PR body or label list to read locally. ⇒ ⛔ a local green on that family is not evidence about this axis, and a dev reporting 「all N gates green」 has said nothing about it. The script ships the remedy (--event with a payload naming body + labels); what is missing is a sweep that synthesises the payload from the open PR. ⚠️ This is why fix(core, driver-memory): one reading of the dateRange array arm — an ARITY case in the conformance kit, and the cube face stops dropping the window #17694 and fix(metadata-protocol): the seed-tenancy organization probe records the operator channel as is, empty included #17709 both reached CI red after clean local sweeps.
• ⭐⭐⭐ Check Changeset's 「clause-② YES but nothing graded minor」 red has TWO answers and they are ⛔ NOT interchangeable — R1 hit both, one hour apart.
  · fix(core, driver-memory): one reading of the dateRange array arm — an ARITY case in the conformance kit, and the cube face stops dropping the window #17694 → path 1 (raise the level). The declaration was right: ANALYTICS_DATE_RANGE_NOT_A_WINDOW is a genuinely new exported symbol on @objectstack/core, re-exported from the entry. A purely additive widening takes at least minor (maintainer ruling 2026-09-04, decision batch [WIP] Add query enhancements and advanced validation features #35, on finding(changeset): two independent contract reviews read the repo's own history to opposite bumps for "add an exported symbol to a published index" #15294).
  · fix(metadata-protocol): the seed-tenancy organization probe records the operator channel as is, empty included #17709 → path 2 (re-declare no). The declaration was wrong — this seat's own yes rested on a labelled READING (「organizationProbeError reaches the published SeedTenancyBackfillStatus」) that the round falsified, exactly as the order told it to try. Re-measured independently: it is a local variable (seed-tenancy-backfill.ts:1327) flowing only into a warn line's meta (:1402), on no exported type (⛔ not SeedTenancyBackfillStatus:188, ⛔ not SeedTenancyBackfillResult:265), and the diff moves no export line. Control fires both ways: a throw at the organization probe does ⛔ not reach JSON.stringify(result); the same throw at the split probe does, in result.detail.
  ⇒ ⭐⭐ The deciding question is never 「which path clears the gate」 — it is 「which statement is TRUE」. Raising fix(metadata-protocol): the seed-tenancy organization probe records the operator channel as is, empty included #17709 to minor would have asserted a published-surface widening in the changelog that does not exist; that is a release-level falsehood bought to turn a check green. ⛔ Never available.
  ⇒ ⭐ 「声明被复核推翻 ⛔ 不作席位过失」 and 「Clause-② 按设计临时…⛔ 非终审」 — a yes re-declared no on measurement is the mechanism working. But ⚠️ the conservative 「拿不准 ⇒ yes」 rule is for unresolved uncertainty; ⛔ it is not a licence to freeze a guess after measurement resolves it.
• ⚠️ This seat's dispatch order repeated a COUNT the card got wrong, without checking it. metadata-protocol: the organization probe records 'unknown error' for an empty message channel, unlike the other three raw-exec sites #17167's card says 「the other three」 operatorFacingErrorText sites; the population is five call sites, so the aligned one has four siblings. ⇒ ⛔ a number inherited from a card is a reading, and this seat must label it as one — it labelled the card's mechanism claims but passed its counts through unmarked.
• ⭐ A one-line-looking fix can be carrying a second fact. metadata-protocol: the organization probe records 'unknown error' for an empty message channel, unlike the other three raw-exec sites #17167's placeholder || 'unknown error' also encoded 「did it fail」, because the site read organizationProbeError === '' as 「the probe did not fail」. The round's ablation showed a bare removal routes a thrown '' to status no-organization-yet with no warning at all ⇒ a published status value is one branch away. The repair moved the fact into the type (string | undefined). ⛔ Never dispatch a 「just delete the fallback」 order without asking what the fallback also encodes.
• ⛔⛔⛔ PROTOCOL VIOLATION, this seat's, repeated in EVERY R1 dispatch: the Claim: comment did not name the dev's branch. AGENTS.md:394-401 — the identity record is 「first line beginning Claim:, then the session ID and the branch (claude/issue-<n>-<slug>)」, a PM dispatch 「posts the Claim: naming the dev's branch (step 2)」, and the executor 「verifies that the newest Claim: names its branch (on a mismatch it stops and reports)」. ⇒ ⛔ that verification was structurally impossible against this seat's claims all round — the mutual-exclusion mechanism could not have caught a second session dispatching the same card.
  ⚠️ ⭐ TWO separate rounds reported it and the first was read past ([finding] aggregate() IS on the IDataDriver contract and is masked as Promise[any] on both SQL drivers — #15267's census and its dispatch order both say it is not #17277's report said 「no branch to verify against」; [finding] Three source comments still say the boot-refusal codes are "deliberately NOT wire vocabulary" — #16649 registered them, so all three are false in packages/core and packages/drivers/driver-sql #16884's filed it as a finding aimed at this seat). ⛔ That delay is this seat's error, not theirs. Amended on the three live claims ([finding] Three source comments still say the boot-refusal codes are "deliberately NOT wire vocabulary" — #16649 registered them, so all three are false in packages/core and packages/drivers/driver-sql #16884 · Sweep the stale summary is a table.float comments left behind by #16318's NUMERIC representation change — nine sites in four packages, the sweep already exists on a sibling branch #17144 · metadata-protocol: the organization probe records 'unknown error' for an empty message channel, unlike the other three raw-exec sites #17167) with an edit note naming the branch.
  ⇒ ⭐ The dispatch order must SPECIFY the branch name and the Claim: must carry it — the PM decides claude/issue-<n>-<slug>, the dev uses it, the dev can then verify. ⛔ Do not post a claim without it.
• ⚠️⚠️ A line-oriented git grep structurally CANNOT see a phrase that wraps across a newline — SECOND occurrence in R1. On [finding] Three source comments still say the boot-refusal codes are "deliberately NOT wire vocabulary" — #16649 registered them, so all three are false in packages/core and packages/drivers/driver-sql #16884 this seat's git grep -l 'deliberately NOT wire vocabulary' read 1 where the card said 3; the tree was right and the instrument was wrong — plugin-contract.ts wraps the phrase between wire and vocabulary (line-based 1, continuation-lines-joined 2), and the third site never carried that phrase at all (the card's table gives it a different false claim). ⭐ The first occurrence was R1's git grep "one day earlier" reading 0 on driver-sql: a multiple: true boolean/toggle column reads back as a single true — formatOutput's booleanFields pass collapses the parsed array, so a stored [false] presents as true #17586 — a trap that card had predicted in advance. ⇒ ⛔ never conclude 「already fixed」 from a single-phrase line grep; join continuation lines, or build the predicate from the card's table one phrase per row.
• ⭐⭐ The repo ships the RIGHT instrument for 「is this diff comment-only?」 — scripts/js-comment-mask.mjs (stripComments). Compare the executable token stream (strip comments, drop whitespace-only lines, hash) instead of eyeballing +/- lines. Used on docs(core,driver-sql): the three boot-refusal comments state the registered position, not the pre-#16404 one #17702: all three files code-identical (3305c756ddfea806 / c9c1b9728c24e313 / 184e2f332da9d7fd) with comments moved — and this seat's hashes matched the round's independently. ⚠️ Both directions of the control must fire: this seat's first negative control used a mutation anchor that was not in the file, so it read 「false」 and voided that limb until re-run with an anchor proved present.
• ⭐ pnpm --filter A --filter B run test --workspace-concurrency=2 forwards the flag to the SCRIPT, not to pnpm — vitest answers CACError: Unknown option --workspaceConcurrency and the run dies in ~2s. ⇒ the flag goes before the filters.
• ⭐⭐⭐ THE TEMPLATE DEFECT THAT DEFEATED A LANDING GATE — this seat's own, and the sharpest thing R1 found. The dispatch-order boilerplate bullet - **`Clause-②: yes|no` must appear in the PR BODY at column 0.** is key-initial, so check-clause2-carriers.mjs's readClause2Line parses it and returns {kind:'declared', value:'yes'} — the yes|no placeholder opens with a valid token and | passes the (?[A-Za-z0-9_]) boundary. ⇒ on [finding] aggregate() IS on the IDataDriver contract and is masked as Promise[any] on both SQL drivers — #15267's census and its dispatch order both say it is not #17277 and [finding] insertManyData attributes a batch-union dropped-field name to every row that supplied it — ruling C's per-row hook exemption falsifies that inference #17290 the declaration limb was reading the seat's own instruction as a judgement, and --pair 17689 returned exit 0 on it — precondition ② of the landing check, on a PR already armed with auto-merge. ⭐ Verified against the exported function with three controls (yes→yes, no→no, prose→null).
  ⛔ The order's sentence 「the gate reads it there and never reads a comment」 is FALSE: two gates read two carriers — Check Changeset reads the PR body, --pair reads the card's claim comment. ⇒ ⭐ every dispatch order must carry a real line-anchored Clause-②: yes|no declaration of the SEAT's own, above any line that merely explains the key. readClause2Line returns on the FIRST match, so position is the whole remedy.
  ⇒ Fixed by hand on [finding] aggregate() IS on the IDataDriver contract and is masked as Promise[any] on both SQL drivers — #15267's census and its dispatch order both say it is not #17277 · [finding] insertManyData attributes a batch-union dropped-field name to every row that supplied it — ruling C's per-row hook exemption falsifies that inference #17290 · The shared dateRange conformance kit has no ARITY case, so an odd-sized array arm is governed nowhere — and driver-memory's cube face drops such a window entirely #17596 (real declaration inserted above; instruction neutralised; edit note on each). Re-run: --pair 17689 → 0, --pair 17694 → 0, --pair 17688 → 0, one match each and each a judgement.
  ⭐ Already a known card — [finding] check-clause2-carriers reads a key-INITIAL describing line as a declaration — its own self-test asserts the general property "only DESCRIBES ⇒ MISSING", and the fixture pinning it covers only the other half #17098 (domain:skills), ⛔ so no duplicate filed. This seat added the measurement as corroboration (5636056726) because that card records only the fail-closed direction (ci: every Test Core run publishes the slowest test files and packages beside their pinned weights (maintainer-directed, part B measurement) #16454: a true no got a review hung). ⚠️ The same defect also produces a false GREEN, which its 「the cost is bounded but recurring」 framing understates. ⚠️ Prevalence board-wide is unmeasured: --json reports findings and declarationLimb counts only (13 open PRs / 12 pairs / absent 0, missing 1, sibling 0) and ⛔ does not expose the matched line for passing pairs.
• ⚠️⚠️ A grep -c for removed text is the wrong instrument — FOUR times in R1. It cannot tell 「the claim stands」 from 「the claim is quoted and refuted」. On the feat(driver-sql,driver-turso): aggregate() publishes its declared return type, not any (#17277) #17689 / fix(core, driver-memory): one reading of the dateRange array arm — an ARITY case in the conformance kit, and the cube face stops dropping the window #17694 / fix(metadata-protocol): insertManyData reports the dropped-field union at BATCH level instead of naming rows it cannot identify #17688 landing checks all three controls read non-zero where 0 was expected, and all three were comment quotations of the removed code. ⭐ The instrument that works: count only lines that are not comments (*, //, /*), and prove it fires on a real code line. Done that way: [finding] insertManyData attributes a batch-union dropped-field name to every row that supplied it — ruling C's per-row hook exemption falsifies that inference #17290's false inference 0 in code, The shared dateRange conformance kit has no ARITY case, so an odd-sized array arm is governed nowhere — and driver-memory's cube face drops such a window entirely #17596's dropping guard 0 in code, [finding] aggregate() IS on the IDataDriver contract and is masked as Promise[any] on both SQL drivers — #15267's census and its dispatch order both say it is not #17277's false claim 0 in code, controls firing at 1. ⛔ The naive count would have failed all three landings, or passed them for the wrong reason.
• ⚠️ (original note, kept) A grep -c for a corrected comment's OLD TEXT is the wrong instrument — it cannot tell 「the false claim stands」 from 「the false claim is quoted and refuted」. On feat(driver-sql,driver-turso): aggregate() publishes its declared return type, not any (#17277) #17689's landing check this seat's control read 1 where 0 was expected; the line was "aggregate is not on that contract" — was FALSE. ⇒ read the context, ⛔ never the substring count. Third instrument error of this class in R1.
• ⚠️ Observed, ⛔ NOT acted on (another lane): PR docs(spec): state the retired allowRestore / allowPurge parse-time accept set exactly #17485 / card ObjectPermissionSchema's retired allowRestore/allowPurge: only literal false parses (not a truthy/falsy split), and no post-parse guard can ever see either key #17425 (domain:spec) is a C6 half-state — clause-② gate cleared on both carriers at head a9469d6b44 with no ## Contract review record on that head. Surfaced by this seat's sweep. ⛔ Not this lane's card; reported here only so it is not lost.
• ⭐⭐ GET /search/issues is BLOCKED in this session — it answers {"message":"This GitHub API path is not available: sessions are bound to their configured repositories…"} with no total_count. ⚠️ The dangerous part: parsing it naively yields total_count = None, which reads like "0 results" and would silently pass a dedup check. ⇒ dedup must use a repo-scoped listing + local grep with a declared control. Done that way this round: 566 open issues over 6 pages, control worktree = 24.
• ⚠️ No agent in this session can delete a remote branch — BOTH channels refuse. git push origin --delete → RPC failed; HTTP 403; DELETE /git/refs/heads/… → 403 「Write access to this GitHub API path is not permitted through this proxy.」 Re-tested 2026-09-12 on a fresh orphan (claude/issue-17676-…): still 403 on the REST channel — ⛔ not inherited from yesterday. ⇒ orphans accumulate and only a maintainer can clear them.
  ⛔⛔ CORRECTION 2026-09-12 — R1 recorded 「4 zero-commit claude/* branches (of 349)」 and THAT NUMBER CAME FROM A BROKEN PREDICATE. ⛔ Do not reuse it. 「sha == origin/main」 only catches branches equal to main at that instant, so it silently drops every zero-commit branch cut against an earlier main — which is exactly why today's fresh orphan (c9eb773bab, the dispatch base) did not show up under it while main had moved to c1078a5591.
  ⚠️ The obvious repair is broken the other way: an ancestor predicate (git merge-base --is-ancestor) returns 219 of 366, but it also matches branches from the merged era, and the control could not be taken at all — the branch chosen as the negative control had already been deleted. ⇒ ⭐⭐ This seat cannot currently measure the orphan population and declines to ship either number. 「控制项不发火 ⇒ 读数作废」 applies to the seat's own census exactly as it applies to a dev's.
• ⭐ git push … 2>&1 | tail reports tail's exit, not the push's. This seat's delete attempt printed exit=0 while failing with 403 — the pipe-exit trap, from this very list, fired again. ⛔ The only evidence that counted was the independent git ls-remote re-read.
• metadata-protocol's live-DB CI step supplies only OS_TEST_MYSQL_URL, so the new catalog presence probe's PostgreSQL arm is pinned as TEXT and has never been executed #17621 (filed this round, ungraded): the PG arm of the new read-probe.ts is text-pinned only, never executed. ci.yml:1415 gives metadata-protocol only OS_TEST_MYSQL_URL; both URLs go to the driver-sql job at :1319-1320, and metadata-protocol has no pg dependency. ⇒ this seat's own read-only fence on driver-sql closed the only live-PG door. ⛔ Not urgent — the four-verdict fence makes a wrong PG arm loud ('unreadable' + warn), never a silent 'absent'.
• fix(metadata-protocol): one shared non-raising table-presence probe, so a normal boot stops printing DATABASE_ERROR for an expected miss (#17175) #17617 carried a test-only addition to packages/runtime (domain:cli, +128/−0, no source change). Accepted and declared, and put to triage as a precedent question: does a test-only cross-package addition require the cross-domain exception path? ⛔ Unsettled; this PR is the card to rule on.
• SeedTenancyBackfillStatus is a public export that gained 'unreadable'. Ruled Clause-②: no (the member is reachable only where the status previously lied). ⭐ The changeset was graded minor anyway, so a later yes ruling costs nothing — cheap insurance this lane has needed before.
• Class census left open on purpose: three further WHERE 1 = 0 sites exist (runtime-index-preflight.ts:162, seed-tenancy-backfill.ts:775, cli/.../duplicates.ts:393), reported ⛔ not swept. None prints on a normal boot; each has a named successor.

✅ Serial relay DISCHARGED — scripts/engine-double-contract.pinned.json

#17580 → #17588 relay completed correctly. On origin/main the ledger carries 3 entries naming protocol.meta-types-degenerate-derivation.test.ts and 3 naming seed-loader-summary-scope.test.ts; 784 rows = 781 + 3. ⭐ --write reported 0 added, 0 lost and left a clean tree — i.e. the regeneration proved both sides survived rather than repairing a loss. ⚠️ Keep the discipline: that path is merge: unspecified, so a dropped side would have merged exit 0 with no conflict marker.

⚠️ The relay hazard, kept for the next occupant

#17580 and #17588 both add +15/−0 to it (each adds a test registering an engine double and ran the gate's own --write). ⇒ #17580 has the baton; #17588 merges origin/main and regenerates after it lands. ⛔ Never a textual merge of the two blocks.

⚠️ git check-attr merge on that path reports unspecified — it is not routed to the merge=os-regen driver (control: packages/spec/spec-changes.json is routed). ⇒ it merges with exit 0 and no conflict marker even if a side is lost. The regen discipline is the only thing standing between this and a silent drop.

⛔ #16746 RELEASED back to the queue — ⛔ do not read the earlier "in flight" row as current

p1, ruling in hand, not a merit stop. The round confirmed all three Zone-2 assumptions and the card's premise (a permissionless caller gets 403 on GET /api/v1/meta/apps/setup), then falsified this seat's suggested route by exhaustive measurement of the lever space: dropping group_integrations' gate alone changes nothing (the app-level gate fires first); dropping setup.access alone still does not reach the card and already serves 14 other Setup entries to every signed-in user; only dropping both reaches connect_agent, and it serves those 14 alongside. ⇒ hard stop 3, measured.

The one defect-free fix is a navigationContributions entry inside CONNECT_AGENT_UI_BUNDLE (packages/mcp/src/connect-ui.ts, app account, group grp_account_developer) — it registers exactly when the page registers, so it needs no gate. That is domain:cli ⇒ hard stop 1 ⇒ released with Release: line + pm:retriage (5627142970).
⭐ Worth keeping: requiresService 'mcp' is strictly weaker than the page's registration condition — plugin.ts:270 registers the service unconditionally while the UI bundle at :628 sits behind isMcpServerEnabled() — so an account.app.ts entry gated that way 404s for every signed-in user on an opted-out deployment.

R1 ledger — landed 0, released 1, re-dispatched 1, retriaged 6

⛔ Zero landings so far is honest: two of the three first-batch cards returned measurements that falsified their dispatch premise, which is the third-tier dispatch working, not a failure. ⛔ Never re-file either as a rework.

Not dispatched, and why — established card-by-card

• Phase 1b of #11333: make the registered granted-permission set actually REFUSE — the ADR-0025 materialize seam that gives each plugin its own SecurePluginContext #17147 (p1) — ⛔ NOT dispatchable; pm:retriage raised. The card asks a dev to build the ADR-0025 materialize seam, which maintainer ruling 5486840233 (2026-09-01, comment on Phase 1 of #11333: wire granted_permissions into PluginPermissionEnforcer (F4) as the load-time gate #13457) fences verbatim: 「The materialize seam (per-plugin context construction) belongs to the ADR-0025 install-flow design work, ⛔ not to be improvised inside either half.」 Relocating that work into a third card does not discharge the fence. Building it is the maintainer floor (ADR + security boundary). Triage's grading comment 5620285623 does not mention the ruling. ⇒ dissent filed (5626888839), grade is triage's to change. Card now carries pm:retriage.

• driver-memory cards (On driver-memory a time-triggered flow that touches per-organization data has NO legal configuration — PR #17334 moves it from the served case into the refused one #17446 · driver-memory answers a text operator over a DECLARED temporal column by matching its canonical ISO text — the opposite of #15683's declared-type answer, and the existing pin passes for the wrong reason (a millisecond mismatch) #17348 · driver-memory analytics generateSql() reads neither granularity nor dateRange, so /analytics/sql echoes a statement the pipeline never ran — and accepts an hour that query() now refuses #17301 · driver-memory: the stored-ARRAY value axis is still unrepaired outside the equality arm — $in/$nin, the text family and the ordering family answer one filter two ways, and the two exclusion arms answer it in the WIDENING direction #17286 · driver-memory / driver-mongodb execute() answer without running the command and without refusing — a declared, NON-optional contract member that no caller can tell apart from "ran and found nothing" #14082) — ✅ SETTLED this round, and the dissent was answered in the direction asked.
  R1 dissented that [裁决] driver-memory / driver-mongodb 投入冻结 —— 维护者 2026-08-05 口径（跨单锚点） #5499's exception channel reads 「由分诊轮点名升级」 so the four grading comments could not legally route the call to the taker. Triage placed the four on pm:on-hold; R1 then measured the stopgap proxy criterion at ~52× too narrow (6 files vs 318; packages/objectql alone 21) and filed Every card held under the #5499 driver-memory freeze has no fireable wake condition — the anchor is tracking and never closes, the freeze's stated wake has no card, and the sole existing hold carries no Restart-when: at all #17587 to the decision box. ⇒ Director seat ruled option 2 (第 22 场一类自裁 5634032076, 2026-09-11T11:53Z): [裁决] driver-memory / driver-mongodb 投入冻结 —— 维护者 2026-08-05 口径（跨单锚点） #5499 carries one executable wake criterion and every hold under it quotes that line verbatim. ⛔ No hold may invent its own proxy again.
  ⭐ The execution is done and read back — see 「Every card held under the #5499 driver-memory freeze has no fireable wake condition — the anchor is tracking and never closes, the freeze's stated wake has no card, and the sole existing hold carries no Restart-when: at all #17587 执行完毕」 below. All five now carry the identical 232-byte line; today's reading is 141 ⇒ non-zero ⇒ ⛔ the freeze's 「整批 not planned 关闭」 cannot fire.
  ⭐⭐ And the channel demonstrably works when triage opens it: on The shared dateRange conformance kit has no ARITY case, so an odd-sized array arm is governed nowhere — and driver-memory's cube face drops such a window entirely #17596 (2026-09-11T02:1xZ) triage did name the escalation, lifting that card's driver-memory half out of the freeze by the exception clause. ⇒ the R1 dissent's premise — that the channel is real but was being routed to the wrong actor — is confirmed by triage's own later act.

• Two hand-written copies of the admission tenancy-posture classification remain after #16013 — resolve-execution-context.ts and mcp/plugin.ts (the kernel branch only) #17114 / A ONE-element dateRange array is schema-valid and means two different windows: ObjectQLStrategy degenerates it to the point [start, start], the draft-preview face leaves the upper bound open #17124 — ⛔ pm:retriage, both mis-anchored to this lane, measured: Two hand-written copies of the admission tenancy-posture classification remain after #16013 — resolve-execution-context.ts and mcp/plugin.ts (the kernel branch only) #17114's two fold sites are packages/runtime + packages/mcp, both domain:cli (only the consumed classifier is engine-side) ⇒ re-route makes it single-lane, not cross-domain; A ONE-element dateRange array is schema-valid and means two different windows: ObjectQLStrategy degenerates it to the point [start, start], the draft-preview face leaves the upper bound open #17124's ObjectQLStrategy is defined in packages/services/service-analytics/src/strategies/objectql-strategy.ts ⇒ domain:services, the lane charter's 「⛔ 绝不从 issue 标题的词汇猜域」 trap firing on the token ObjectQL.

• Seed loader never removes rows, so switching a stack's active locale leaves the previous locale's dataset resident alongside the new one #16596 — R3 recorded its deliverable as a ruling, examined three times and routed to the maintainer. Not re-examined this round.

• driver-sql: store the file family (file / image / avatar / video / audio) as the bare sys_file id in a string column — drop FILE_REFERENCE_TYPES from JSON_COLUMN_TYPES, per-deployment switch on the adr-0104-file-references flag (ruling on #15041, step 2) #15989 — open and deliberately UNGRADED on pm:*. Its column step is held, not dropped (the ADR's own step-3 SQL would silently destroy data: USING (col #>> '{}') extracts any json type as text, so it cannot honour "abort on the first cell that is not a JSON string"). Three re-grade candidates at 5618900154. ⚠️ Changing its grade needs maintainer authorisation this seat does not hold.

Half-state patrol anchor (#9857) — read at seating, sweep 2026-09-10T19:46:50Z

No rendered H row names a domain:engine card, PR, or this seat post. The only lane mention is #13457 appearing as a blocker target inside #11333's H19/H26 rows. ⚠️ This is a LOWER BOUND, not a clean bill: the sweep found 316 half-states and the body trim rendered 19, omitting 297 (H19 8/24, H52 5/31, H9 0/15, …). The omitted rows live only in the workflow run log.

⚠️ Anchor-wide, unrelated to this lane but recorded because it degrades every row: H22's rate premise has drifted — the sweep observed ~148.9 closed-issue updates/day against a pinned 415.1/day (factor 0.36, outside the 2× band), so H22's stated day-reach is misdescribed by that factor. ⛔ A sweep never overwrites the pin; it needs a hand re-measure. Not this lane's to fix.

⚠️ Standing caution carried forward

#13457 must NOT be closed until #13458 re-points its Blocked-by: at #17147. #13457 is assigned to os-sam and is not this seat's to touch.

3. Hot-file serial queue — 2026-09-10T23:3xZ

file	held by	next in line
packages/drivers/driver-sql/src/sql-driver.ts	— (#17277 landed 88a933088e)	#17690 if triage grades it — the 9-door census remainder
packages/drivers/driver-turso/src/turso-driver.ts	—	#17690 (4 of the 9 are Turso overrides)
packages/metadata-protocol/src/protocol.ts	#17290 (in flight, 2026-09-11T12:5xZ)	#17167 (organization probe 'unknown error') — ⛔ do not dispatch until #17290 lands
packages/core/src/utils/analytics-date-range-conformance.ts	#17596 (in flight, 13:2xZ)	—
packages/drivers/driver-memory/src/memory-analytics.ts	#17596 (in flight)	— ⛔ rest of the package stays frozen under #5499

⚠️ 2bed4c328d (#16319, R3's landing) touched both sql-driver.ts and protocol.ts earlier today — same-day churn. Both premises were re-verified against origin/main at f721ef0ff2 before dispatch, ⛔ not against the card text.

4. Notes — lane disciplines that are current

Measurement

• ⭐⭐ A control that FAILS to fire voids the reading. R3 needed three attempts before one fired on a skip/quarantine sweep; the first two returned 0 themselves and would each have let a "0 added" claim stand on no evidence.
• ⭐⭐ A number produced by a bad parse is not a reading, and printing it does not make it one. R3 produced three: a false parent count of 11 (%H %P %s + awk — the parent list and the subject both contain spaces; use git show -s --format='%p' <sha> | wc -w), a docs sweep of 117 that conflated three different type vocabularies, and an "old behaviour gone" count that read higher on main than on base because the landed code carries comments naming the expression it replaced. ⛔ Separate code from comments before counting either.
• ⭐⭐ A number must name its population. The changeset's 388 was correct — matching lines under driver-sql/src/. Because it never said so, three readers computed three different correct numbers (dev 371/372, seat 405).
• ⭐ $? after a pipe is the pipe's LAST stage. cmd | head reports head's status. This seat re-committed that error twice in one shift after warning devs about it. Redirect to a file instead.
• ⭐ Exit code 3 = PREREQUISITE NOT MET — nothing was measured. ⛔ Never a pass.

Reading CI

• ⭐⭐ Judge a red by the whole run's conclusion + a per-head tree comparison. ⛔ Never the check NAME — and the name misleads in both directions. Temporal Conformance (live PG + MySQL) actually runs the whole driver-sql suite (ci.yml:1316 step name, :1300 comment), with OS_EXPECT_LIVE_DIALECT_MATRIX=1 turning a missing server into a red rather than a skip. ⚠️ A cancelled run can still hold a job whose own conclusion is failure.
• ⭐⭐ Directory byte-identity proves nothing across a workspace edge. R3's first red had packages/runtime byte-identical to its base while the failure was 100 % the PR's — the fixture that tripped the door was imported from another package. The recorded "not ours" lane pattern needs both its limbs; one limb firing means the assertion decides.
• ⭐⭐ PR-side CI runs the affected subset; the merge queue runs the FULL suite. R3's queue build failed on packages/qa/dogfood, which the PR's own CI had never exercised. ⛔ Green PR CI is not evidence a class is clean.
• ⚠️ A merge-queue failure can be a semantic collision the queue itself created — two branches, each sound alone, meeting for the first time. Fix it in the PR being landed; the queue tests the combination.

Census discipline

• ⭐⭐ A census that misses a whole class usually has a wrong PREDICATE, not a lazy author. R3's first census cross-referenced the literal token registerObject(, so every registration arriving through registerApp or a plugin manifest was invisible, and its hand-written vocabulary lacked checkbox. Its "0 reach a door" was honest and wrong. ⛔ Ask which doors a zero covered before believing it. A sound census enumerates the door set from code and follows importers — the fixture that broke the queue carried no door token at all.
• ⭐ A card's own body under-counts the fix surface, and so does the seat's own sweep. [finding] driver-sql and both migration generators default an absent or unknown field type to DIFFERENT families — string versus text, so the unvalidated authoring door produces two different columns #16319's body said "one character each side"; triage said 4 on the generator side; this seat measured 7 on the driver side and 7 was wrong in both directions (真数 11 — it missed the ?? spelling — plus 2 introspection sites that are a different question). ⛔ Never hand a hand-rolled half-census to a dev as authoritative while telling them to census.
• ⭐⭐ A discovered error triggers a sweep of its own CLASS.
• ⭐⭐ Read the newest state TRANSITION, not the newest MENTION of a blocker. A replaced blocker and a discharged one look identical in a thread.

Filing

• ⭐ A pin that can turn itself red is its own carrier. R3 declined to file a card for the driver-side membership arm and for a dead case 'string': arm, on that ground. The door then caught a mis-spelled field type written the same day by another author, in the merge queue, before it reached anyone — a card would have carried nothing CI does not shout.
• ⭐⭐ An Execution paragraph is authoritative about INTENT, not immune to being wrong (driver-sql: store the file family (file / image / avatar / video / audio) as the bare sys_file id in a string column — drop FILE_REFERENCE_TYPES from JSON_COLUMN_TYPES, per-deployment switch on the adr-0104-file-references flag (ruling on #15041, step 2) #15989: following it literally would have destroyed data).
• ⛔ Never let a dev take the cheap ADR-0087 disposition unmeasured.

Channel readings — ⛔ one call each, not rules

• DELETE /issues/{n}/assignees answers 415 without Content-Type: application/json. Looks like permissions. Is not.
• enable_pr_auto_merge's echo, the REST auto_merge.merge_method field and the webhook all three report merge for a squash landing. ⭐ Mechanism, found in R3: the repo sets allow_merge_commit=False / allow_squash_merge=True, so that value names a method this repo forbids — squash is the only reachable one. ⛔ The parent count remains the only instrument.
• ⭐ auto_merge reads OFF once the queue takes ownership. That is the expected post-enqueue state, ⛔ not evidence the arm failed — this seat misread it once and built a false "the tool reports success while doing nothing" theory on an empty field in the echo. Verify queue membership by the TIMELINE.
• GH006: a branch in a merge queue cannot be pushed to. A dev that finds a newer main mid-run must leave the merge unpushed rather than dequeue.
• Queue timing, 6 landings: enqueue lag 30 s–3 min; enqueue → merge 25m04s / 25m10s / 25m35s / 29m17s / 27m10s.
• The docs-drift bot's emitter-vs-inputs blind spot fired repeatedly. ⛔ A green drift check is not a clean bill of health.

R1 measurement lessons (2026-09-11)

• ⭐⭐ Read CI as the LATEST run per check name. A check-runs listing returns every historical run, so counting raw conclusions over-reports red. This seat reported fix(driver-sql): a multiple: true boolean column keeps its $contains membership filter (#17343) #17577 as "4 non-green" when it had one — the three Check Changeset rows were superseded runs and the newest was already success. ⛔ Group by name, take max started_at, then judge.
• ⭐⭐ The Clause-② line must be in the PR BODY, at column 0. Check Changeset reads it there and never reads the claim comment. All three of R1's PRs shipped without it and all three went red on a declaration this seat had already made. ⇒ every dispatch order must say so. ⭐ The gate re-reads on the edited event, so the red clears with no push and no re-run — a body edit is the whole remedy.
• ⭐⭐ A REST PATCH to a PR body appends the platform's own footer — and POST (create) does NOT. Refined on fix(core, driver-memory): one reading of the dateRange array arm — an ARITY case in the conformance kit, and the cube face stops dropping the window #17694: REST create stored the author's footer byte-identical and appended nothing; REST edit appended the platform block on top of the existing one, leaving two. ⇒ the hazard is the edit verb specifically. Strip every footer from the body you send, then read back and confirm exactly one. This seat produced a duplicate on fix(metadata-protocol): serve a real JSON Schema for action from /meta/types #17580 doing precisely what a dev had already documented as a hazard.
• ⭐ A PR-body edit is CHEAP and its check movement is benign — know both halves. It re-runs only Check Changeset, ⛔ not the pipeline, so a body fix costs no CI cycle. ⚠️ But it also flips Auto Label and Check PR Size from success to skipped, because they stand down on an edited event. ⇒ ⛔ that pair going skipped after a body edit is not a regression; measured on fix(core, driver-memory): one reading of the dateRange array arm — an ARITY case in the conformance kit, and the cube face stops dropping the window #17694.
• ⭐⭐ A CI gate can be driven LOCALLY before pushing, and the round that did it saved a red cycle. On fix(core, driver-memory): one reading of the dateRange array arm — an ARITY case in the conformance kit, and the cube face stops dropping the window #17694 the dev ran node scripts/check-changeset-no-major.mjs --base origin/main --event EVENT with the real PR body in a synthesised payload: exit 1 on the old grade, exit 0 on the new one — the failure reproduced and the fix proven before the push. ⇒ ask for this shape whenever a gate script is the thing that went red.
• ⭐⭐ premise_still_valid: false + pr: null is a legitimate terminal report. It happened twice in R1 (metadata-protocol: /meta/types serves an EMPTY JSON Schema for action — the output-mode derivation of its ZodPipe has no properties, and the hand-crafted fallback never fires #17501's C ruling, Setup → Connect an Agent is admin-only, but POST /api/v1/keys mints per-user keys for anyone — the "acts as you" self-service promise cannot be kept by non-admins #16746's route) and both were correct — the measurement killed the dispatch premise before any code was written. ⛔ Never re-file as a rework, never count as a failed dispatch.
• ⭐⭐ Zone-2 assumptions must be labelled as readings vs. measurements, and devs must be told to refute them. R1 shipped one wrong file name (plugins/organizations/… for plugin-security/claim-seed-ownership.ts) and the dev caught it because the order said "my reading of the card's prose, not my measurement". ⛔ An unlabelled assumption is indistinguishable from a fence.
• ⚠️ The seat's own slip, recorded: a full label-set PUT re-asserts domain:*. Closing Every card held under the #5499 driver-memory freeze has no fireable wake condition — the anchor is tracking and never closes, the freeze's stated wake has no card, and the sole existing hold carries no Restart-when: at all #17587 this round the seat used PUT /labels with the whole target set — which includes domain:engine — instead of the single-label DELETE. ⛔ Net effect was nil (read-back identical but for the intended removal), but the rule exists so a seat cannot regrade by accident, and the instrument was the wrong one. The three claims that followed used DELETE + POST.
• ⭐ A lane inventory taken at the START of a shift is not the lane at the END of one. R3 reported 0 dispatchable while triage graded ~18 cards into the lane during its shift.
• ⭐ Several lane cards anchor on packages belonging to OTHER lanes, and the token in a symbol name is the usual cause — ObjectQLStrategy lives in packages/services/service-analytics, and packages/runtime is domain:cli, not engine. ⛔ Re-measure the definition site before claiming; 「绝不从 issue 标题的词汇猜域」 extends to class names.

Standing cautions

• ⚠️ Phase 1 of #11333: wire granted_permissions into PluginPermissionEnforcer (F4) as the load-time gate #13457 must NOT be closed until Phase 2 of #11333: retire the legacy string[] arm of manifest.permissions (major, standard retirement route) #13458 re-points its Blocked-by: at Phase 1b of #11333: make the registered granted-permission set actually REFUSE — the ADR-0025 materialize seam that gives each plugin its own SecurePluginContext #17147.
• [裁决] driver-memory / driver-mongodb 投入冻结 —— 维护者 2026-08-05 口径（跨单锚点） #5499 freeze on driver-memory / driver-mongodb — ⭐ read its exception clause before fencing.
• ⚠️ ⭐ /tmp/claude-0 is SHARED across parallel devs and same-named files collide silently. Every dispatch order must require a per-issue scratchpad path for gate output.
• ⛔ Seats never write domain:*, never grade a card their own lane filed. ⭐ Use the single-label DELETE when clearing a label — a full label-set replace re-asserts domain:*.
• Governed surfaces (docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md) — exactly those five. content/docs/releases/ is not among them (the rule is real but hookless), and packages/spec/** is lane ownership, not governance.
• This repo runs no Claude Approvals check, and has no steward/ or babysit/ skill.
• ⚠️ Stale facts written into a standing instruction recur every hour and look like compliance. ⛔ 「it's about to be disabled anyway」 is an excuse this seat used twice in R3 before correcting the patrol prompt.

_{Seat post body rewritten at 2026-09-10T23:3xZ by the incoming domain:engine seat · session_01RuoNSXUbBoWHkNS4AknTrM · R1 seating. Sections 1–3 are this seat's readings; section 4 is carried forward from R3 verbatim.}