[objectstack-fleet]

Requested by Elon · project thread

domain:skills#2 · os-elon-musk · session_016WV4czYNVYrGQqbs51hpvv

Fixes #28024

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：契约复核记录「审的是哪个 head」现在只从它自己 ## Contract review 题头之下、第一条不带引用块、不带列表符、不在代码围栏里的 Head-sha: 行读；题头之前、引用、列表、围栏里的 Head-sha: 行一律当散文。写入侧 post-stamped.mjs 在发评论前就拒收「带 Head-sha 键但读器读不出 head」的记录。规则文 contract-review.md:33 点名这一行。4 个文件，+141/−32，无新门禁。
• 为什么改：PR fix(pm): a contract-review record reviews only the head on its Head-sha line, never a head its prose names #28023 之后读器取的是全文第一条 Head-sha: 键行，且容忍引用块和列表符。于是一条引用别人记录的 > Head-sha: B 若排在自己那行之上，记录就被读成「审过 B」（复核探针实测：在 B 找到、在真 head 缺席）。这是三条 should-fix 里唯一能放进错 head 的一条，另两条是让作者早点知道。
• 风险与回滚：只收紧不放宽。实测 2026-10-23 至 30 的 709 条题头记录：707 条本来就是题头下的裸行，2 条无 Head-sha 键（已知旧写法，PR 已合并），0 条在新读法下读数改变。读不出的记录读为「无 head」，补发一条正确的记录即可；写入侧的拒收会在发出前就说明哪一行坏了。回滚即 revert。
• 先看：scripts/pm/check-half-states.mjs 的 contractReviewHeadSha 与 CONTRACT_REVIEW_HEAD_SHA_LINE（所有读者只经这一个函数取 head）；scripts/pm/post-stamped.mjs 的 recordKeyedLineRefusals（导入同一读器，不重拼）；.claude/skills/pm-dispatch/references/contract-review.md:33。
• 两分钟验证：node scripts/pm/check-half-states.mjs --self-test && node scripts/pm/post-stamped.mjs --self-test，预期两者 exit 0（5102 与 743 例），其中含「引用行在上、真行在下：在引用 head 缺席、在真 head 找到」的钉子。
• 需要你做的：无。本 PR 触及 .claude/** 受管规则文，欠一轮契约复核（席位安排，CONTRACT_REVIEW_TIER）；落地档位以登记册为准（check-governed-merges.mjs --test 读为 Tier S，--pr 在 PR 上再读一次）。

What changes

Follow-up to PR #28023 (#27979), closing its review's should-fixes 1–3. Triage ruling: edge 1 is the one that can admit a wrong head; edges 2 and 3 are loudness; no new gate.

• Edge 1 — the reader (scripts/pm/check-half-states.mjs). contractReviewHeadSha(body) now returns the span on the FIRST Head-sha: line BELOW the record's own ## Contract review heading (read with CONTRACT_REVIEW_HEADING_MARKER, blockquoted heading included, exactly as the locator finds the record), skipping every line inside a fenced code block (three or more backticks or tildes; an unclosed fence runs to the end, as it renders). CONTRACT_REVIEW_HEAD_SHA_LINE drops the blockquote and bullet tolerances the keyLineRegex convention keeps for Served-tier:, Reviewed-by: and Local-runs:: those values describe the record; this line decides which head a PASS clears, and a quoted or bulleted Head-sha: line is one the author cited rather than wrote. Bold and backticks on the key, a trailing span on the line, and CRLF still read. Every reader reaches the head through this one function — latestContractReviewOnHead (H43), locateReviewOfRecord, owed-reviews recordReading, the queue guard's recordVerdict — so they move together; no other file changes a predicate.
• Edge 3 — the write side (scripts/pm/post-stamped.mjs). recordKeyedLineRefusals refuses a ## Contract review comment that carries a Head-sha key anywhere (case-blind presence test) for which the imported contractReviewHeadSha reads null, before the write and beside the existing Local-runs: row; a record with no key at all is not re-judged (the two retired-dialect records carry none). RECORD_KEY_SPELLINGS prints the accepted shape; the refusal names the owner. Imported from check-half-states.mjs, which the file already imports at module scope — no new edge, no cycle (both self-tests that load the graph pass).
• Edge 2 — the rules text (.claude/skills/pm-dispatch/references/contract-review.md:33). 「head sha 独占码段」 becomes 「Head-sha: 行独占码段」. 60 lines before and after; the line is 117 bytes under the 120-byte cap.
• Pins. H51 battery (check-half-states.mjs): the four probe shapes from the fix(pm): a contract-review record reviews only the head on its Head-sha line, never a head its prose names #28023 review — a Head-sha: line naming another head placed before the heading, blockquoted, bulleted, fenced, each above the record's own — read absent at the cited head and found at the real one; a quoted, bulleted or fenced line alone, a line with no heading above it, and a line inside an unclosed fence name no head; tilde fence and CRLF. Locator battery (record-recognisers.mjs, floor 10 to 13): the same shapes through locateReviewOfRecord on the PR thread and the card. post-stamped.mjs battery (floor 9 to 17): each unreadable shape refused, the quoted-above-real shape passes, absent not re-judged, both rows together, the structural import pin now covers both readers.

Tests

Self-tests on the committed head fd3f1f3e, exit codes captured before any pipe:

Command	Exit	Cases
node scripts/pm/check-half-states.mjs --self-test	0	5102 (5089 on the base of #28023)
node scripts/pm/record-recognisers.mjs --self-test	0	336
node scripts/pm/post-stamped.mjs --self-test	0	743 across 26 batteries
node scripts/pm/check-owed-reviews.mjs --self-test	0	65 in 9 batteries
node scripts/pm/check-governed-queue-guard.mjs --self-test	0	403

Ablations, one per new leg, through scripts/ablation-replace.mjs (anchor hit 1 to 0, blob hash moved, restored to the HEAD blob with git diff HEAD empty on every leg):

Leg	Mutation	Red pins
heading scope	let belowHeading = true	half-states 3 of 5102, recognisers 1 of 336 (the pre-heading pin), post-stamped 1 of 743
blockquote / bullet refusal	(?:>[ \t]*)?(?:[-*][ \t]+)? restored into the key regex	half-states 3, recognisers 2, post-stamped 4
fence skip	if (fenced && false) continue	half-states 4, recognisers 2, post-stamped 1
write-time refusal	if (false && …) in recordKeyedLineRefusals	post-stamped 5 of 743

A first attempt at the heading-scope leg mutated the assignment inside the loop (belowHeading = true; continue), which also skipped the first line and so stayed green; it was discarded and re-run as the initialiser mutation above. Both runs are in the report.

Acceptance notes

• Measured before changing the accept set (REST issues/comments?since=2026-10-23, 113 pages, 11,236 comments, at origin/main e1dde1a5c): 709 bodies with a line-initial ## Contract review; 707 carry their first readable Head-sha: line plain and below the heading; 2 carry no Head-sha key (6360650327 on PR fix(plugin-auth)!: a cloud-managed environment refuses local self-registration, invitations (resends included), user creation and import, and sets passwords only on local accounts #25399, 6397040906 on PR fix(mcp,runtime)!: the stateless /api/v1/mcp answers GET and DELETE with 405 Allow: POST #25774 — the retired dialects, both PRs merged); 0 blockquoted, bulleted, bold-key, backticked-key, fenced or pre-heading first lines; 0 blockquoted headings; 1 body with more than one Head-sha key line (the fix(pm): a contract-review record reviews only the head on its Head-sha line, never a head its prose names #28023 review record, whose prose names the key mid-sentence; its first line is the real one). 0 records read differently under the new reader.
• keyLineRegex still tolerates blockquote and bullet for Served-tier:, Reviewed-by: and Local-runs:; only the head line is stricter, for the reason in its docblock. Not changed here.
• The template's null-oid placeholder is 40 hex and reads as a head, so post-stamped does not refuse a pasted template; C6 refuses it at the locator, as before.
• Scope: exactly the four files the claim names (record-recognisers.mjs for pins only). No production predicate outside check-half-states.mjs and post-stamped.mjs moved.
• skip-changeset: scripts/pm/** and .claude/** only, nothing published.

Verification

Local gates on the committed head fd3f1f3e, from a second worktree at the same commit (pnpm install --frozen-lockfile --ignore-scripts, then turbo run build --filter=@objectstack/formula --filter=@objectstack/lint for the formula gate), exit codes captured before any pipe:

• node scripts/pm/dispatch-gates.mjs --commands derived 56 families for the 4 changed paths (+141 / −32, under the human-merge threshold).
• All 56 ran and exited 0 — among them check:pm-half-states, check:pm-post-stamped, check:pm-record-recognisers (recognisers + owed-reviews + mailbox-open + fleet-roster self-tests), check:pm-governed-merges, check:pm-dispatch-gates, check:pm-skill-id-lint, check:pm-skill-ratchet (the line budget and the 120-byte line cap), check:skill-frame-sync, check:commit-card-trailers, check:nul-bytes, check:scripts-symbol-anchors.
• node scripts/pm/dispatch-gates.mjs --ran ran.txt: 56 derived, 56 run, 0 NOT-MEASURED, 0 UNRUN (exit 0).
• pnpm lint (the repo-wide ESLint sweep) is CI-owned and was not run locally; read it off the PR check-runs.
• Landing tier: node scripts/pm/check-governed-merges.mjs --test on the four paths answers Tier S (.claude/** ×1, the three scripts/pm/** paths not on the register); the seat reads --pr on this PR.

---

Generated by Claude Code

[objectstack-fleet]

domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS

Contract-review-claim: session_016WV4d1QkPVVzNz3FJqb2iS · head fd3f1f3 · 2026-10-30T10:27Z

[objectstack-fleet]

domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS

Contract-review-claim: session_016WV4d1QkPVVzNz3FJqb2iS · head 2e75b19 · 2026-10-30T10:42Z

[objectstack-fleet]

domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: fd3f1f3ef3a7211bc436ffa1cc9482357c66133f
Local-runs: probe — the five scripts' own --self-test batteries on the head, four ablation legs (each restored with git checkout, git status --porcelain empty), and a read-only reader probe (28 synthetic bodies plus the live PR #28023 and PR #27964 threads, driven through the four readers in a head worktree and an origin/main worktree) were executed locally, because the card's wanted item 1 is a behavioural claim about the readers that no check-run prints; the register, the skill-id lint, the line ratchet and the token ratchet were run read-only beside them
Scope: .claude/skills/pm-dispatch/references/contract-review.md (:33) + scripts/pm/check-half-states.mjs (CONTRACT_REVIEW_HEAD_SHA_LINE :12668, FENCE_LINE :12679, contractReviewHeadSha :12711, contractReviewHeadMatch :12764, latestContractReviewOnHead :12781, H51 pins :33506-33521), scripts/pm/post-stamped.mjs (RECORD_KEY_SPELLINGS :2062, HEAD_SHA_KEY_ANYWHERE :2069, headShaKeyLine :2072, recordKeyedLineRefusals :2092, recordLineRefusalText :2105, CLI wiring :3894, battery :5300-5324), scripts/pm/record-recognisers.mjs (battery floor :2073, pins :2235-2246); read but not reviewed: scripts/pm/record-recognisers.mjs (keyLineRegex :534, locateReviewOfRecord :1991, --template), scripts/pm/check-owed-reviews.mjs (recordReading :196), scripts/pm/check-governed-queue-guard.mjs (loadRecordRecognisers :887, recordVerdict :965), CONTRACT_REVIEW_HEADING_MARKER (check-half-states.mjs :12624)

① Derived judgments

Base is origin/main at e1dde1a5c (merge base; the branch is the single commit fd3f1f3ef; origin/main has since moved to 5aee20654 with no touch of the four files). node scripts/pm/check-governed-merges.mjs --pr 28042 on the head: 1 of 4 paths hits the register (.claude/**), Tier S, size 173 lines under the human-merge threshold; the three scripts/pm/** paths are off the register. The register and the PR body agree. Every claim the diff makes, judged against the tree and by running it:

1. The reader's three positional rules. contractReviewHeadSha (:12711) walks the body split on \r?\n; a line matching FENCE_LINE (three or more backticks or tildes with up to three spaces of indent) toggles fenced and is skipped; a fenced line is skipped; until a line matches CONTRACT_REVIEW_HEADING_MARKER (blockquoted heading admitted, ### refused) every line is skipped; among the lines that remain the FIRST matching CONTRACT_REVIEW_HEAD_SHA_LINE wins. The key regex (:12668) drops the optional blockquote-marker and list-bullet prefixes the base carried and keeps bold, backticks, leading whitespace and the value half ((?:[ \t]|\*\*)* then H51_SHA_SPAN.source, so the g flag is not inherited). contractReviewHeadMatch and latestContractReviewOnHead are untouched and still reach the head through this one function. TRUE as the PR body and the docblock state.
2. One shared definition. At the head, by grep over scripts/pm: latestContractReviewOnHead (H43 via h43HandoffReading), locateReviewOfRecord (record-recognisers :1991, importing contractReviewHeadMatch), recordReading (check-owed-reviews :196, through locateReviewOfRecord) and the guard's recordVerdict (:965, through the lazily loaded locate) all reach the head through contractReviewHeadSha; post-stamped now imports it too. No second parser; no other production predicate moves. TRUE.
3. The core question, answered by execution. A probe (scratchpad probe.mjs) imported the four modules from a worktree at the PR head and from a worktree at origin/main, built 28 synthetic bodies and the live PR fix(pm): a contract-review record reviews only the head on its Head-sha line, never a head its prose names #28023 (4 comments) and PR feat(spec,metadata-protocol,rest,objectql,runtime): GET /meta/object serves switched-off packaged actions beside the item, and the disabled-action refusal reads as a plain sentence #27964 (10 comments) threads fetched by REST, and drove each through contractReviewHeadSha, latestContractReviewOnHead, locateReviewOfRecord, recordReading and recordVerdict (recognisers from loadRecordRecognisers(), a .claude/** Tier S path, repo objectstack) at head A 8216bec4 and cited head B b3d92fee. At the PR head:
   • the four ruling shapes, each naming B ABOVE the record's own A line: blockquoted, bulleted (- and * **bold**), fenced (backtick, tilde, fence indented three spaces, blockquoted fence) and pre-heading: every reader answers null / absent / stale / absent at B and A / found / current / stands at A. On base every one of them read B (found at B, absent at A). CLOSED, exactly as the PR body states.
   • B under an earlier ## Summary heading, B under a nested ### Contract review, a second ## Contract review section naming B AFTER the record's own: absent at B, found at A on head (base read B for the first two). CLOSED.
   • a fully blockquoted record on B: names null on head (base named B, and with a quoted Reviewed-by: would have been found at B). A quotation alone now contributes no head. CLOSED.
   • CRLF record, CRLF with a quoted B above own A, own A with trailing prose naming B, prose mentioning the key mid-sentence above own A, a one-space-indented own line, an unclosed fence, B only in prose: all read as the PR body says.
   • template-shaped record (contractReviewTemplateLines({ headSha: A })): found at A, absent at B. Live PR fix(pm): a contract-review record reviews only the head on its Head-sha line, never a head its prose names #28023 record 6518659368 at its real head 40b5a25e: H43 6518659368/PASS, located found, owed current, guard stands; at a wrong head: absent / stale / absent. Live PR feat(spec,metadata-protocol,rest,objectql,runtime): GET /meta/object serves switched-off packaged actions beside the item, and the disabled-action refusal reads as a plain sentence #27964 full thread at b3d92fee: found 6516322954; at 8216bec4: found 6516042954; truncated before 06:15Z at b3d92fee: null / absent / stale / absent, at 8216bec4: found 6516042954. Identical readings on base for every live case. No live record reads differently.
   • RESIDUAL, named B on the head AND on base (no regression, not loosened): a Head-sha: line inside an INDENTED code block (four spaces or a tab) above own A; a nested fence (four-backtick outer, three-backtick inner, B inside) and a mismatched-character fence (backtick open, tilde line inside) — FENCE_LINE toggles on any fence line regardless of character or length, so a line that CommonMark renders as fence content is read; and an unquoted paste of a record on B placed before the author's own heading (first section wins, which the self-test pins as the rule). Should-fixes 2 and 3.
   • RESIDUAL, read DIFFERENTLY on the head (the one shape this PR reads worse than base): a fully blockquoted, signed record on A (the heading, the head line and the Reviewed-by: line each carrying the blockquote marker) followed by a plain prose line opening Head-sha: B. Base read A (the quoted line, a head the quoted record did review); the head reads B and locateReviewOfRecord answers found at B, signed through the quoted Reviewed-by: that keyLineRegex still tolerates. Cause: the blockquoted heading opens the scope (CONTRACT_REVIEW_HEADING_MARKER admits the blockquote marker, and the docblock keeps it "exactly as the locator finds the record"), the quoted head line is refused, and the reader falls through to the next plain key line. The seat's corpus measured 0 blockquoted headings in 709 records; no protocol line (Contract-review-claim, -handoff, -hold) spells the head as Head-sha:; post-stamped would not refuse it (it reads B). Not blocking: it needs the author to write the record's own key line as prose under a quotation, a shape the previous review graded should-fix at p2 in its more natural form. Should-fix 1.
     So after this PR no reader admits a PASS for a head named only on a quoted, bulleted, fenced or pre-heading Head-sha: line, on a line after a nested or earlier heading, or in a second section after the record's own; the accept set is the same or narrower than base in 27 of 28 probed shapes and wider in the one shape above.
4. Edge 3, the writer. recordKeyedLineRefusals (:2092) keeps the record-only scope (CONTRACT_REVIEW_HEADING_MARKER.test(text) first), then refuses when HEAD_SHA_KEY_ANYWHERE (/head-sha[ \t]:/i, presence anywhere) matches and the IMPORTED contractReviewHeadShareads null; theLocal-runsrow follows; both rows are returned together,Head-shafirst. Driven on the head (scratchpadrefusal-probe.mjs): quoted-only, bulleted-only, fenced-only, pre-heading-only, key-in-span, bare hex, lowercase key, Head-Sha, six-hex span: each refused with the offending line quoted and RECORD_KEY_SPELLINGS['Head-sha'] printed; no key at all: untouched; an ordinary comment, an os-dev-report JSON and a triage-style comment mentioning the key mid-sentence with no line-initial heading: untouched; record 6518659368 (key mentioned mid-sentence many times, own line plain) and every other live comment on both threads: untouched. The structural pin reads the CLI wiring (options.mode === 'comment', :3894) and both imports off the file's own source, and asserts no function contractReviewHeadShais restated. The import is one name added to the./check-half-states.mjsimport list post-stamped already carried at module scope (base :965);check-half-states.mjsimports only./seat-record.mjsamong pm siblings, so no cycle; module load of post-stamped measured 138 ms on head against 137 ms on base. TRUE. One loudness false positive, not an admission: a comment that quotes a record's heading at line start and mentionsHead-sha:` in prose with no plain line is refused at write time (should-fix 4).
5. Edge 2, the rules text. contract-review.md :33 「同形 = ## Contract review 题头、Head-sha: 行独占码段、①②③ 逐项、独立性对、PASS/FAIL。」 is true against the new reader (the head is read off the Head-sha: line's own span and nowhere else) and matches the key-line style :36 already uses. Line count 60 on head and on base (wc -l); the line is 117 bytes under MAX_LINE_BYTES 120; check-skill-line-ratchet.mjs reads contract-review.md at 60 lines (ceiling 60), exit 0; check-skill-id-lint.mjs --self-test then the lint: 105 files clean against /#[0-9]{3,}/g, exit 0, and a grep of the file for # followed by three or more digits finds nothing; check-skills-token-ratchet.mjs: 56 authored bundle files within ceilings, exit 0. The line does not state the positional rules (below the heading, not quoted, bulleted or fenced); the shape is defined by --template, which prints the line second and plain, and RECORD_KEY_SPELLINGS prints the full rule at the write. Acceptable at this byte budget.
6. Self-tests, run on the committed head in the worktree, exit captured before any pipe: check-half-states --self-test exit 0, 5102 cases; record-recognisers --self-test exit 0, 336; post-stamped --self-test exit 0, 743 across 26 batteries; check-owed-reviews --self-test exit 0, 65 in 9 batteries; check-governed-queue-guard --self-test exit 0, 403. All five counts match the PR body. The raised floors (recognisers 10 to 13, post-stamped 9 to 17) are met.
7. Ablation at the head, each leg restored with git checkout and git status --porcelain empty afterwards: (A) blockquote and bullet tolerance restored into the key regex: half-states 3 of 5102 red, recognisers 2 of 336, post-stamped 4 of 743; (B) let belowHeading = true: 3 / 1 / 1; (C) if (fenced && false) continue: 4 / 2 / 1 (the tilde-and-CRLF pin among them); (D) the write-time Head-sha refusal disabled: 0 / 0 / 5. Every red pin is one of the new ones and the seat's reported counts (3/2/4, 3/1/1, 4/2/1, 5) reproduce exactly.
8. Measure-first. The 709 / 707 / 2 / 0 counts (REST issues/comments?since=2026-10-23, 113 pages) are the seat's own measurement, read not re-run; the two no-key records named (6360650327 on PR fix(plugin-auth)!: a cloud-managed environment refuses local self-registration, invitations (resends included), user creation and import, and sets passwords only on local accounts #25399, 6397040906 on PR fix(mcp,runtime)!: the stateless /api/v1/mcp answers GET and DELETE with 405 Allow: POST #25774) are the ones the fix(pm): a contract-review record reviews only the head on its Head-sha line, never a head its prose names #28023 review spot-checked. The live probe in item 3 is this review's own sample and agrees.
9. Scope. The diff touches exactly the four files the claim's file surface names; record-recognisers.mjs moves pins and a battery floor only. PR body: Fixes #28024 on its own line, Clause-②: no, Metadata-protocol: none; label skip-changeset is right for PM tooling and skill text with no published package.
10. Not measured here: ESLint on the touched scripts (no node_modules in the worktree); the Lint · ESLint check-run on the head is success. The seat's 56-family gate reconciliation is read, not re-run.

② Semver level

No published package is touched (.claude/** and scripts/pm/** only); skip-changeset carried. Clause-②: no is right; no narrowing declared or present.

③ Boundary flags

• Served tier versus face: the register answers Tier S on one .claude/** path, so the governed rules-text face applies and this record is served at CONTRACT_REVIEW_TIER, the tier the queue guard will read.
• Author: PR user.login is objectstack-fleet[bot] (attribution comment names os-elon-musk); no non-bot login to record.
• Contract-review-claim: comment 6520495482 names the seat session and this head; no competing claim, no hold, no hand-off.
• CI at review time (50 check runs on fd3f1f3e): success on Lint & Repo Gates, Lint · ESLint, Lint · repo & tooling gates, Lint · PM dispatch-gates, Lint · docs & code guards, Lint · CI release & engine gates, the three Lint · scoped jobs, TypeScript Type Check and its four sub-jobs, Governed Surface Queue Guard, Dogfood Regression Gate, Test UI, Test Core and both shards, Check Changeset, Check PR Size, PR-body guards, Live required-set sweep, Platform checklist gate sweep, Release section-coverage sweep, board snapshot, Auto Label, filter, Plan Test Core shards; still in_progress: Live half-state sweep; the rest skipped by path filter. No failure. The final all-green reading is the landing gate's.
• Seat report deviations: (a) assignment and review request skipped at PR creation per SKILL.md, accepted; (b) check:platform-checklist --changed-from not run because no export was renamed or removed, verified (CONTRACT_REVIEW_HEAD_SHA_LINE keeps its name, FENCE_LINE is module-private), accepted; (c) the discarded first heading-scope ablation (in-loop mutation stayed green) is disclosed and the re-run leg is the one reproduced here, accepted.
• Premise: premise_still_valid: true; base e1dde1a5c carried the blockquote and bullet prefixes in the key regex and the first-line-anywhere reader, and contract-review.md :33 read 「head sha 独占码段」 (read off git show).
• open_questions empty; the out-of-scope observation (keyLineRegex still tolerates blockquote and bullet for the three other keys) is the root of should-fix 1 and is answered there.
• Draft PR, mergeable_state: unstable while the sweep runs; Tier S landing by the owning seat after this record and all-green.

④ Design judgment

Rules face, per hits file, and the gate the rule names read as one change:

• contract-review.md :33. The rule now names the line the readers read, in the form the sibling :36 already uses, inside the same byte budget and with no line added. It states the shape, not the reader's positional rules, which is right for a one-line definition whose copyable form is --template and whose write-time refusal prints the full rule. Holds.
• The reader (check-half-states.mjs). The design is the right one for the ruling: positional rules a single-line regex cannot carry live in the one walker every consumer shares, the key regex refuses the two decorations that mark a citation, and the fence toggle is deliberately minimal. Fail-closed in the direction the ruling names: every quoted, bulleted, fenced or pre-heading line is prose, a quotation alone names nothing, and the repair is at the write. The cost of the chosen bounds is the residual set in ①.3: the walker's scope opens on a blockquoted heading (so a quotation can open the scope for a plain line that follows it), its fence model ignores fence character and length, and its key regex tolerates any leading whitespace (so an indented code block reads). Each is a key line in a code-rendered or quotation position that no protocol line produces and the corpus has none of; each is a one-token tightening. Holds, with should-fixes 1 to 3.
• The writer (post-stamped.mjs). Importing the reader and refusing on present-and-null is exactly the discipline the Local-runs row set, so a record cannot be posted in a shape every reader files as no head. The presence test is deliberately looser than the line (anywhere, case-blind) so a decorated key is caught; the price is a refusal on a non-record comment that quotes a record heading at line start and mentions the key in prose, which is loudness in the right direction. Holds, with should-fix 4.
• No new gate, no label write, no workflow touched; consistent with triage 6518934332.

Implemented-by: claude/project-thread-l6ibnp
Reviewed-by: session_016WV4d1QkPVVzNz3FJqb2iS

VERDICT: PASS

Must-fix: none.

Should-fix:

1. contractReviewHeadSha (check-half-states.mjs :12711) opens its scope on a BLOCKQUOTED heading, so a fully quoted signed record followed by a plain prose line opening with the Head-sha: key is read as a record naming that prose line's sha (probed: found at B, signed through the quoted Reviewed-by:; base read the quoted record's own A). Open the scope only on an unquoted heading (the blockquoted-heading tolerance belongs to the locator's filter, where a fully quoted record now reads null anyway), or refuse a Reviewed-by: line that is blockquoted when the head line was read below a quoted heading. One token, one pin shaped like the probe; 0 live instances (the seat measured 0 blockquoted headings). File as a follow-up card from this record.
2. The key regex (:12668) still begins ^[ \t]*, so a Head-sha: line inside an INDENTED code block (four spaces or a tab) above the record's own line is read as the head, on head and on base alike. ^[ ]{0,3} (CommonMark's paragraph indent, the bound FENCE_LINE already uses) closes it; the template prints no indent and the corpus has none.
3. FENCE_LINE toggles on any fence line, so a nested fence (four-backtick outer, three-backtick inner) and a mismatched close (backtick open, tilde inside) let a line that renders as fence content be read. Track the opening fence's character and length and close only on the same character at the same or greater length. Same follow-up as 1 and 2.
4. HEAD_SHA_KEY_ANYWHERE (post-stamped.mjs :2069) tests presence anywhere, so a non-record comment that quotes a record heading at line start and mentions Head-sha: mid-sentence is refused at write time with "a Head-sha key is present". Loudness only; a line-initial presence test with decoration tolerated (the keyLineRegex shape) would keep the catch for decorated lines and drop the prose false positive. Rides later.
5. contract-review.md :33 names the line but not that it sits below the heading; when the file has a line of headroom, or in --template's Head-sha note, say 「题头之下」 so the rule and RECORD_KEY_SPELLINGS agree in words. Cosmetic.

[objectstack-fleet]

domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 2e75b19392b1acff5c999da52311e167042a11de
Local-runs: probe — the five scripts' own --self-test batteries on the head, four ablation legs of the delta in a detached worktree (each restored with git checkout, git status --porcelain empty), the previous record's reader probe re-run with 27 added shapes (56 synthetic bodies plus the live PR #28023 and PR #27964 threads, driven through the four readers in worktrees at this head, at the previous head fd3f1f3e and at origin/main), the write-side refusal probe with 14 added shapes, and a read-only corpus scan (11305 issue comments updated since 2026-10-23, fetched by REST in 114 pages, driven through the three readers and the write-side refusal) were executed locally, because the card's wanted item 1 is a behavioural claim about the readers that no check-run prints and the delta changes the reader's scope, indent and fence rules; check-governed-merges.mjs --pr 28042 was run read-only beside them
Scope: DELTA review of 2e75b193 over fd3f1f3e (one commit), with the full PR in view. scripts/pm/check-half-states.mjs (CONTRACT_REVIEW_HEAD_SHA_LINE :12671, FENCE_LINE :12684, contractReviewHeadSha :12721, H51 pins :33519-33529), scripts/pm/post-stamped.mjs (battery floor :4090, pin :5321), scripts/pm/record-recognisers.mjs (battery floor :2073, pins :2188 and :2246-2247); untouched in the delta and read again: .claude/skills/pm-dispatch/references/contract-review.md (:33), post-stamped.mjs recordKeyedLineRefusals (:2092) and RECORD_KEY_SPELLINGS (:2062), record-recognisers.mjs locateReviewOfRecord (:1991) and keyLineRegex (:534), check-owed-reviews.mjs recordReading, check-governed-queue-guard.mjs recordVerdict, CONTRACT_REVIEW_HEADING_MARKER (check-half-states.mjs :12624). The previous PASS on fd3f1f3ef3a7211bc436ffa1cc9482357c66133f covers that head only; this record is the review of 2e75b193.

① Derived judgments

Base is origin/main, merge base e1dde1a5c; origin/main has since moved to bc496bf7d with no touch of the four reviewed files or the two consumer scripts (git diff --stat e1dde1a5c bc496bf7d on the six paths is empty). The delta is one commit touching three scripts/pm/** files (+51 / -24); git diff fd3f1f3e 2e75b193 -- .claude is empty, so contract-review.md is unchanged and the Tier S face is the PR's, not the delta's. check-governed-merges.mjs --pr 28042 at the head: 1 of 4 paths hits the register (.claude/**), Tier S, 202 changed lines (+169 / -33) under the human-merge threshold. Each of the dev's three delta claims, judged by reading the code and by running it:

1. Heading scope. contractReviewHeadSha (:12721) now sets belowHeading only when CONTRACT_REVIEW_HEADING_MARKER matches AND the line does not begin, after optional whitespace, with the blockquote marker (a second, two-token regex on the same line); the marker itself (:12624) keeps its optional blockquote marker so the locator, H43's filter, owed-reviews and the guard still see a quoted-heading comment as a record, and recordKeyedLineRefusals still scopes on it. Probed at this head: the previous record's should-fix 1 shape (a fully quoted signed record on A followed by a plain prose line opening Head-sha: B) names null, and every reader answers null / absent / stale / absent at B AND at A (base and fd3f1f3e read B with locateReviewOfRecord found at B through the quoted signature; origin/main read A). The same with CRLF, with the plain Reviewed-by: added below, and with a space before the marker: null. A quoted heading alone over a plain own line: null (previously A). A quoted record on B followed by the real unquoted record on A: A, found at A, absent at B (fd3f1f3e and base read B). The locator's flipped pin (:2188) now asserts ABSENT and names its reason. TRUE.
2. Indent. CONTRACT_REVIEW_HEAD_SHA_LINE (:12671) opens ^[ ]{0,3}; the key-to-colon gap keeps [ \t]*. Probed: a four-space or tab-indented line naming B above the own A line is skipped and A is read (fd3f1f3e read B); a four-space, tab, or four-space-under-a-paragraph own line alone names null (fd3f1f3e read A); a one-, two- and three-space own line reads A; two spaces then Head-sha: then a tab then the span reads A. TRUE. The heading marker still admits any leading whitespace, so a heading indented four spaces (a code block in CommonMark) still opens the scope over a plain line; this is unchanged from base and both prior heads and is below the key line's own bound (should-fix 7).
3. Fence. FENCE_LINE (:12684) captures the run; the walker records { ch, len } on open and closes only on the same character with a run at least len long; other fence lines inside are content and skipped; an unmatched fence runs to the end. Probed: four-backtick outer with a three-backtick inner naming B then own A: A (fd3f1f3e read B); backtick open with a tilde line and B inside: A (fd3f1f3e read B); tilde open with a backtick pair inside: A; a longer closing run (five backticks over three, four tildes over three) closes and A is read; a fence with an info string closes on the bare run; an open fence followed by ~~~ B ~~~ and never closed names null, as does an unclosed fence before the own line and a four-backtick fence "closed" by three; a fence indented three spaces and closed at column 0 closes; a fence line indented four spaces is not a fence (CommonMark agrees) and the plain B line after it is read on every head alike. CRLF nested fence: A. TRUE. Residual, same on this head, fd3f1f3e and base: a closing line with trailing text (three backticks then prose, which CommonMark reads as fence content, not a close) closes the fence here, so a Head-sha: line after it is read (should-fix 6).
4. Monotone across the whole probe. 56 synthetic shapes times three worktrees: between fd3f1f3e and this head the reader's answer changes in 19 shapes, and every change is either something-to-null or the cited B to the author's own plain A; between origin/main and this head it changes in 39 shapes, each of the same two kinds; in NO shape does this head name a sha that a plain line below an unquoted heading did not write. The 28 shapes of the previous probe read exactly as the previous record states except the five the delta was asked to change (quoted heading over a plain line; indented code and tab above own A; nested and mismatched fence), each now narrower. The four readers agree in every row: H43 latestContractReviewOnHead, locateReviewOfRecord, owed recordReading and the guard's recordVerdict all reach the head through contractReviewHeadSha (grep over scripts/pm at the head: no second parser), so a null here is absent / stale / absent everywhere. Template-shaped record (contractReviewTemplateLines({ headSha: A })): found at A, absent at B. Live PR fix(pm): a contract-review record reviews only the head on its Head-sha line, never a head its prose names #28023 record 6518659368 at 40b5a25e: H43 6518659368/PASS, located found, owed current, guard stands; at a wrong head: absent / stale / absent. Live PR feat(spec,metadata-protocol,rest,objectql,runtime): GET /meta/object serves switched-off packaged actions beside the item, and the disabled-action refusal reads as a plain sentence #27964 full thread at b3d92fee: found 6516322954; at 8216bec4: found 6516042954; truncated before 06:15Z: null at b3d92fee, found 6516042954 at 8216bec4. Identical to the previous record's readings and to base.
5. No live record is orphaned. Corpus scan (scratchpad corpus-scan.mjs): of 11305 issue comments updated since 2026-10-23, 713 carry the heading marker; 0 have a blockquoted heading line (all 713 have a plain line-initial one), 0 have a Head-sha key line indented four spaces or a tab, 1 has any fence line, 711 carry a Head-sha key. contractReviewHeadSha at this head, at fd3f1f3e and at origin/main returns the SAME value on all 713 bodies (0 differences in either pair); the 2 nulls are the two no-key legacy records the previous reviews named. 711 records name a head and all 711 carry a Reviewed-by: line. The seat's 0-of-709 measurement reproduces on a superset.
6. Write side still consistent. recordKeyedLineRefusals (:2092) is untouched in the delta and still refuses on key-present-and-reader-null through the IMPORTED contractReviewHeadSha, so the new nulls are refused at the write automatically. Driven at the head (scratchpad refusal-delta.mjs): the should-fix 1 shape, a fully quoted record, a quoted heading over a plain own line, a four-space or tab own line alone, a nested-fence B alone, an unmatched fence, and an unclosed fence before the own line are each refused with the offending line quoted; a three-space own line, a four-space B above a plain own A, a nested-fence B above a plain own A, and a quoted record followed by the real unquoted record all pass and name A; an ordinary comment with the key mid-sentence, an os-dev-report JSON, a triage comment naming the heading mid-line and a comment quoting a Head-sha: line with no heading are untouched; all 14 live comments on the two fixture threads are untouched. Over the 713 live heading-marker bodies the Head-sha row fires on none; the one write-time refusal the scan finds is the pre-existing Local-runs row on record 6517315440 (PR docs(skills): objectstack-formula eval for a mail amount in each record's own currency (currency:@path) #27922), whose Local-runs: names a command instead of none or probe — REASON; not this delta's. The new post-stamped pin (:5321) covers the quoted record and both indents; RECORD_KEY_SPELLINGS['Head-sha'] and the row's why text still list "blockquoted, bulleted, fenced or pre-heading" and do not name the two new causes (should-fix 6 text part, folded into should-fix 8).
7. Self-tests, run on the committed head, exit captured: check-half-states --self-test exit 0, 5105 cases; record-recognisers --self-test exit 0, 337; post-stamped --self-test exit 0, 744 across 26 batteries; check-owed-reviews --self-test exit 0, 65 in 9 batteries; check-governed-queue-guard --self-test exit 0, 403. All five match the dev's report. Raised floors (recognisers 13 to 14, post-stamped 17 to 18) are met.
8. Ablation of the delta, in a detached worktree at this head, each leg one sed, restored with git checkout and porcelain empty: (A) heading scope opens on a quoted heading again: half-states 1 of 5105 red (the :33524 pin), recognisers 2 of 337 (the :2188 flipped pin and the :2247 quoted-record pin), post-stamped 0 of 744 — its quoted-record limb is still refused under A because the quoted key line is refused by the key regex, so that pin does not discriminate this leg; the reader's and the locator's do. (B) key regex back to ^[ \t]*: half-states 1 red (:33526), recognisers 0, post-stamped 1 of 744 (:5321). (C) fence close back to a toggle: half-states 1 red (:33529), recognisers 0, post-stamped 0. (D) fence closes on the same character at any length: half-states 1 red (:33529, its longer-run and nested limbs). Every leg is caught by at least one new pin in the reader's own battery, and no other pin moves.
9. Scope and metadata. The delta touches only the three script files; no export is renamed or removed (FENCE_LINE stays module-private; the key-regex constant keeps its name). PR body: Fixes #28024 on its own line, Clause-②: no, Metadata-protocol: none; labels documentation, size/m, skip-changeset. The dev's commit trailer form (Co-authored-by: Claude plus Claude-Session:) follows the repo rule the previous record accepted.
10. Not measured here: ESLint on the touched scripts (no node_modules in the worktrees); the Lint · ESLint check-run on this head is success. The dev's 56-family gate run at fd3f1f3e was not re-run for this delta; the five self-tests and the PM dispatch-gates check-run on this head are the delta's own gate evidence.

② Semver level

No published package is touched (.claude/** and scripts/pm/** only); skip-changeset carried. Clause-②: no is right; no narrowing declared or present, and the delta adds none.

③ Boundary flags

• Served tier versus face: the register answers Tier S on the one .claude/** path the PR carries (unchanged in the delta), so this record is served at CONTRACT_REVIEW_TIER, the tier the queue guard will read.
• Author: PR user.login is objectstack-fleet[bot]; no non-bot login to record.
• Contract-review-claim: comment 6520760971 names this seat session and this head (2e75b193), after 6520495482 on the previous head; no competing claim, no hold, no hand-off; no reviews on the PR.
• CI at review time (45 check runs on 2e75b193): success on Lint & Repo Gates, Lint · ESLint, Lint · repo & tooling gates, Lint · PM dispatch-gates, Lint · docs & code guards, Lint · CI release & engine gates, the three Lint · scoped jobs, TypeScript Type Check and its four sub-jobs, Governed Surface Queue Guard, Dogfood Regression Gate, Test UI, Test Core (2/8), Check PR Size, PR-body guards, Live required-set sweep, Platform checklist gate sweep, Release section-coverage sweep, board snapshot, Auto Label, filter, Plan Test Core shards (27); 16 skipped by path filter (Check Changeset among them); still in_progress: Live half-state sweep and Test Core (1/8). No failure. The final all-green reading is the landing gate's.
• Draft PR, mergeable_state: blocked while the two runs finish; Tier S landing by the owning seat after this record and all-green.
• Premise: premise_still_valid: true in the dev report; the delta's premise (the three residuals the previous record named at ①.3) is reproduced here on fd3f1f3e before being shown closed.

④ Design judgment

• Heading scope. Refusing the blockquote at the one place the scope opens, while leaving the marker's tolerance to the locator, is the smaller of the two fixes the previous record offered and the right one: a quoted record stays a record (so a quotation cannot masquerade as "no record" either) and simply names no head, which every consumer files as absent. Holds.
• Indent. ^[ ]{0,3} is the bound FENCE_LINE already used and the one CommonMark draws; the lazy-continuation case it also refuses is fail-closed in the right direction and the template prints no indent. Holds.
• Fence. Tracking character and length is the minimal model that makes "inside a fence" agree with the renderer on nesting and on mismatch; the one remaining divergence (a closing run with trailing text) is a one-token tightening and reads the same on base. Holds, with should-fix 6.
• The writer is unchanged and inherits the narrower reader through the import, which is exactly what the Local-runs discipline was for; the refusal's prose lags the reader by two causes. Holds, with should-fix 8.

Implemented-by: claude/project-thread-l6ibnp
Reviewed-by: session_016WV4d1QkPVVzNz3FJqb2iS

VERDICT: PASS

Must-fix: none.

Should-fix (1 to 3 of the previous record are closed by this head; 4 and 5 carried forward, 6 to 8 new; file on a follow-up card):
4. HEAD_SHA_KEY_ANYWHERE (post-stamped.mjs :2069) tests presence anywhere, so a non-record comment that quotes a record heading at line start and mentions Head-sha: mid-sentence is refused at write time with "a Head-sha key is present" (re-probed at this head: still refused). Loudness only; a line-initial presence test with decoration tolerated (the keyLineRegex shape) would keep the catch for decorated lines and drop the prose false positive. Rides later.
5. contract-review.md :33 names the line but not that it sits below the heading; when the file has a line of headroom, or in --template's Head-sha note, say 「题头之下」 so the rule and RECORD_KEY_SPELLINGS agree in words. Cosmetic.
6. FENCE_LINE (:12684) matches a closing line with trailing text (three backticks then prose), which CommonMark reads as fence content, so a Head-sha: line after such a line is read (probed: B named; same on fd3f1f3e and on base). Close only when the rest of the line is whitespace: one anchored regex for the close, the open keeps its info string. Same follow-up card.
7. CONTRACT_REVIEW_HEADING_MARKER (:12624) admits any leading whitespace, so a heading indented four spaces (a code block in CommonMark) opens the scope while the key line below it is held to three; the marker is shared with the locator, so change it at the open in contractReviewHeadSha only (^[ ]{0,3}## Contract review), as the blockquote refusal was. Unchanged from base; 0 live instances. Same follow-up card.
8. The Head-sha refusal's why text (post-stamped.mjs :2097) and RECORD_KEY_SPELLINGS['Head-sha'] (:2063) still enumerate "blockquoted, bulleted, fenced or pre-heading" and do not name a code-indented line or a line under a quoted heading, both of which now cause the refusal. Add the two words so the printed rule matches the reader. Cosmetic; same card as 5.

[objectstack-fleet]

domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS

维护者速读

• 改了什么：契约复核记录的 Head-sha: 行，现在只在未加引用的 ## Contract review 题头之下读，而且必须是普通行。以下几种行都不再读：

  • 引用块里的；
  • 列表项里的；
  • 围栏代码里的（围栏要用同字符、不短于开栏的连续符号才算关闭）；
  • 缩进代码里的（行首最多 3 个空格，不收 tab）；
  • 题头之前的。

  写入侧 recordKeyedLineRefusals 会在发帖前拒收「有 Head-sha: 键但读不出 head」的记录。contract-review.md:33 写明了读的是哪一行。4 个文件。

• 为什么改：这是 pm(record-recognisers): a contract-review record is read as a review of ANY head it mentions in a code span, not the head on its Head-sha line; an older head's PASS that names the new head marks the new head reviewed #27979（p1）的尾巴。PR fix(pm): a contract-review record reviews only the head on its Head-sha line, never a head its prose names #28023 之后，排在本记录前面的一行引用或列表里的 Head-sha: 仍会被当成本记录的 head，也就是把别人的 sha 读成「已审」。

• 风险与回滚：只收紧，不放宽。实测 2026-10-23 以来 713 条线上记录，新读法与基线逐条一致：0 条读法改变，0 条被拒。另有 2 条旧记录没有 Head-sha 键，本来就读不出，与本 PR 无关。回滚就是 revert。

• 先看：check-half-states.mjs 的 contractReviewHeadSha，再看 post-stamped.mjs 的 recordKeyedLineRefusals。

• 两分钟验证：本 head 上五个自测全部 exit 0：half-states 5105、recognisers 337、post-stamped 744、owed-reviews 65、guard 403。

• 需要你做的：无。登记册判定为 Tier S（.claude/** ×1）。契约复核 PASS，记录在本评论之前，Head-sha: 2e75b19392b1acff5c999da52311e167042a11de。本席转 ready 并开自动合并。

席位意见：ACCEPT。前一 head fd3f1f3e 的复核也是 PASS（6520948513），但它的 should-fix 1 指出：有一种写法在那个 head 上比基线还宽——记录的题头整个放在引用块里时，也会打开读取范围。这正是 p1 防的那一类错误，所以本席没有放行那个 head，要求在本 PR 内修掉 should-fix 1–3。

修好后的 2e75b193 做了 delta 复核，结果 PASS：

• 56 种构造写法，加上 fix(pm): a contract-review record reviews only the head on its Head-sha line, never a head its prose names #28023、feat(spec,metadata-protocol,rest,objectql,runtime): GET /meta/object serves switched-off packaged actions beside the item, and the disabled-action refusal reads as a plain sentence #27964 两个真实评论串，在新 head 上的读法都与基线相同或更窄；
• 原 should-fix 1 的写法，两个 head 都读为空；
• 自测里四条消融都按预期变红。

剩下的 should-fix 4–8 都与基线行为相同，或只影响报错是否清楚，线上 0 例，转到跟进卡 #28057。

席位核对

• 形态: one PR, Fixes #28024, two commits, four files: scripts/pm/check-half-states.mjs, scripts/pm/post-stamped.mjs, scripts/pm/record-recognisers.mjs, .claude/skills/pm-dispatch/references/contract-review.md (line 33 only, 117 bytes, line-neutral). skip-changeset. check-governed-merges.mjs --pr 28042: Tier S (.claude/** ×1).
• 前提实测: the card thread measured 709 live records before the change, with 0 decorated, 0 pre-heading and 0 quoted-heading Head-sha: lines. The delta review re-scanned 713 records: base, fd3f1f3e and 2e75b193 agree on all of them. Every reader reaches the head through the one contractReviewHeadSha: H43, locateReviewOfRecord, owed-reviews recordReading and the guard's recordVerdict. post-stamped.mjs imports that reader; nothing re-spells it, and there is no import cycle.
• 门禁 check-runs: head 2e75b19392b1acff5c999da52311e167042a11de: 45 check-runs, 27 success, 16 skipped, 0 failed, 2 in progress (Live half-state sweep, Test Core 1/8). Auto-merge waits on them. The card thread reports 56 derived gate families exit 0 at the first head.
• 接受的偏差: a record whose ## Contract review heading is itself blockquoted now reads absent. There are 0 such records live, and the locator pin that used to read it was flipped deliberately, with the reason stated.
• 范围外去向: pm(record-recognisers): close a fence only on a bare run, refuse a code-indented Contract review heading, and name the new Head-sha refusal causes #28057 (pm:blocked on this PR) takes delta review should-fixes 4–8.
• 落地条款: Tier S: on the contract review PASS on the current head, the seat posts the record and this ACCEPT, flips the PR ready and arms auto-merge, under the maintainer's landing grant for this term (seat thread, 2026-10-29 22:04Z).