feat(pm): a project seat's patrol is part of seating, recorded on the stub, and its absence is a half-state reading - #28687

domain:skills#2 · marchtian · session_017ihL2g7RyXa8ErM6GAkHyc

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 58de368f04d9392425076b29eb2dc4eb5fb064f3
Local-runs: none
Scope: .claude/skills/pm-dispatch/references/project-forms.md, .claude/skills/pm-dispatch/references/seat-lifecycle.md, .claude/skills/pm-dispatch/references/seat-post-protocol.md + scripts/pm/check-half-states.mjs (the H70/H71 rows, their sweep wiring and battery — the gate the rule is enforced by, read as one change with it)

Written 2026-11-01T14:03Z by the at-tier subagent of domain:skills#2; inputs = card #28642 (body + 3 comments), PR #28687 (body, file list, net diff vs main at this head), the head's check-runs. The dev's report and the PR body were read as claims and checked against the tree, not adopted.

① Derived judgments

• Published accept set / public surface: unchanged — right. The four changed paths are .claude/skills/pm-dispatch/references/** (governed rules text) and scripts/pm/check-half-states.mjs (PM tooling, not a package, not in GOVERNED_SURFACES). No packages/**, no exports map, no .d.ts, no error code. Clause-②: no on the PR body and on the claim (6558432195) is the correct declaration.
• Review face: rules (CONTRACT_REVIEW_TIER) — right. reviewFace on the file list returns the three references files as hits; the script is cited code.
• Landing tier by the register: Tier S — triage's "Tier H" is not the register's reading. SKILL.md:204 and AGENTS.md ¶14 put the whole of .claude/** in Tier S; scripts/pm/check-half-states.mjs is not a governed path. Triage 6556985958 nonetheless made the maintainer's approval the ruling for this rule change, and the dev's claim and PR body accept that condition. Judged: the mechanical path is Tier S (this record is the record of record), and the maintainer's approval stays owed as the card-level ruling before ready/enqueue — see ③.
• Rules text: three files, net 0 lines each (54/96/88 on main and at head), every edited line ≤ 120 bytes (measured 103 / 119 / 118 / 119 / 116 / 120 / 116) — right; SKILL.md and dispatch-runbook.md untouched, as the claim's line budget stated. The 〈断粮〉 patrol line is deleted and each clause has a surviving home: hourly → seat-post-protocol.md L66; standby items → seat-lifecycle.md L89–91; wall note on the stub → seat-post-protocol.md L18; no timer chain → SKILL.md:72.
• Half-state registry: H70 → state, H71 → stall, both emitted from sweepInto, both report-only (no label, title, body or assignee write anywhere in the added code) — right. Zero extra requests holds: H70 reads the seat post's own body inside the existing pm:seat branch; H71's onDutyLanes and candidates come from seen, and SEEN_LABEL_PAGES already lists pm:seat and pm:queue.
• Self-test roster: one new battery H70/H71 seat patrol pinned at 26 under 27 recorded cases; SELF_TEST_BATTERY_FLOOR stays 10 and the "TEN batteries" case still holds with eleven declared — right. directiveValues' JSDoc key union gains 'Seam'|'Patrol': doc-only, H68 already called it with 'Seam' on main.
• Check-runs on this head: every completed non-skipped run is success (Lint & Repo Gates, Lint · PM dispatch-gates — the ratchet/id-lint/frame-sync/governed-prose family —, Lint · scoped · tooling self-tests, Governed Surface Queue Guard, PR-body guards, Type Check ×6, Test UI, Dogfood, Check PR Size, and Live half-state sweep — the standing report-only caller of the script, green with the new rows in it). Still in_progress at write time: Test Core (1/8) only, a product shard no path here feeds. No red, no merge-base signature to discount.

② Semver level

No publishable package is touched; no changeset exists and the PR carries skip-changeset — matches what the diff publishes (nothing). Clause-②: no is consistent on the PR body and the claim; there is no (narrowing) arm, so no narrowing face is owed. Correct.

③ Boundary flags

Author: objectstack-fleet[bot] (relay) — no off-relay login to name.

Dev deviations (PR body "Acceptance notes" / report deviations):

• Notify: seat-online key not extended — accepted. Card Wanted ① wanted the patrol on the seat-online record too; the key template at project-forms.md L44 is parsed by record-recognisers.mjs, outside this claim's surface, and the mailbox-keys card is the serial behind this one. The rule as written (L41) says the stub carries it, and H70 reads the stub, so the tree is self-consistent. The half still owed goes to that serial card, not to this PR.
• H71 drops "spare concurrency" — accepted. No seat post states a cap machine-readably; the row text says so and the remedy allows "in hand at its limit".
• dispatch-runbook.md untouched; Wanted ④ lives at seat-lifecycle.md L89 — accepted; the runbook's 〈巡查常设项〉 still names the cross-account review and fork-PR items, which L89's "待命五项" reaches by its pointer.
• 「含前提过时」 not re-homed — accepted: execution-duties.md L14 already makes the premise check a per-dispatch duty.
• No director exemption on L41 — accepted: SKILL.md:72, project-forms.md L26 and seat-post-protocol.md L66 carry it, and H70 excludes the director title in code.
• H70 reuses seatIsHeld — accepted, consistent with H32; [PM seat] domain:spec · seat 5 — ⏳ vacant · 留守 #29571 #29618 (os-warren) #19357 (🟢 session_…) will read as held, which is right (a held lane seat).
• Trailer casing — outside the hits; not reviewed here.

open_questions:

• OQ1 (Tier S vs Tier H → landing path): answered. By the register this PR is Tier S (see ①); triage's note is not a re-tiering but a card-level condition: the maintainer's approval is the ruling for the rule change. So the path is the dev's option A: this record stands as the Tier S record of record, and the owning seat does not flip ready or enqueue before the maintainer's approval is on the PR. ⛔ Not a reason to request a CODEOWNERS review from the seat's own account.
• OQ2 (instrument-discipline L9: a new patrol row needs the maintainer's words on the card): escalated to the maintainer with the approval. The card's filing gate quotes the maintainer verbatim (「28560 等了4 个小时，是你的技能有什么问题吗」, 「为什么会停了定时巡查，skills 是否需要优化」), which is the form L9 asks for; whether a question authorises two report rows is the maintainer's call, and the PR's 速读 asks for exactly that approval. Until it is given, H70/H71 are unauthorised and the PR stays draft. The rows cost nothing and write nothing, so the approval is the only remaining gate.

④ Design judgment

Scenario accepted against: #28560 (p1, domain:spec) in pm:queue 4.5 h with seat 4 (#18917) 🟢 and idle; the seat never created its routine, stopped one-shot checks when the queue emptied, and no reading on the board showed either half.

project-forms.md L26 — holds. 「坐席即建巡查 routine(见 seat-lifecycle.md)」 keeps the triage bare-card round and the director exemption on the same line; the pointer lands on the one home. No finding.

seat-lifecycle.md L41–42, L88–89, deleted L97 — holds. L41 makes creation a step of the seating act, visible on the stub and deleted in the same act as seat-offline, which is the exact gap the incident measured (creation was never a step; the post could not show its absence). L88 names the habit that overrode the rule and forbids it; SKILL.md:74's 自退 is the round's self-exit and the routine outlives it, so L88 and 自退 do not collide; L87's 「队列空 ⇒ 停」 is scoped to one-shot invocations already. L89 names the patrol's work (claim to batch, then the five standby items) and keeps the existing interval pointer. L42 keeps the seat-online key pointer and the Routine-seat mailbox note. create_trigger bound to the seated session is what seat-post-protocol.md L58/L60 already distinguish from a new-session routine.

• should-fix (unit of the routine): SKILL.md:72 says 「每项目一个自建自绑巡查 routine」 while L41 and project-forms.md L26 say 「坐席即建」, i.e. one per seat; project-forms.md L25 opens one seat thread per seat, so a project seated on two lanes (pm-dispatch ui skills) reads two routines from the references and one from SKILL.md. Resolve on a follow-up (SKILL.md is outside this surface): either L41 says 「本席线程一个」 or SKILL.md:72's unit becomes the seat.

seat-post-protocol.md L18, L66 — holds. The stub gains Patrol: as a fixed line beside the optional wall note, and L66 names the spelling Patrol: TRIGGER_ID · CRON as the only place the current value lives, keeping 「协议不复制当前值」. Checked against the reader: DIRECTIVE_PREFIX + directiveKey('Patrol') accept the bare line, - **Patrol:** … and a backticked line, and refuse Patrol: with nothing after it and a mid-sentence mention — the battery pins all four.

Cited gate check-half-states.mjs, H70/H71 (read, not reviewed; findings are on the rule-with-gate): H70 scope traced = pm:seat ∧ open ∧ not a PR ∧ seatIsHeld ∧ not director ∧ no Patrol: line; H71 = pm:queue ∧ ¬pm:epic ∧ no assignee ∧ a domain:* label (alias-resolved) whose lane has a 🟢 seat post (seatOnDuty, non-foreign) ∧ updated_at older than 2 h or unreadable. Both match the rule text and the PR body's description; the 2 h boundary (1h59 clean / 2h01 fires) and the unreadable-stamp arm are pinned.

• should-fix (H71 remedy vs the red line): an unassigned pm:queue card carrying needs-user-decision or pm:retriage legally pairs with pm:queue (H29's vocabulary) yet is not a candidate (execution-duties.md L8) and must never be dispatched (SKILL.md L29); H71 still fires on it with the remedy "that seat claims it". Live today both pairs count 0, so no false reading is on the board; exclude the two labels in h71UnclaimedOnDutyLane and pin one case.
• should-fix (director title anchor): DIRECTOR_SEAT_TITLE anchors 总监 at the start of the seat name; the live title director(项目总监) matches via director, but a retitle to [PM seat] 项目总监 — 🟢 … would make H70 fire on the director seat. Match the seat-name half, not its first character.

No must-fix: the rule holds against the incident it is accepted against, the gate reads the exact spelling the rule names, and both rows are readings that write nothing.

Implemented-by: claude/issue-28642-seat-patrol
Reviewed-by: session_017ihL2g7RyXa8ErM6GAkHyc

VERDICT: PASS

domain:skills#2 · marchtian · session_017ihL2g7RyXa8ErM6GAkHyc

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 8eb102fffe4c9231ba98d19964b6b215161f2070
Local-runs: none
Scope: .claude/skills/pm-dispatch/references/project-forms.md, .claude/skills/pm-dispatch/references/seat-lifecycle.md, .claude/skills/pm-dispatch/references/seat-post-protocol.md + scripts/pm/check-half-states.mjs (the H70/H71 rows and their battery — the gate the rule is enforced by, read as one change with it)

Delta review, written 2026-11-01T14:17Z by the same at-tier subagent that rendered record 6558991413 on the previous head 58de368f. The head moved by ONE commit (8eb102ff, "fix(pm): H71 skips queued cards awaiting a decision or re-triage; H70 matches the director seat anywhere in the seat name"): 21+/4− in scripts/pm/check-half-states.mjs only; the three hits files are byte-identical to the previous head, so the ① ② ③ ④ judgments of 6558991413 carry over unchanged except where this record says otherwise.

① Derived judgments

• Accept set / public surface: still unchanged — right. The delta touches scripts/pm/check-half-states.mjs only (PM tooling, not a package, not a governed path); the rules face and its hits are the same three files, untouched since the previous head.
• The delta applies should-fix 2 and 3 of 6558991413 and nothing else — right, verified against the diff: (a) H71_NOT_CANDIDATE_LABELS = ['needs-user-decision', 'pm:retriage'] is tested after the pm:queue/pm:epic gate and before the assignee gate, so such a card returns null; the row's out-of-scope sentence names both labels. (b) DIRECTOR_SEAT_TITLE is now ^\[PM seat\][^—]*?(?:\bdirector\b|总监)[^—]*— — the match is confined to the seat-name half ([^—] cannot cross the — status separator), so the live director(项目总监), a retitled 项目总监, and 总监 in the STATUS half of a lane seat (domain:server — 🟢 os-zhuang · 总监 relay) all read as the rule needs; the four new battery cases pin exactly these arms.
• Self-test roster: the H70/H71 seat patrol pin rises 26 → 30 under 31 recorded cases; the roster count and SELF_TEST_BATTERY_FLOOR are unchanged — right. Still report-only: no write of any label, title, body or assignee is added; no new request (both rows still read off seen).
• Check-runs on this head: every completed non-skipped run is success — Lint & Repo Gates, Lint · PM dispatch-gates, Lint · scoped · tooling self-tests (the script's own battery), Lint · docs & code guards, Lint · CI/release/engine, Lint · repo & tooling, ESLint, Type Check ×6, Governed Surface Queue Guard, PR-body guards, Check PR Size, Live half-state sweep, Test UI, Dogfood, Test Core (2/8). Still in_progress at write time: Test Core (1/8) only — a product shard no path in this PR feeds. No red.

② Semver level

Unchanged from 6558991413: no publishable package touched, no changeset, skip-changeset on the PR, Clause-②: no on body and claim, no narrowing arm. Correct.

③ Boundary flags

• No new dev flag or open_questions entry on this head; no new comment on the card or the PR since 6558991413. The two answers given there stand: OQ1 — Tier S by the register, with triage's card-level condition that the maintainer's approval is the rule-change ruling, so the owning seat does not flip ready or enqueue before that approval is on the PR; OQ2 — escalated to the maintainer with that approval (the card quotes the maintainer verbatim as instrument-discipline L9 asks; whether a question authorises two report rows is the maintainer's call). The PR is still draft, as it should be.
• Should-fix 1 of 6558991413 (SKILL.md:72's "one routine per project" vs the references' "one per seating") is deliberately NOT applied here — it needs a SKILL.md line outside this claim's surface and remains a follow-up, not a condition on this PR.
• Author: objectstack-fleet[bot] (relay) — no off-relay login to name.

④ Design judgment

The three hits files are unchanged from the previous head; their ④ in 6558991413 holds as written. On the cited gate: the two code findings of that record are closed by this commit. H71 no longer tells a seat to claim a card the red line (SKILL.md L29) forbids dispatching, and H70 can no longer be made to fire on the director seat by a retitle — while a 总监 mention in a lane seat's status half still does not shield that seat, which is the direction the control case guards. I tried to break the new regex: \bdirector\b under the u flag still bounds on ASCII letters, so codirector or directors would not match, and the lazy [^—]*? cannot reach past the first —; a title without an em dash matches nothing, which is correct because such a post is not a parseable seat post for seatIsHeld either. No must-fix, no new should-fix.

Implemented-by: claude/issue-28642-seat-patrol
Reviewed-by: session_017ihL2g7RyXa8ErM6GAkHyc

VERDICT: PASS

domain:skills#2 · marchtian · session_017ihL2g7RyXa8ErM6GAkHyc

维护者速读(席位终稿 · head 8eb102fffe4c9231ba98d19964b6b215161f2070)

• 改了什么:坐项目席时同一动作建好自绑的每小时巡查 routine,座位贴存根写 Patrol: TRIGGER_ID · CRON,收班同笔删掉;队列空是待命不是停查;半状态巡检加两行只读读数:H70(在任项目席的存根没有 Patrol: 行)、H71(有 🟢 席位的车道上,无人认领、超过 2 小时无动静的 pm:queue 卡,待裁与待分诊卡除外)。
• 为什么改:spec: a per-field display patch slot on ObjectExtensionSchema, derived from BASE_FIELD_DISPLAY_WHITELIST; structural keys refused at parse #28560(p1)在 spec 席位在任、手上 0 张卡时排队 4.5 小时没人领。原因是建巡查不在坐席步骤里,座位贴看不出缺巡查,也没有读数报警。
• 风险与回滚:三个规则文件只改写既有行,净行数都是 0,SKILL.md 未动;两行读数只报告,不挡落地、不写任何东西。首跑 H70 会报约 16 个现有座位贴(规则刚立,存根还没写巡查行),属于预期。回滚 = revert。
• 先看:seat-lifecycle.md 〈座位贴协议〉首两行与〈停止条件与待命〉新两行;seat-post-protocol.md 存根行;check-half-states.mjs 的 H70/H71。
• 两分钟验证:node scripts/pm/check-half-states.mjs --self-test,预期 exit 0、5162 cases、电池 H70/H71 seat patrol 31/30(PR 正文写的 27/26 是返工前的数)。
• 需要你做的:批准本 PR。按登记册它是 Tier S,但分诊把维护者批准定为这条规则变更的裁决;卡上引的原话是提问,所以批准同时授权 H70/H71 两行新读数(instrument-discipline 新增巡查行须有维护者原话)。契约复审 PASS:6559169512(Head-sha: 8eb102fffe4c9231ba98d19964b6b215161f2070)。

席位意见:ACCEPT. 规则落在一个家(seat-lifecycle.md),其余两处只指过去;读数与规则同改、只读不挡。等授权批准后由本席 ready、入队。

席位核对

• 形态: 4 files (get_files): 3 × .claude/skills/pm-dispatch/references/** (governed, Tier S by check-governed-merges --test) + scripts/pm/check-half-states.mjs (not governed). 2 dev commits + 1 merge of origin/main + 1 patch commit. skip-changeset, no publishable package. Clause-②: no, Metadata-protocol: none, both on the body and the claim (6558432195).
• 前提实测: on origin/main before this PR, no seating step, stub line or half-state row named a patrol (claim 6558432195). The live sweep in the PR body is a reading at f4027cfe; spot-checked: [PM seat] domain:devx · seat 2 — 🟢 marchtian #20163 (devx seat 2) has no Patrol: line on main today, so H70 firing there is true.
• 门禁 check-runs on 8eb102ff: 30 success, 16 skipped, 0 failure, 0 in progress (read after the delta record). Dev's local dispatch-gates --commands: 55/55 exit 0, --ran 0 NOT-MEASURED.
• 复审: full contract review PASS 6558991413 at 58de368f (three should-fixes); delta PASS 6559169512 at 8eb102ff (should-fix 2 and 3 applied, verified).
• 接受的偏差: all seven in the PR's Acceptance notes, as answered in 6558991413 ③. The seat-online mailbox key does not carry Patrol:; that half rides pm-dispatch(mailbox): name when a seat MUST ring another — unblocked card, main-red anchor, release blocker, a question for triage, serial order, a relayed ruling — and close the seats with no mailbox #28675 (serial behind this card).
• 范围外去向: should-fix 1 (SKILL.md:72 says one routine per project, the references now say per seat) → filed pm-dispatch: SKILL.md says one patrol routine per project, the references now say one per seat — pick the seat #28699. Live H71 reading pm:mailbox migration: close the three per-login mailboxes and open one per seat, after per-seat mailboxes land (#27637 follow-up) #27890 (domain:skills, ~58 h) is this lane's own queue card, to be picked up under the project's concurrency ceiling. Skills-docs: none — internal tooling, no published skill or doc.
• 落地条款: Tier S path by the register (## Contract review PASS on the current head + every check green) and triage 6556985958's card-level condition (the maintainer's approval is the ruling). This seat reads the two together and takes the stricter: it stays draft with needs-user-decision until an authorised approver (GOVERNED_APPROVERS) approves; then this seat runs the landing pre-check, clears the label, flips ready and enqueues. A head move other than a pure base sync voids this record.