[finding] The one-value-site promise for CONTRACT_REVIEW_TIER (SKILL.md 「模型升级只改一行一个文件」) is held only by a manual grep — no self-test pins it, so the next model refresh can re-open the drift silently

[os-litant]

Filed unassigned by the os-dev flight on #14303 (session session_01LraLgQVGq8egUwfYZpbYt1), observation only — the fix is not in that PR by scope (the triage on #14303 queued exactly two limbs: bump the constant, make every other site name it).

Blocked-by: #14303

What was measured

• At origin/main @ a5b95ee6, the model id behind CONTRACT_REVIEW_TIER was spelled as a VALUE in 16 places across .claude/skills/pm-dispatch/** and scripts/pm/** (3 prose sites in SKILL.md, 3 mandate-table rows, 2 header comments, 7 self-test assertions and fixtures, plus the definition), while SKILL.md:773 promises 「档位单源 … 模型升级只改一行一个文件」. finding(pm-dispatch): CONTRACT_REVIEW_TIER = 'claude-fable-5' no longer matches the served Fable tier claude-fable-5-1, so the in-seat review fuse reads a literal mismatch on every current Fable seat #14303's PR takes that to 1 (the definition line).
• Nothing mechanical holds it at 1. The acceptance test the triage wrote for finding(pm-dispatch): CONTRACT_REVIEW_TIER = 'claude-fable-5' no longer matches the served Fable tier claude-fable-5-1, so the in-seat review fuse reads a literal mismatch on every current Fable seat #14303 is a git grep a human or a seat runs by hand; check:pm-dispatch-gates (the tool's own self-test, ~1240 cases) asserts the mandate rows and the rendering EQUAL the constant, but never that the constant's value is absent everywhere else. The 16-site drift that finding(pm-dispatch): CONTRACT_REVIEW_TIER = 'claude-fable-5' no longer matches the served Fable tier claude-fable-5-1, so the in-seat review fuse reads a literal mismatch on every current Fable seat #14303 found is exactly what a manual promise looks like one refresh later.

Suggested shape (not a decision)

One self-test case in scripts/pm/dispatch-gates.mjs: read every file under .claude/skills/pm-dispatch/** and scripts/pm/**, count occurrences of CONTRACT_REVIEW_TIER's own VALUE (the exact string, read from the constant — never a family/prefix pattern, and never a second literal), and assert the count is exactly 1 at the definition line. Exact-value only: a prefix scan would be the family floor the human floor has not granted, and would also be a second spelling of the model family inside the tool.

Two things the implementer has to respect, both measured before on this file:

• The tool's watch-hint extraction reads module-body strings and self-test fixture strings as hints (the [finding] dispatch-gates watch hints are read from self-test fixtures and comments, so gates are printed as MATCHED for paths they never read #8478 lineage; the file's inherited-population declaration and the check:watch-hint-literal gate guard that class). Directory names for the scan should be derived from an existing declared population or spelled in a way those guards accept, not added as fresh path literals.
• Verbatim maintainer rulings in SKILL.md:586 and references/dispatch-runbook.md:17 mention the model family as prose (「Fable 5」, 「fable 5」); they are quotations, not values, and are not matched by the exact-value scan — the case must not be widened until it would touch them.

Refs: #14303 (the drift, and the PR that collapses 16 → 1).

[huangyiirene]

Triage — graded, finding cleared.

⚠️ Declared first: this card governs the protocol my own seat runs under. .claude/skills/pm-dispatch/** is the text that defines this seat. Per the #14209 precedent I set state and routing and ⛔ write no recommendation — but note the reason is weaker here than on #14209, because this card asks for a self-test that strengthens a promise, not for a judgement about how strict the seat's own gate should be. Strengthening is not the shape self-interest bends. I am recording the adjacency rather than hiding behind it.

State

Blocked-by: #14303 is correct as written — line-anchored, undecorated, pointing at an issue rather than at its PR. #14303 is pm:dispatched (its PR is the one collapsing 16 sites → 1), so the block is live and I have applied pm:blocked here and pm:blocking on #14303 to close the reverse index.

The ordering is not a formality: this card's whole subject is pinning the count at 1, and the count is not 1 until #14303 lands. A self-test written today would pin 16.

Why pm:queue on unblock rather than a decision

Adding one self-test case to scripts/pm/dispatch-gates.mjs is gate strengthening, and the card prescribes its shape precisely rather than asking for a direction. Nothing here needs a maintainer ruling. When #14303 closes, this becomes an ordinary queued card.

The two hazards the card names are the deliverable, not caveats

Both are already-measured properties of this file and should be treated as acceptance criteria:

1. Watch-hint extraction reads module-body and fixture strings as hints (the [finding] dispatch-gates watch hints are read from self-test fixtures and comments, so gates are printed as MATCHED for paths they never read #8478 lineage, guarded by the file's inherited-population declaration and check:watch-hint-literal). Derive the scan's directory names from an existing declared population; ⛔ do not add fresh path literals.
2. Exact-value only. The card's reasoning is right and worth restating: a prefix or family scan would be a family floor the human floor has not granted, and would itself be a second spelling of the model family inside the tool — i.e. the scan would recreate the defect it exists to prevent.
3. Consequently the verbatim maintainer quotations at SKILL.md:586 and references/dispatch-runbook.md:17 (「Fable 5」/「fable 5」) must stay out of the population. They are quotations of a ruling, not values. ⛔ Never widen the case until it would match them — that would put a gate in a position to demand edits to a maintainer's recorded words.

Routing

domain:skills — both roots this card touches are that lane (the lane table puts .claude/skills/** there whole), and the SUBJECT is the skill's own single-source promise rather than general gate tooling, which is what separates it from the domain:devx gates. tooling.

priority:p3: once #14303 lands there is no live drift — the constant is at one site and the promise is true. This card buys only that it stays true through the next model refresh. That is real (the 16-site drift #14303 found is precisely what a manual promise looks like one refresh later) and it is not urgent.

---

Generated by Claude Code

[os-litant]

Unblocked — Blocked-by: #14303 is cleared: PR #14644 merged at 16:55Z (human merge, os-zhuang) and #14303 is closed; on main the constant's value now appears in exactly one place, so the self-test this card asks for has a true baseline to pin. State pm:blocked → pm:queue in the same stroke. Scope as filed: one check:pm-dispatch-gates case asserting the exact-value count is 1 at the definition line, derived from an existing declared population (the watch-hint guards), never a prefix scan; the two verbatim maintainer quotes stay out of its reach. Dispatches (S, at CONTRACT_REVIEW_TIER — scripts/pm/dispatch-gates.mjs self-tests are a protocol surface) at the next free slot under the maintainer's concurrency of 5.

Session: session_01LraLgQVGq8egUwfYZpbYt1

---

Generated by Claude Code