skills(pm-dispatch): the single-writer set is what SINGLE_CLAIM_PATHS enumerates — said where the seat reads batch independence - #17089

Fixes #17032

What this changes

.claude/skills/pm-dispatch/SKILL.md, the 候选与批次 block, lines 438–442 rewritten in place: 812/812 lines, every touched line ≤120 bytes. Direction (1) of the card — say it once, where a dispatching seat reads about batch independence. Directions (2) (the check's display name) and (3) (the gate's passing output) belong to the gate's own lane: scripts/check-single-claim-paths.mjs and the workflow are untouched. references/core-rules.md is untouched too (151/151): its clause states independence by constructed file surface and never used the word; the reader who needs the mechanism is on SKILL.md.

Before (854639b3, :438–442):

- 并行度以 `batch` 封顶;同批独立性按文件面不相交判,⛔ 不按包;`priority:p0` 可超 `batch`。
- 第 N 单派发前读 `scripts/pm/os-verify-lock.sh --status`:到达深度 ≥ `LOCK_DEPTH_HOLD`(= 2)即等。
- 到达深度 = `queue N:` 行数 + 1(待派 dev 的运行算作到达);`state:` holder 与 `parked` 行不计。
- 有效上限是锁宽的函数,⛔ 不是第二个 `batch`;`priority:p0` 可超 `batch`,⛔ 不越过深度等待。
- 阈值出处是深度表:深度 1/2/3/4 的 exit 99 率 1%/23%/36%/56%;等待不填槽,读数带 UTC 写进认领。

After (9bbd015cb, :438–442; widths 118 / 114 / 112 / 114 / 118 bytes, measured with printf '%s' LINE | wc -c):

- 并行度以 `batch` 封顶,等待不填槽;同批独立按文件面不相交判,⛔ 不按包、不按 check 名。
- single-writer 路径 = `SINGLE_CLAIM_PATHS` 所枚举;共享其它路径是普通并发,后落地方解冲突。
- 第 N 单派发前读 `scripts/pm/os-verify-lock.sh --status`:到达深度 ≥ `LOCK_DEPTH_HOLD`(= 2)即等。
- 到达深度 = `queue N:` 行数 + 1(待派 dev 的运行算作到达);`state:` holder 与 `parked` 行不计。
- 有效上限是锁宽的函数,⛔ 不是第二个 `batch`;`priority:p0` 可超 `batch`,⛔ 不越过深度等待。

Gloss of the two rewritten lines: parallelism is capped by batch and a wait does not fill a slot; same-batch independence is judged by disjoint file surfaces — not by package, and not by a check's name. The single-writer paths are exactly what SINGLE_CLAIM_PATHS enumerates (no count hardcoded — the script is the authority and a number would rot); two open PRs sharing any other path is ordinary concurrent work, and the cost is one merge resolution paid by whichever lands second.

Paid in place — the three deletions and where each lives instead

等待不填槽 was moved, not deleted: from :442 to :438, beside 并行度以 batch 封顶 — the same rule at the slot it qualifies.

The sweep the card asked for — done first

Channel: repo-scoped REST (probe GET /repos/objectstack-ai/objectstack/issues/17032 → 200; /rate_limit reads the 15000/h form), then GET /repos/objectstack-ai/objectstack/issues/comments?since=…&per_page=100&page=N&sort=created&direction=desc paged to a short page — /search/* was not used (MCP calls for the whole run: 0). Local regex single[- ]writer, case-insensitive, then classified by hand from each body's own seat markers (session id / lane / seat post).

• Window A, since=2026-09-08T00:00Z: 2,021 comments (created 09-07T11:37Z … 09-09T07:06Z), 21 pages, 68 hits across 50 issues.
• Window B, since=2026-09-05T00:00Z: 5,999 comments (09-05T07:24Z … 09-09T07:19Z), 60 pages, 122 hits. Widened because the gate itself landed 2026-08-18 (ba0a84685, PR ci: at most one open PR may modify a declared single-writer path #9598) and a two-day window cannot separate a personal error from a lane-wide one.
• Positive control, both windows: the two retractions the card names are re-found — 5595142864 on Two branches bumping the same hand-maintained counter merge clean and produce a wrong sum with zero conflict — measured on system-context.mdx (106→107 twice, tree holds 108) #16919 and 5595150955 on [PM seat] domain:services — 🟢 os-sales · session_01ToDPcx9AESFubJkDiFMtKW · R1 #6021 — and so are the services seat's own "Single-writer check, done before dispatch" claim paragraphs (session session_012zTkyNHJ7TkuN2oXtP5x37: plugin-reports: a non-member timezone silently discards a report schedule's cron and fires it on the interval cadence forever — and the create-time guard cannot see it #16291, plugin-audit's read-audit rows back-date created_at to the VIEW instant through an isSystem reliance the audit hook never honoured, so every batched sys_audit_log read row now gets the FLUSH instant #16829, plugin-auth: POST /two-factor/verify-totp on the enrolment lane echoes user.twoFactorEnabled: false after the flag has flipped — the vendor's pre-rotation snapshot, which two-factor-rotated-token-echo repairs for token only #16535, [finding] verifyMcpAccessToken resolves a client_credentials (M2M) token to a principal, while its own docblock says such tokens carry no sub and are rejected #16418, [finding] AuthManager still carries two more independent basePath normalisers — getAuthIssuer() and getMcpResourceUrl() — and one of them builds a malformed URL #16399, [finding] service-automation: the durable run-history row folds cancelled (and timed_out) into failed — after a restart the Runs surface cannot tell a cancelled run from a failed one #15223, Validate Package Dependencies now fails on every PR and will fail on main's next scheduled run — 15 advisories across 7 packages (2 Critical in next), all with fix versions, and no lockfile moved #16999, The #3424 admin override has no Console control: a record stranded behind an unstaffed approval is releasable only through the API #16679 ×2, Two branches bumping the same hand-maintained counter merge clean and produce a wrong sum with zero conflict — measured on system-context.mdx (106→107 twice, tree holds 108) #16919, service-analytics: on driver-sql (sqlite) the NativeSQLStrategy answers POST /analytics/dataset/query without the object-level grant or the tenant wall — a user with NO read grant on an object gets its row count (200) where GET /data/OBJECT answers 403; the memory driver's path refuses both #16645, plugin-security: the first-user promotion picks the oldest authenticable user from an UNORDERED 50-row sys_user window, so on the default driver a seeded job seeker became platform admin and owned every seeded row #16682). A zero is not what this sweep reads.

Classification of the 122 (window B):

• ~60 neutral: the check's display name quoted inside a green-check roster of a contract review / ACCEPT / adoption record. Not the model.
• ~6 the lane-charter sense (scripts/pm/** single writer is the objectstack seat; "single writer of the seat post"). A different subject.
• The over-read model — "any file two open PRs both change is a single-writer path the gate enforces" — acted on, by seat:

• Independently falsified three times, each as a per-seat correction that never became a rule: domain:engine 09-06 13:24 (objectql: 11 error classes still spell their code as an inline literal, so a consumer cannot follow the by code, not instanceof convention the docs already teach #16159, 5559511753: "The round measured the gate; I then re-read scripts/check-single-claim-paths.mjs on origin/main"); domain:cli 09-07 11:12 (rest: the three server-built findData literals speak the canonical QueryAST; retire wireDialectQuery (consumer half of #16066) #16337, 5569766536: "⛔ The premise of the hold above is FALSE — rest-server.ts is not a CI-enforced single-writer path. Measured." — SINGLE_CLAIM_PATHS has one entry); domain:services 09-09 03:06 ([PM seat] domain:services — 🟢 os-sales · session_01ToDPcx9AESFubJkDiFMtKW · R1 #6021, 5595150955 — the card's provenance). The next domain:cli session re-adopted the model on 09-09: the correction did not survive a session boundary, which is exactly what a charter line is for.

Verdict: lane-wide, not personal — four dispatching lanes (services, cli, engine, devx) plus one review seat, at least twelve distinct comments acting on the model across four days, and the phrase's only in-repo source before this PR was the check's display name (grep -n -i single-writer .claude/skills/ on 854639b3: 0 hits; after: 1, SKILL.md:439; control word batch: 7 before, 7 after).

Reverse verification — the ratchet reads this file

On 9bbd015cb (fix committed first): one line appended → on-disk marker count 1, wc -l 813 → node scripts/pm/check-skill-line-ratchet.mjs exit 1 with its own verdict line ✗ check-skill-line-ratchet: .claude/skills/pm-dispatch/SKILL.md is 813 lines; the ratchet ceiling is 812. Restored with git checkout HEAD -- PATH (trap-guarded, absolute path): marker count 0, 812 lines, git diff HEAD empty, git status --porcelain empty, working-tree blob hash 5e0b353e71d48de445714fd5987043dfa23b3b17 equal to HEAD:PATH, ratchet exit 0 again. The hash equality is the proof; the trap is only the crash path.

Gates — all on 9bbd015cb, exit captured before any pipe

Derived with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths passed; 16 commands) and reconciled with --ran: ✓ dispatch-gates --ran: 16 derived famil(ies) accounted for — 16 run, 0 NOT-MEASURED.

Governed predicate, copied from node scripts/pm/check-governed-merges.mjs --test .claude/skills/pm-dispatch/SKILL.md .claude/skills/pm-dispatch/references/core-rules.md (exit 3):

governed-surface predicate: 2 of 2 path(s) hit the register (5 surfaces, repo-agnostic).
  ⛔  GOVERNED — a human merge is the review record for this PR (#9495 regime).
      No seat flips it ready, enqueues it, or arms auto-merge (AGENTS.md Prime Directive #14).
      .claude/** ×2 — the agent instruction tree (skills, agents, hooks, settings)

⇒ draft, human merge. No seat flips it ready, queues it, arms auto-merge, or approves it. skip-changeset: .claude/** ships in no package's files[] (fast lane, not published). Clause-②: no per the claim.

Deviations from the dispatch, stated

• The dispatch named the script path as the thing to cite; the line cites SINGLE_CLAIM_PATHS — the exported enumeration itself. The path is 38 bytes and no ≤120-byte spelling carried the path plus both halves of the rule (the closest, single-writer 只有 \scripts/check-single-claim-paths.mjs` 枚举的路径;其余共享路径是普通并发,后落地方解冲突。, is 136 bytes); git grep SINGLE_CLAIM_PATHSlands on the array inscripts/check-single-claim-paths.mjs`. The count is not hardcoded (所枚举), per the dispatch's mechanism assumption 2.
• The new rule needed two lines, not one; three deletions inside :438–442 paid them (table above). Two are duplicates; the depth-table provenance is not.
• The sweep window was widened to 09-05 in a second pass (the card asked for "recent"; the two-day pass alone could not answer personal-vs-lane-wide).
• The dispatch's suggested grep control word single-claim occurs nowhere in .claude/skills/** on the tree, before or after — it is not a control; batch (7 hits) was used instead.

验收备注 (noted, not filed)

• noted, not filed: LOCK_DEPTH_HOLD is a name that exists only in SKILL.md and core-rules.md — scripts/pm/os-verify-lock.sh neither defines nor prints it, so the depth table this PR removes was the only numeric provenance of the 2 anywhere in the tree; 承接者:无 (recorded here and in the commit that landed it).
• noted, not filed: the isolated review seat on fix(plugin-security): choose the platform-admin promotion target instead of sampling it — order the candidate read server-side and prefer the declared owner #16863 accepted the over-read as "true against the tree" — reviewer-side instance; 承接者:无 beyond this line landing.
• noted, not filed: the dispatch's single-claim control word (above); 承接者:the skills seat, next time it writes a grep control into a dispatch.

维护者速读(草稿)

改了什么

.claude/skills/pm-dispatch/SKILL.md 候选与批次段 :438–442 原地改写,总行数不变(812/812)、每行 ≤120 字节。新增两条规则:同批独立性按文件面判、⛔ 不按包也不按 check 名;single-writer 路径只有 SINGLE_CLAIM_PATHS 枚举的那几条,两个 open PR 共享其它任何路径都是普通并发,代价是后落地的一方解一次冲突。为付行数,删掉了同段内两处重复(priority:p0 可超 batch 与 :441 逐字重复;读数带 UTC 写进认领与 :163 重复)和一处出处数据(LOCK_DEPTH_HOLD = 2 的深度表)。等待不填槽 只是挪了位置。门禁脚本与 workflow 一字未动。

为什么改

四天里四个车道的派发席(services、cli、engine、devx)加一个复核席,把 CI 检查名 No other open PR may claim the same single-writer path 读成了「任何两个 open PR 共同改的文件都是单写手路径」,据此挡了本可派发的卡、给在跑的 dev 划了不该划的围栏、拒绝了本可顺带的修复。三个席位各自实测证伪过一次,但每次都停留在该席位的评论里,下一个会话又把错误模型捡回来。仓库里除了检查名,没有任何一处写着这条规则;本 PR 把它写在派发席判同批独立性时必读的那几行上。

风险与代价(含回滚)

• 风险一:删掉的深度表(深度 1/2/3/4 对应 exit 99 率 1%/23%/36%/56%)是 LOCK_DEPTH_HOLD = 2 的唯一树内出处;规则本身(深度 ≥ 2 即等)保留,出处退回落地它的提交 21e36a2d3(docs(pm-dispatch): read the verify-lock queue depth before each dispatch and hold at depth ≥ 2 (#14944 Q1 B) #16271)。若维护者认为出处必须留在文件里,替代方案是不写「不按 check 名」这半句并把两条新规则压成一条(信息损失在新规则一侧),或按棘轮头部的跨文件搬迁条款另立单处理。
• 风险二:行内引用的是导出常量 SINGLE_CLAIM_PATHS 而非脚本路径(路径 38 字节装不下);常量重命名会让这行失锚,与引用路径的风险同级。
• 回滚:单文件、单提交,git revert 即回到 854639b3 的五行原文。

席位意见

(留空)

你要做的

读一遍 :438–442 的五行,确认措辞与你对「同批独立性」和「single-writer」的本意一致;认可深度表出处退回 git 历史;人工合并(受管面,席位不翻 ready、不入队、不挂 auto-merge)。方向 (2)(改检查显示名)与方向 (3)(绿检查输出列出声明集)留给门禁所在车道自行决定。

🤖 Generated with Claude Code

https://claude.ai/code/session_01HxLw5aKDPR5RJgyUR7Exkd

Generated by Claude Code