chore(pm): the queue guard reads its record recognisers from record-recognisers.mjs; check-clause2-carriers.mjs is deleted

[objectstack-fleet]

Fixes #19061

维护者速读(草稿)

• 改了什么:队列守卫(Governed Surface Queue Guard)放行 .claude/** 时读 ## Contract review 记录所用的识别器,以及席位照抄的 --template 记录模板,从 10,220 行的 scripts/pm/check-clause2-carriers.mjs 原样搬进新文件 scripts/pm/record-recognisers.mjs(连同钉住它们的自测用例),然后删除旧文件。守卫改为懒加载新文件;lint.yml 里原先跑旧文件自测的那一步改指新文件(不是新增门禁);contract-review.md 两处 --template 指针改写为新命令。
• 为什么改:裁决 B(三层归一)的最后一步。前三步已落地;旧文件只剩守卫一处懒加载在用,其余(--pair 扫描、C1–C9 行、认领读取器)早已退役、无人调用。
• 风险与代价(含回滚):守卫的判定不变 —— 守卫自测改前改后都是 279 例全过;搬过去的识别器由新文件自测 110 例和守卫自测两头钉住。回滚 = revert 本 PR。代价:本 PR 改动 11,684 行(+1,392 / −10,292),超过 5,000 行的人工合并线。

席位意见

建议批准并合并;这是裁决 B(三层归一)的最后一步,做的全是减法。 一万行的 check-clause2-carriers.mjs 删掉,队列守卫懒加载的那几个记录识别器和 --template 原样搬进 1,324 行的 record-recognisers.mjs(含它们自己的 110 个自测例);守卫指向新文件,懒加载没动(dev 用消融证明一改成即时加载就死锁,所以懒加载必须留);--template 输出 40 行里后 39 行逐字节相同,只有第一行改名。lint 工作流那一步是改指向不是新增,步数不变;contract-review.md 两处指针跟着改,行数 24 → 26,天花板 60。席位在新 worktree 上重跑:识别器自测 110、守卫自测 279、半态自测 4897、十个门禁全 0。之所以要你点合并:改动行数 11,684 超过 5,000 的人工合并线(删除也计数),不是档位问题。合并即 Fixes #19061,四步全部落地。复核记录:PR 评论 5790479344(PASS,在席按服务档渲染);ACCEPT 在卡 #19061。CI 读数:36 latest-per-name check runs — 30 success, 6 skipped, 0 in progress, 0 other。

• 你要做的:席位贴出当前 head 的 ## Contract review PASS 记录、所有检查全绿之后,请您手动点合并 —— 超 5,000 行的 PR 按规则只能人工合并,队列守卫的 size 腿会拒绝入队。

Clause-②: no

What this does

Ruling record 5770886272 (letter B), its last step, named on Release 5789425558. Four commits, one per class, so a reviewer can bisect:

1. a4a16863e — the module. scripts/pm/record-recognisers.mjs holds exactly what check-governed-queue-guard.mjs reads from the old file — through loadRecordRecognisers (locateReviewOfRecord, deliveredCardNumber, servedTierStands, isModelIdentifierToken, REVIEW_OF_RECORD_THREADS, REVIEW_OF_RECORD_LOCATION) and in its self-test through RECOGNISER_SOURCES.tier (CONTRACT_REVIEW_TIER_NAME, unexplainedPathsBetween) — plus what those are built from (readServedTier, the stamp control, the regeneration carry, REVIEWED_BY_LINE, DELIVERY_EVIDENCE_PRECEDENCE) and the record template (contractReviewTemplateLines, contractReviewRecordLines, RECORD_TEMPLATE_PLACEHOLDERS, the two fences) with a --template CLI. The code blocks are verbatim slices of the old file's blob at 2cf9db7c4; ten docblock sentences that named a deleted function as live are corrected, each listed under Deviations. The self-test cases that pin these readers moved with them (110 cases, six batteries, roster floor and verdict handshake); the cases that read the retired rows did not.
2. baa17b116 — the re-points. The guard's RECOGNISER_SOURCES.tier is ./record-recognisers.mjs (still a LAZY import from a function body), its renamed-source pin and docblocks follow. The lint.yml step that ran the old self-test is retargeted to pnpm check:pm-record-recognisers — ⛔ not a gate added beside it. references/contract-review.md :13 / :19 now point at node scripts/pm/record-recognisers.mjs --template. Present-tense prose that named the old file as a live importer, location or message is re-pointed (list below).
3. 81b3469d6 — the deletion. scripts/pm/check-clause2-carriers.mjs (10,220 lines) is removed, and with it, not re-homed: the --pair scan and its readers (derivePairs, C1–C9, pairRows, the read-path ladder, the input record), the claim readers no live importer used, the local copy of the retired label constant, and the self-test battery of those parts.
4. Two merges of origin/main (the last at 98d83361d); neither touches a file this PR edits.

Measured premises

• H1 holds. At 2cf9db7c4 the guard's RECOGNISER_SOURCES.tier read ./check-clause2-carriers.mjs. git grep for a statement-shaped import/from of the file: zero hits. With the file deleted in the worktree before any re-point, 27 scripts/pm/*.mjs --self-test runs (every one but dispatch-gates.mjs, whose battery takes about 12 minutes, and check-dispatch-gates.mjs) plus check-governed-merges.mjs --test and first-party-closure.mjs were compared with the same runs with the file present: the ONLY exit that moved was the guard's self-test, 0 → 1 (ERR_MODULE_NOT_FOUND). Both omitted batteries passed on the final tree (Tests). The one other consumer was CI's own invocation (lint.yml:1267 through the check:pm-clause2-carriers alias), retargeted here.
• H2 — first half holds, second half is falsified. The guard's self-test passes 279/279 before and after, with the renamed-source pin updated. The cycle was re-measured through the new file by ablation: a module-scope import of record-recognisers.mjs planted in the guard exits 13 with Detected unsettled top-level await at .../check-half-states.mjs:9765; restored byte-identical (blob a2fd67afc6bb == HEAD, git diff HEAD empty). But a fresh node -e import of the new module DOES load the guard: it imports check-half-states.mjs for the record readers and deliveryEvidence, and that file's module-scope top-level await imports the guard — exactly as the old file did. Avoiding it would mean restating check-half-states.mjs' readers, which the module's own rule forbids; this is why the guard's import stays lazy.
• H3. See Tests. check:first-party-closure does not exist: scripts/first-party-closure.mjs is a library with no CLI; its consumers' self-tests ran (check-adr-0087-registration 441 assertions, check:objectui-changeset).
• H4. No overlap: origin/main moved 2cf9db7c4 → 98d83361d during this work and touched none of these files.
• H5. 11,684 changed lines (+1,392 / −10,292, 12 files) — OVER the 5,000 human-merge threshold. The deletion was not split to dodge it.

--template, before and after

40 lines both times; lines 2–40 byte-identical. Line 1 names the tool that prints it — record-recognisers --template instead of the deleted check-clause2-carriers --template.

Tests — at HEAD 5c24980ef

• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no paths) derived 85 commands at 5c24980ef, byte-identical to the list derived at bfe5b9917 before the last merge; all 85 were run on 5c24980ef, each exit captured before any pipe, and --ran answers ✓ dispatch-gates --ran: 85 derived famil(ies) accounted for — 82 run, 3 NOT-MEASURED (3 DERIVED from a recorded exit 3).
• NOT MEASURED, declared — five families that read BUILT dist/ output, with no workspace package built here (74 of 78 build tasks are cache misses): check:dual-build-cjs-loads, check:lean-entry-closure and check:type-check-debt exit 3 PREREQUISITE NOT MET; check:dts-closure and check:sourcemap-no-sources-content exit 0 but swept only the 4 packages built for check:doc-formula-expressions (formula, lint and their closure), a partial population and not a measurement of the whole. This diff changes no workspace package's source, manifest or build — only the private root package's scripts map — so none of their verdicts can move; CI builds the closure and runs them.
• pnpm check:pm-record-recognisers → ✓ record-recognisers self-test: 110 cases pass. Ablations through scripts/ablation-replace.mjs, each landed on disk and restored to the HEAD blob: servedStampsHold made to accept any control → 3 of 110 red; DELIVERY_EVIDENCE_PRECEDENCE reordered → 2 of 110 red.
• node scripts/pm/check-governed-queue-guard.mjs --self-test → ✓ check-governed-queue-guard self-test: 279 cases pass (279 before the change too).
• pnpm check:pm-dispatch-gates → ✓ dispatch-gates self-test: 1905 cases pass. · pnpm check:pm-half-states → 4897 cases · pnpm check:pm-widening-tells → 525 · pnpm check:pm-expected-skips → 99 · pnpm check:closing-target-claim → 105 · check-changeset-no-major --self-test → 339 · check-adr-0087-registration --self-test → 441 · check-self-test-wired → every one of the 229 script(s) CI runs that ship a --self-test has that self-test run by CI · pnpm check:pm-skill-ratchet → contract-review.md is 26 lines (ceiling 60; headroom 34), every line at most 120 bytes (measured widest 118) · pnpm check:skill-frame-sync, pnpm check:doc-authoring, pnpm check:declared-population-live, pnpm check:nul-bytes, check:doc-formula-expressions (after building formula and lint under the verify lock) → exit 0.
• ESLint, a proven narrowing: the population is eslint.config.mjs's files: ['**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}'] object minus NEVER_LINTED, which covers scripts/**; eslint --no-inline-config --format json over the 8 changed .mjs files reports 8 files, 0 errors, 0 warnings; the config enables no type-aware linting (--print-config shows parserOptions of ecmaVersion and sourceType only), so the diff cannot move the verdict of any file it does not touch.
• node scripts/pm/check-governed-merges.mjs --test over the three-dot path list → GOVERNED, Tier S (contract-review.md is the one register hit).

Deviations

• The module has its own --self-test, and the lint step is RETARGETED, not removed. The moved docblocks cite pins ("the self-test drives THIS function's output", "a MIRROR, so the self-test MEASURES it", "the cross-tool pin in this file's self-test"); moving the docblocks without those pins would have left them false, and the kept readers would have lost their unit cases. What moved is only cases that exercise a function this file owns.
• --template line 1 names the new tool (above) — the dispatch asked for the old output exactly; a banner naming a deleted file is the one line changed.
• references/contract-review.md grows 24 → 26 lines: each re-pointed line is wrapped once, because the new spelling would push both past the 120-byte line cap (they were 119 and 104 bytes). No other line's text changed.
• scripts/first-party-closure.mjs :21 is unchanged: it is past-tense narration of the [finding] An accept-set narrowing owes a **BREAKING** banner in core but not in platform-objects — and the ADR-0087 classifier reads the banner #16421 measurement, not a closure list — the closure is computed from import edges, so the deletion needs no edit there.
• Docblock corrections inside the moved code (each the one sentence that named a deleted function or constant as live): the regeneration hop's printable shape, the carry memo's reason, the value-decoration strip, the authorship reader comparison, the CLAUSE2_CORRECTION_KEY_LINE aside, the repo-shape example "below", the template round-trip reader, the derivePairs / H31 askers, the reviewOfRecord "below", and the template banner. REVIEWED_BY_LINE is now keyLineRegex('Reviewed-by') (the same regex the deleted AUTHORSHIP_KEY_LINES built; pinned equal by source in the self-test).
• Prose re-pointed outside the named list: scripts/pm/clause2-line.mjs (its docblock described this very step as pending) and one runtime usage line in scripts/pm/check-widening-tells.mjs (--repo refusal named the deleted file as the convention's reader; it now names check-half-states.mjs). In check-half-states.mjs one runtime sentence drops its clause about the deleted reader.

Acceptance notes

• scripts/pm/check-widening-tells.mjs' docblock still narrates its only caller, the deleted --pair (the C5 row, an exit register "pinned in THAT file's self-test", the caller section). Left as history rather than rewritten; the tool now has no caller besides its own self-test. carrier: 承接者:无.
• History left as history: check-skill-line-ratchet.mjs :437 / :483 (raise ledger), dispatch-gates.mjs :6799 (an import-edge measurement), check-changeset-no-major.mjs :1452 (a phrase attribution), check-half-states.mjs :1404 / :2740 / :24659, the two docs/audits/ census snapshots.
• The template's calibration notes still describe retired mechanics — "refused HALF WRITTEN" (the retired C4 row) and "FAIL strips the two carriers" (the retired carrier discipline). Kept byte-identical because seats paste this output and the dispatch pinned it.
• Exports left with no importer by the deletion: CLAUSE2_VALUES / CLAUSE2_ARMS in clause2-line.mjs, bindingClosesCard in check-half-states.mjs. Not touched.
• Pre-existing, unrelated, identical before and after this diff: node scripts/pm/measurement-claim-triage.mjs --self-test exits 1 on origin/main (UNTRIAGED scripts/check-dts-references.mjs:74); it is not wired into CI.

---

Generated by Claude Code

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 5c24980efc02f62946cc48c5cac979212d269e87

① Derived judgments

Rendered in-seat by the skills seat 1 session at the served tier the maintainer named (ruling record 5771798588; 「契约复审继续用 fable 不变」 5788482806 of this date). The contract is ruling B on #19061 (5770886272, 三层归一), step ④ as named on the step-③ Release 5789425558 and the claim 5789522248: the record recognisers and --template leave scripts/pm/check-clause2-carriers.mjs into one small module the queue guard imports, then the file is deleted with the retired --pair scan and the label constant; the two --template pointers in references/contract-review.md follow; ⛔ no gate added, ⛔ no change to what the guard decides.

• (a) The diff — measured by this seat on a review worktree at the head. Five commits on merge-base 0b83e0162 (the module a4a16863e, the re-points baa17b116, the deletion 81b3469d6, two merges of origin/main); 12 files, +1392 / −10292 = 11,684 changed lines. scripts/pm/check-clause2-carriers.mjs (10,220 lines) is gone; scripts/pm/record-recognisers.mjs (1,324 lines) carries exactly what check-governed-queue-guard.mjs lazy-imports — locateReviewOfRecord, deliveredCardNumber, servedTierStands, isModelIdentifierToken, REVIEW_OF_RECORD_THREADS / REVIEW_OF_RECORD_LOCATION, CONTRACT_REVIEW_TIER_NAME, unexplainedPathsBetween, the record template and a --template CLI — with the 110 self-test cases that pin those readers; the guard's RECOGNISER_SOURCES.tier at :659 now reads ./record-recognisers.mjs, the lazy import untouched (the dev's ablation planted an eager import and got exit 13 「unsettled top-level await」 — the cycle the :622–:669 docblock describes still exists through check-half-states.mjs, so the laziness stays load-bearing, as the dispatch said it must).
• (b) The --template output, compared by this seat. 40 lines from the old file on origin/main and 40 from the new module; lines 2–40 byte-identical, line 1 names record-recognisers --template instead of the old file — the copyable record of record is unchanged.
• (c) The pointers and the retargets. contract-review.md :13 / :19 → :13–:14 / :20–:21, each wrapped once under the 120-byte cap (24 → 26 lines, ceiling 60, check:pm-skill-ratchet 0); .github/workflows/lint.yml :1250–:1263 — the self-test step is RETARGETED to pnpm check:pm-record-recognisers, step count unchanged (the moved pins need their CI runner; not an added gate); package.json :85 the script renamed; prose re-points in clause2-line.mjs, check-expected-skips.mjs, check-closing-target-claim.mjs, check-adr-0087-registration.mjs, check-half-states.mjs, check-widening-tells.mjs (each a sentence that would otherwise name a deleted file as live). Residual mentions of the old name on the head (the seat's git grep: lint.yml 1 comment, check-half-states.mjs 6, check-widening-tells.mjs 11 docblock lines, check-skill-line-ratchet.mjs 2, dispatch-gates.mjs 1, clause2-line.mjs 2, first-party-closure.mjs 1 narration, two audit docs) are history, none a mechanism — and the closure list the dispatch named at first-party-closure.mjs :21 is narration of a past measurement, correctly left.
• (d) The deletion is safe by measurement, not by claim. The dev's deletion leg ran 27 scripts/pm self-tests plus check-governed-merges --test with the file present and deleted before any re-point: only the guard's self-test moved (0 → 1 ERR_MODULE_NOT_FOUND) — the guard was the only live importer, as the step-③ review had read. Exports the deletion orphaned (CLAUSE2_VALUES / CLAUSE2_ARMS in clause2-line.mjs, bindingClosesCard in check-half-states.mjs) are dead exports, noted, not widened into this PR.
• (e) Gates — re-run by this seat on the review worktree at the head after pnpm install --frozen-lockfile --offline. check:pm-record-recognisers 0 (110 cases); check-governed-queue-guard.mjs --self-test 0 (279, unchanged); check-half-states.mjs --self-test 0 (4897); check:pm-skill-ratchet 0; check:skill-frame-sync 0; check:doc-authoring 0; check:pm-skill-id-lint 0; check:pm-governed-prose 0; check-self-test-wired.mjs 0 (229 scripts wired — the lint step retarget keeps the moved self-test run by CI; the seat's first attempt through the pnpm wrapper returned an empty exit 254 and the direct run is the reading); check:entry-guard 0; check:pm-expected-skips 0; check-governed-merges.mjs --pr 19803 exit 3 — GOVERNED Tier S (.claude/** ×1: contract-review.md) and HUMAN MERGE (11,684 changed lines over the 5,000 line, generated files included, the 2026-09-18 ruling — the same terminal as a Tier H diff). The dev's derivation: 85 families by --commands, --ran 82 / 85 / 3 NOT-MEASURED (dist-reading gates on an unbuilt workspace, no package touched), the 1905-case dispatch-gates self-test, ablations on servedStampsHold (3 red) and DELIVERY_EVIDENCE_PRECEDENCE (2 red) restored clean. CI at the head at the seat's read: 34 latest-per-name check runs — 21 success, 6 skipped, 7 in progress; the 四件套 waits for green.

② Semver level

None — no release. scripts/pm/**, .claude/**, .github/** and the private root package.json are in no package's files[]; skip-changeset written through label-write.mjs with read-back (the dev's report).

③ Boundary flags

• HUMAN MERGE by size (the register's size limb, not a tier): the seat does not ready, enqueue or arm auto-merge; on green the 四件套 — ACCEPT on the card, needs-user-decision on the PR, 席位意见 in the body, review requested from GOVERNED_APPROVERS — and the maintainer clicks merge; Fixes #19061 closes the card at that merge, ruling B complete.
• Deviations, all correct readings: the lint step retargeted rather than removed (above); --template line 1 renamed; first-party-closure.mjs :21 left as narration; two files re-pointed beyond the dispatch's list (clause2-line.mjs, check-widening-tells.mjs) — pointers, in scope; the dispatch's check:first-party-closure gate name was this seat's error (no such gate; the library's consumers' self-tests ran).
• Report 5790420237 on the card parses; mcp_calls 0; three REST writes through the fleet-write relay plus five pushes; no body PATCH by the dev; the worktree removed by the dev after the PR opened.
• Out of scope, noted by the dev, ⛔ not touched: measurement-claim-triage.mjs --self-test exits 1 on origin/main itself (an untriaged magnitude in check-dts-references.mjs :74; not wired into CI) — class a, a filing this seat's identity cannot make → the maintainer's items; check-widening-tells.mjs's docblock narrates the deleted caller (history, 11 sites); the template's calibration notes describe retired mechanics — the seat pinned those bytes and re-spells them in its own later PR; the dead exports above.

Implemented-by: claude/issue-19061-step4-record-recognisers-module
Reviewed-by: session_01Wnstp2kTth7sGXfr8fXypc

VERDICT: PASS

[objectstack-fleet]

Standing down on the queue refusal — this PR lands only by 人工直合, not through the merge queue. domain:skills seat 1 (session_01Wnstp2kTth7sGXfr8fXypc, seat post #7623), 2026-09-23T07:50Z. ⛔ Not a code failure; no patch round is owed and the seat pushes nothing.

What was measured (REST + the job log, read this act):

• Timeline: ready_for_review and auto_merge_enabled by hotlong at 07:30 UTC of this date, added_to_merge_queue 07:31:44 UTC, removed_from_merge_queue by github-merge-queue[bot] 07:43:41 UTC, reason CI_FAILURE.
• The failing group check: workflow run 35832209082 (Governed Surface Guard, merge_group, gh-readonly-queue/main/pr-19803-502f179cc…), job 107087199445, step 「Governed surfaces may not enter the merge queue unreviewed」 — check-governed-queue-guard.mjs exit 8. Its governed leg CLEARED (Tier S, hotlong's authorized APPROVED review counted); its Human-Merge Size Line limb REFUSED: 「chore(pm): the queue guard reads its record recognisers from record-recognisers.mjs; check-clause2-carriers.mjs is deleted #19803 — ⛔ 11684 changed line(s) (+1392 / -10292) EXCEEDS the human-merge line 5000 … this pull request lands only by a HUMAN MERGE」. The other four group runs (CI, Lint & Type Check, Closing-Target Claim Guard, Spec Liveness Check) were green or still running; none failed.
• Ruleset main (GET /rulesets/12119582): merge_queue SQUASH + Governed Surface Queue Guard in the required set; the bypass_actors key is absent to this token (unreadable, exactly the finding(skills/governed-surface): the queue guard's size limb prescribes a HUMAN MERGE (人工直合) that the main ruleset makes unreachable — merge queue mandatory, the guard required, bypass_actors empty — so PR #19024 was enqueued three times by the maintainer's accounts and refused three times #19344 reading), so the seat cannot say whether a bypass actor is configured right now.

The one door this PR has — as the guard's own remedy text states it and as #19344 (maintainer item 6) narrowed it: the Merge button's bypass-rules option (「Merge without waiting for requirements to be met」), offered only while ruleset main lists a bypass actor (the Repository-admin role or the GOVERNED_APPROVERS accounts). PR #19024 landed exactly this way on 2026-09-20 (merged_by os-zhuang). ⛔ Every re-enqueue comes back to this same refusal: the size limb is not lifted by an APPROVED review, by the seat's ## Contract review PASS (5790479344, head 5c24980ef), or by green CI — all three already stand on this head.

Seat position: the 四件套 is complete (ACCEPT 5790743219 on #19061, needs-user-decision, the 席位意见 block in this body, review requested from os-zhuang / hotlong). The PR stays ready and out of the queue with auto-merge off (the dequeue disarmed it); the seat neither re-drafts it nor re-arms anything. ⭐ Ask of hotlong / os-zhuang: land it by the bypass-rules merge (squash), or tell the seat to park it as draft. The seat confirms the landing by content on origin/main (scripts/pm/record-recognisers.mjs present, check-clause2-carriers.mjs absent) and then closes out #19061 (Fixes).