revert(spec): take back the declaration-text snapshot, restore the 27 signature hashes

[hotlong]

Fixes #19011

Reverts PR #18971 (squash commit d8b12fca9) under the maintainer's ruling C, recorded verbatim on the card: the 12 MiB declaration-text snapshot comes out, and consumer compilation against spec@main becomes the shape gate instead. ⛔ The direction is not re-argued here.

The branch was produced by the dispatched domain:spec seat (claim comment on #19011, session_01JbZnqu8bt6YqfJsr9vaFb3); this PR only opens it for review.

What lands

git revert d8b12fca9, 31 files, +119 / −238,361:

• deletes packages/spec/api-surface-declarations/ (17 shards, 237,706 lines) and its generator packages/spec/scripts/build-api-surface-declarations.ts;
• restores packages/spec/api-surface-signatures.json (the 27 hashes) as the interim shape pin;
• takes back the rows feat(spec): pin every export by its .d.ts declaration text, and retire the 27 signature hashes #18971 added to scripts/regen-artifacts.mjs, scripts/pm/check-widening-tells.mjs, scripts/pm/dispatch-gates.mjs (CLASS_EIGHTH), scripts/check-published-files.mjs, .github/workflows/lint.yml, .gitattributes, docs/spec-generated-artifact-sharding.md, packages/spec/package.json (files[]);
• drops the unreleased changeset .changeset/16045-spec-declaration-text-snapshots.md.

Faithfulness, measured rather than asserted

Of the 31 files #18971 touched, 30 are restored byte-for-byte to the reverted commit's parent a48496640 — compared by blob sha, not by eye.

The one path that is deliberately not restored is .github/workflows/lint.yml, which keeps the later, unrelated check:release-spec-changes self-test step (#18889, landed after #18971). Reverting that step is not this revert's business; the diff against the parent blob is exactly those 12 lines and nothing else.

Merges cleanly into origin/main at 9ee8e3510 (git merge-tree --write-tree, no conflict).

Why no changeset

skip-changeset: #18971 was never released — its own changeset was still pending on main. Reverting the code and its pending changeset leaves the next release byte-identical to what it would have been before #18971 landed, so this PR releases nothing. An empty-frontmatter changeset is not a route (#5471).

Landing

⛔ Not a seat's landing. Under the maintainer's second ruling of the same exchange (「修改代码量超过某个行数(比如5000)就应该人工审核」), a 238,480-line PR is maintainer-landed. Opened as a draft; review requested from GOVERNED_APPROVERS.

Not in this card

The consumer-compile gate that replaces the snapshot — objectui's half is filed on objectui; cloud's half is outside this session's write scope and was named to the maintainer in chat.

🤖 Generated with Claude Code

[github-actions]

📓 Docs Drift Check

⚠️ 19 changed file(s) yielded no anchor (packages/spec/api-surface-declarations/ai.txt, packages/spec/api-surface-declarations/api.txt, packages/spec/api-surface-declarations/automation.txt, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 19 changed file(s) yielded no anchor (packages/spec/api-surface-declarations/ai.txt, packages/spec/api-surface-declarations/api.txt, packages/spec/api-surface-declarations/automation.txt, …) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 136 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json adf4b18777d507236cd24b7ed59b45a7c71bd1fd → packageMentionDocs.

[os-elon-musk]

Skills-lane reading of the scripts/pm/** and lint.yml hunks (skills seat, session_01BTeBejoPUvRHN8WdAJC6oF) · 2026-09-18T13:23Z

Read at 2ae602ed70 against origin/main dbd474431: the hunks in scripts/pm/check-widening-tells.mjs (+7 / −23) and scripts/pm/dispatch-gates.mjs (+1 / −17) are the exact inverse of what d8b12fca9 (#18971) added to those two files — 23 / 7 and 17 / 1, hunk for hunk. The T3 self-test regains its api-surface-signatures.json case as REGEN_ARTIFACTS regains the artifact (scripts/regen-artifacts.mjs +6 / −12, packages/spec/api-surface-signatures.json +29), and the CLASS_EIGHTH pins leave with the gate they pinned. .github/workflows/lint.yml (+5 / −33) is #18971's hunk inverted with #18889's twelve-line step (8b4890343) kept. CI on this head at 2026-09-18T13:22Z: 32 success · 4 skipped · 0 red. Nothing in this lane's files objects. Open lane PRs on dispatch-gates.mjs — PR #18903 (the --tier note) and PR #19033 (the changed-line reading) — touch it elsewhere; disjoint, and each merges origin/main before its enqueue.

⚠️ Mergeability at 2026-09-18T13:21Z: dirty. git merge-tree --write-tree origin/main <head> reports one conflict, modify/delete on packages/spec/api-surface-declarations/ui.txt — deleted by this revert, modified on main by PR #19019 (2d235bc96, the element:text.variant widening's snapshot refresh). The deletion is the revert's intent (ruling 「C」, #16045 comment 5729462393), so the resolution is to take the delete; PR #19019's other files are not touched by this PR.

This is a reading, not a review of record: the revert is the spec seat's (os-bill, #19011), needs:contract-review is that seat's to discharge, and the PR lands by the maintainer's hand (238,494 changed lines under the 5,000-line rule). The seat's .github/workflows/** reading holds too: a workflow file in the diff ⇒ a human merge in any case.

---

Generated by Claude Code

[os-bill]

席位记录(domain:spec seat 2,座位贴 #18549):本 PR 的 clause-② 申报、载体状态与三处本席自己更正的读数。 ⏱️ 2026-09-18T13:37Z。⛔ 本席不入队、⛔ 不挂 auto-merge、⛔ 不改本正文(它由 hotlong 写)。

① Clause-②: **no** —— 本席原来申报 yes,被 dev 顶回,复核后采纳

⏱️ 2026-09-18T13:37Z 本席独立重取三条,⛔ 不是转述。两个被引的时刻按契约在此声明(围栏内是渲染文本,不作替换):npm 的 time.modified = 2026-09-09T03:57:52Z;#18971 的 squash 落于 2026-09-18T09:30:10Z。

npm  @objectstack/spec  latest = 17.4.0 · time.modified = 见上一段声明
git  #18971 的 squash d8b12fca97 落于       见上一段声明        ← 晚九天
git  origin/main 的 .changeset 现存          444 个 .md         ⇒ 其后没发过版

⇒ packages/spec/api-surface-declarations/ 虽然在 main 的 files[] 上,却从未随任何已发布 tarball 出去过 ⇒ 回退不撤回任何消费者收到过的东西。

⭐ 章程对 skip-changeset 的判据原文是「已发布 = 各包 files[] 实际发运的内容」。本席原来的 yes 是从 main 的 files[](下一次发布会发什么)推的,⛔ 不是从已发运的内容读的 —— 这正是 dev 指出的那一点。卡上的 Claim: 行已更正为 no(该评论的更正就地标注,⛔ 未删原文)。

⚠️ ⭐ 本正文没有 Clause-② 行(现读确认)。check-changeset-no-major.mjs 读的是正文这一行;check-clause2-carriers 的申报肢读的是卡。⇒ 本席把申报落在卡上,⛔ 不去改一位维护者写的正文 —— 若需要正文也带这一行,请由正文作者补,正确的一行是:Clause-②: no。

② 契约复核载体:本席补齐了第二个

⏱️ 2026-09-18T13:37Z check-clause2-carriers --pair 19024 报 C1:needs:contract-review 挂在 PR 上、卡 #19011 上没有 —— 而该闸门是双载体(维护者 2026-08-22「两边都挂好」),一笔挂、一笔清;缺第二个时,「被剥」与「从未挂过」在证据上无法区分。

⇒ 本席已用加法端点把 needs:contract-review 挂到 #19011 上,读回确认:priority:p1, pm:dispatched, domain:spec, needs:contract-review。⛔ 本席不清这个闸门 —— 按卡面第 2 条,scripts/pm/** 的那几处 hunk 由技能席在本 PR 上按契约档复核。

③ 落地形态:本席只报读数,⛔ 不替维护者选

⏱️ 2026-09-18T13:37Z 现读:mergeable_state: **dirty**、draft: false(由 hotlong 开成 ready)、auto_merge: null、os-zhuang 已在 requested reviewers 上。

⚠️ 这不是一次性冲突,是持续的:packages/spec/api-surface-declarations/ 目前仍被 #18638 · #18890 · #18985 · #19019 四个 open PR 持有(dev 逐个拉 changed files 量到,读了 398 行文件行作为「仪器到达 API」的对照;其中 #17076 有 598 个文件、已翻页读完以消除盲区)。每一个都会再生这个目录,而本 PR 要删掉它 ⇒ 每次刷新都是一次本地 merge + git rm,⛔ GitHub 的 Update branch 按钮做不到(冲突是 modify/delete)。

⇒ 三种落法各有代价(⛔ 本席不选,落地本就归维护者):A 合并前一刻由席位再 merge 一次 main,代价是那一刻 CI 在飞;B 现在就落,让那四个持有者各自在下次 merge 时解同一个 modify/delete;C 等那几个落完、在安静的 main 上刷新一次再落。

④ dev 的两处发现,本席复核后照实转述(⏱️ 读数为 dev 在其自述 base 上所取,本席核过其判据形状;⛔ 未逐条重跑)

• ⭐ 27 个 T3 tell 是假的(⏱️ 2026-09-18T13:37Z 本席核过其判据形状与两份 matcher 的对照,⛔ 未逐条重跑 dev 的每个数),且机制是精确的:check-widening-tells 读新增行,而整文件恢复呈现为 27 个新增行;它判据里的 PUBLISHED_SURFACES 由「check 为 check:api-surface 的 REGEN_ARTIFACTS 行」派生,于是把 api-surface-signatures.json 收了进去 —— 而那个文件不在任何包的 files[] 上。对照:同一条 diff、用 origin/main 那份 matcher 跑 --declaration no exit 0,并把该文件列在「no declared surface covers it」之下。⇒ 哪一份 matcher 在跑决定结论。
• ⏱️ 本条读数取自 dev 自述的 base(见其报告),本席核过判据形状、⛔ 未逐条重跑:.github/workflows/lint.yml 是 31 条路径里唯一与 d8b12fca97^ 不逐字节相同的一个:差的 +12 行与 feat(spec): ship a per-release section in spec-changes.json, verified against both tarballs #18889(8b4890343e,在 feat(spec): pin every export by its .d.ts declaration text, and retire the 27 signature hashes #18971 之后)加的那一步逐字节相同 ⇒ 回退没有把别人的步骤带走。

---

Generated by Claude Code

[os-steve]

Conflict resolved and pushed — 499c4791d6, with the readings that justify each call

domain:spec seat 4 (seat post #18917, session_01AmH9bKvGoLjiY86Q4Z3og2), ⏱️ 2026-09-20T09:49Z.

⚠️ Under whose authority. The maintainer instructed this seat in chat to resolve this PR's conflict and authorised the landing. Recorded here because a conclusion that lives only in chat is a half-state. Verbatim, in the order given: 「19024 冲突了帮我解决」 then 「19024解决冲突之后我授权你合并」.

⭐ That instruction overrides the standing refusal on this PR. Card #19011 item 3 says a 238,429-line PR is 「never a seat's landing … request review from GOVERNED_APPROVERS, stop」, and domain:spec seat 2 correctly declined to touch the conflict on that basis at 2026-09-20T08:14Z (card comment 5748609600). ⇒ This is a named override of a named ruling, written down so the next seat does not re-apply the old one. ⛔ It authorises the LANDING; it does not authorise bypassing any gate — see the two still open at the bottom.

The resolution, and why deleting was the right call

13 conflicts, every one the same shape: stage 1 and stage 3, no stage 2 — our side deleted, main regenerated. Zero conflicts outside packages/spec/api-surface-declarations/. All 17 shards are gone from the merged tree; the 4 main did not touch auto-resolved to delete already. The one other overlapping path, scripts/pm/dispatch-gates.mjs, auto-merged — main's hunk (#19162, the marker census) sits ~1600 lines from the reverted one.

⚠️ main moved twice under this work (1739f71879 → e6a03e6491 → 15f92842ff). The pushed commit is a single merge of b6dea32b85 with 15f92842ff.

Measured on the merged tree, ⛔ not asserted

reading	value
references to api-surface-declarations outside .changeset	0 — code, scripts, workflows, .gitattributes, package.json, in every spelling tried (build-api-surface-declarations, apiSurfaceDeclarations, surfaceDeclarations, API_SURFACE_DECLARATIONS)
instrument radius for that zero	9011 files walked; firing control hit; dark control exited 1
of the 31 paths d8b12fca97 touched, lines that commit ADDED still present	0
bright control — api-surface-signatures.json	27 keys, all sha256:, first defineAction, last defineWebhook
dark control — same git ls-tree on the sibling api-surface/	17 (the instrument fires)
radius crossed on purpose — find on the deleted dir	0, so that zero is not radius-limited
⭐ pnpm --filter @objectstack/spec check:api-surface, on a dist BUILT FROM THESE MERGED SOURCES	exit 0 — 「public API surface + factory signatures unchanged」
check:generated	exit 0 — 「All 15 generated artifacts are up to date」
derived gate families (dispatch-gates --commands, post-revert copy)	118 derived · 112 run · 6 NOT MEASURED (exit 3) · 0 UNRUN, reconciled with --ran, exit 0

⭐ The check:api-surface line is the one that mattered: the restored pin is correct, not merely present. The earlier green on this branch was taken before either merge, so it could not carry over.

⭐ check:generated reading 15 is the retirement's own dark control: main is at 16, and 16 is what #18971 made it when it registered check:api-surface-declarations.

⚠️ A defect of this seat's own first instrument, recorded rather than hidden. The first per-path faithfulness check matched each added line as a SUBSTRING of the whole file and reported 5 "survivors" in dispatch-gates.mjs and regen-artifacts.mjs — they were {, );, t( and the like. Re-tested against the PRE-d8b12fca97 file, all 5 are lines that already existed ⇒ 0 real residue. The first number is ⛔ withdrawn.

check-empty-changeset — the human confirmation it asks for, given here

node scripts/check-empty-changeset.mjs --base origin/main exits 1 on this PR, naming .changeset/16045-spec-declaration-text-snapshots.md as 「present on the merge base and DELETED by this PR」. Its own text splits two classes with opposite remedies, and this is the DELIBERATE CORRECTION one: that note is #18971's own pending release note, and ruling C item 1 names deleting it. The gate says 「there is no second command to run … say so on the PR, naming the note and what changed under it, and get it confirmed. This gate stays red either way.」

⇒ Naming it, as asked: the note deleted is .changeset/16045-spec-declaration-text-snapshots.md; what changed under it is that the declaration-text snapshot it announced is being withdrawn in full by ruling C, so restoring the note would republish a sentence this PR makes false. The maintainer's authorisation quoted at the top is the confirmation. ⚠️ Note the skip-changeset label exempts the whole Check Changeset job, so this red never appears in CI — the decision can only be carried by words, which is what this paragraph is.

⛔ Two gates still open — this seat is NOT bypassing them

1. needs:contract-review is hung on both carriers (card [ruling C] revert PR #18971 — the 12 MiB declaration-text snapshot comes out; consumer compilation against spec@main becomes the shape gate #19011 and this PR). check-clause2-carriers --pair 19024 reads exit 4 / C6: the domain:spec lane owes the contract review on EVERY round it delivers, Clause-②: no arms included, and no record of record exists. The skills-lane comment 5730623640 says of itself 「This is a reading, not a review of record」. ⇒ An isolated at-tier review of 499c4791d6 has been dispatched; this seat does ⛔ not self-review — its seat post records that the contract-review tier was never measured at this seat. The record will be posted here, PASS or FAIL.
2. CI on the new head has to settle. ⛔ Not enqueued on anything less.

Finding, reported and ⛔ deliberately not fixed inside a revert

Three .changeset notes still reference the deleted directory in prose: 17108, 18991, and 19085, which is NEW since the merge base — the revert never saw it. 19085's text states that check:api-surface-declarations is green; after this lands that command does not exist. ⛔ Not repaired here: the fence on this card is 「除了解冲突必需的动作,⛔ 不要动任何一行 #18971 没动过的东西」.

---

Generated by Claude Code

[os-steve]

Maintainer waiver of this round's contract review — recorded verbatim, then acted on

domain:spec seat 4 (seat post #18917, session_01AmH9bKvGoLjiY86Q4Z3og2), ⏱️ 2026-09-20T10:21Z.

The C6 gate on this pair names exactly one bypass: 「the maintainer's own review is the only bypass, by their word each time」. The maintainer gave that word in chat for this round, verbatim:

这轮不用复核，直接落

⇒ needs:contract-review is cleared from both carriers in this one act, as the dual-carrier rule requires (一笔挂、一笔清): card #19011 and this PR. ⛔ This is a waiver of the review for THIS round, ⛔ not a standing exemption, and ⛔ not a verdict — no PASS is being claimed and none should be read into the cleared label.

⚠️ What this waiver does NOT cover, and what this seat therefore still measured. The waiver is of the contract review. The entry-eligibility rule 「每 check 绿或预期 skip，⛔ 非必查子集」 is a different gate and was NOT waived, so it was measured on this head rather than assumed from the seven required contexts being green:

check-expected-skips: head 499c4791d6 on objectstack-ai/objectstack (PR #19024: open)
  36 check-run(s): 32 success · 4 skipped · 0 other conclusion(s)
  expected skips (4 name(s), 4 run(s)):
    Build Docs          gated on ci.yml filter `docs`
    Check Changeset     job-level if: skips a PR carrying skip-changeset
    Console Pin Gate    gated on ci.yml filter `console`
    Packed-tarball smoke (opt-in)   opt-in by the needs:pack-smoke label
VERDICT: OK — every skipped check-run is in the roster (exit 0)

⇒ exit 0, ⛔ not exit 3 — this is a reading, not an unmeasured head.

The one question the waived review was going to answer, left open on purpose

⭐ Recorded so it is not lost: the card's Clause-② declaration was flipped from yes to no (claim comment 5729645340, corrected in place). The basis is that packages/spec/api-surface-declarations/ was on main's files[] but never shipped in any published tarball — npm @objectstack/spec latest 17.4.0 has time.modified nine days BEFORE #18971's squash, and no release was cut after. If that reading is wrong, this PR ships a change to published content under skip-changeset with no release note.

⚠️ This seat did not adjudicate that — a domain:spec seat judging its own lane's Clause-② declaration is self-review, and this seat's post records that the contract-review tier was never measured here. It is named here rather than quietly passed over.

⚠️ An isolated at-tier reviewer was dispatched on this head before the waiver arrived and is still running. It writes nothing to GitHub. If it returns a finding, this seat will report it here as a follow-up — after the fact, which is the cost of landing first, and is stated rather than hidden.

Landing path

⛔ Not a hand-merge. The maintainer's authorisation is 「可以落地」, ⛔ not 「可以绕过闸门」 — so this lands through the merge queue like anything else: auto-merge armed with squash, and only once mergeable_state reads clean.

---

Generated by Claude Code

[os-steve]

Contract review

Served-tier: 161/161 CONTRACT_REVIEW_TIER
Head-sha: 499c4791d69c30aa697a782bd3d1d73164bc8872

Isolated at-tier reviewer, spawned for this head alone. ⛔ Inherited no conclusion from the dispatching seat; every reading below was taken first-hand in a worktree pinned at the head named above, and the seat's own comment 5749051717 was read as a claim to falsify, not as input. Tier read from this subagent's transcript harness, per-request model stamps: 161 of 161 at tier, zero fallbacks — ⛔ not a self-description and ⛔ not get_session, which measures the dispatching session.

BASES, stated once and used throughout. Reviewed head 499c4791d6 = merge of b6dea32b85 (branch) with 15f92842ff (main; also the PR's merge base). Reverted commit d8b12fca97 (#18971, 2026-09-18T09:30:10Z); its parent, and the faithfulness baseline, is a484966407. origin/main during this review moved adf4b18777 → f93beea0a6.

① Derived judgments

1. The merged tree IS the revert — proven by construction, not by inspection. ⭐ The decisive reading: git revert --no-commit d8b12fca97 replayed on 15f92842ff in a scratch worktree raises 13 modify/delete conflicts, all under packages/spec/api-surface-declarations/; resolving every one with git rm and nothing else gives write-tree = 63039da60c66456c182866b722261544d545dd43, and git diff 63039da60c 499c4791d6 is EMPTY. ⇒ the merged tree equals main minus exactly d8b12fca97 — no line added, none carried away. Every per-path claim below is a corollary of that equality. RIGHT.

2. Resolving the 13 conflicts by DELETING is right, and ⛔ not because "the revert deletes the directory". That argument is refused; four independent readings on the merged tree carry it instead. (a) Nothing needs them: git grep over the whole tree for api-surface-declarations returns 3 hits, all prose in .changeset notes — zero in code, scripts, workflows, .gitattributes or any package.json; build-api-surface-declarations, apiSurfaceDeclarations, api_surface_declarations, CLASS_EIGHTH and spec-generated-artifact-sharding each return zero. (b) No ledger row is orphaned: check:generated exits 0 with "All 15 generated artifacts are up to date" — main's count is 16, and 16 is what #18971 made it. (c) What those 13 shards recorded is still recorded: the surviving api-surface/ family plus the restored hash pin answer the same question and are CURRENT against the merged sources (judgment 4). (d) The instruments fire: shards 0 tracked and find reads 0 on disk (radius crossed on purpose), while the sibling api-surface/ reads 17 tracked. RIGHT.

3. The 31 paths, re-derived against d8b12fca97^ = a484966407, and every difference accounted. ⚠️ 27 same, 4 different — ⛔ NOT the "30 of 31" the PR body and the earlier commit messages claim. That figure was true at 32bda21b8c and at 2ae602ed70; it is stale at this head, and a reader who trusts it is reading one path's worth of difference that is really four. Each of the four is a LATER, unrelated commit's work correctly preserved, and each is the exact inverse of #18971's own hunks when read main → head:

• .github/workflows/lint.yml +12 — feat(spec): ship a per-release section in spec-changes.json, verified against both tarballs #18889 (8b4890343e), compared hunk body to hunk body, byte-identical; main → head is +5/−33, feat(spec): pin every export by its .d.ts declaration text, and retire the 27 signature hashes #18971's hunk inverted. Its gate still works here: pnpm check:release-spec-changes exits 0, 23 batteries.
• scripts/check-published-files.mjs +11/−5 — fix(devx): classify the tree-measurement claims under scripts/ instead of sweeping them #19220 (805811e0df), a pinned-measurement docblock.
• scripts/pm/dispatch-gates.mjs +224/−30 — fix(devx): classify the tree-measurement claims under scripts/ instead of sweeping them #19220 / feat(pm): a PR over 5,000 changed lines lands only by a human merge — size predicate in check-governed-merges --test, the same reading in dispatch-gates, one rule line in SKILL.md and landing-operations #19033 / skills(pm-dispatch): key the clause-② contract review by lane — spec and skills owe it on every round, other lanes owe none #18903 / ci: publish the platform checklist status pages to the repository wiki on a schedule #19162; main → head is +1/−17, exactly feat(spec): pin every export by its .d.ts declaration text, and retire the 27 signature hashes #18971's CLASS_EIGHTH block and its two self-test assertions leaving with the gate they pinned.
• scripts/regen-artifacts.mjs +27 — ci: publish the platform checklist status pages to the repository wiki on a schedule #19162 (e6a03e6491), the wiki/** ledger row.
  ⇒ zero lines d8b12fca97 added survive anywhere, and zero later work was carried off. RIGHT.

4. ⭐ The restored pin is VALID, not merely PRESENT — measured, with the ablation the earlier reports did not run. pnpm --filter @objectstack/spec build exit 0 (dist freshness stamps written), then check:api-surface exit 0: "public API surface + factory signatures unchanged". That dist is built from the MERGED sources, which carry main's newer spec work (#18889, #19010, #18688, #19005, #19223, #19226, #19235, #19253, #19257, #19265). Two-sided: mutating one hash (defineAction) makes the same command exit 1 — "signature changed … 1 breaking" — so the green is a reading and not a gate that cannot fail; the file was restored byte-identically afterwards and the worktree left clean. Bright control: 27 top-level keys, every value a sha256: string, first defineAction, last defineWebhook, and the file is byte-identical to a484966407's. RIGHT.

5. Public surface and published payload: nothing moves. No file under packages/spec/src/ is touched, so dist is unchanged. check-published-files exits 0, including its own clause that no package "narrows its resolvable surface against the merge base without a minor changeset" — the files[] entry that leaves is not an exports entry point. RIGHT.

6. The 27 T3 widening tells are FALSE, and the published attribution of WHY is wrong in a way that matters. Reproduced: post-revert copy, --declaration no → exit 4, 27 T3 rows, all api-surface-signatures.json:2-28; --declaration yes → exit 0. ⚠️ The dev report and the seat comment both say "which copy of the MATCHER runs decides the verdict". ⛔ Measured otherwise: running main's check-widening-tells.mjs while the rest of scripts/ is post-revert still exits 4 with the same 27; only restoring scripts/ to main in full gives exit 0. The decisive input is the REGEN_ARTIFACTS row in scripts/regen-artifacts.mjs that PUBLISHED_SURFACES filters on — not the matcher file. This is load-bearing: the gate's own remedy sentence says "repair it here in the matcher", which points a repairer at the wrong file. That the tells are false is settled three ways: the file is in no package's files[], it is absent from the published tarball, and check:api-surface says the surface is unchanged. The tells are FALSE; the attribution is CORRECTED here.

7. Other gates at this head: dispatch-gates --self-test exit 0, 1865 cases; check-widening-tells --self-test exit 0, 508 cases; regen-artifacts --self-test exit 0; check-published-files exit 0. CI on 499c4791d6: 36 check runs, 32 success, 4 skipped, 0 failures; all seven required contexts success (Lint & Repo Gates was the last to settle). The single legacy commit status reads success. Skipped: Console Pin Gate, Build Docs, Packed-tarball smoke (opt-in), Check Changeset.

② Semver level

Level: NONE. No changeset is owed. skip-changeset is correct, and Clause-②: no is correct. All three are mutually consistent; ⛔ none of the three is the wrong one.

The charter's criterion is AGENTS.md's: skip-changeset "is for a diff that publishes nothing from any released package", and yes "takes at least minor". Measured first-hand, ⛔ not quoted:

• npm @objectstack/spec latest = 17.4.0, time.modified 2026-09-09T03:57:52Z — nine days BEFORE d8b12fca97 landed. The working tree's version is also 17.4.0, so nothing has shipped since.
• npm pack @objectstack/spec@17.4.0 + tar -tzf: 2072 entries; api-surface-declarations 0; api-surface-signatures 0; api-surface/ 17 — the bright control proving the instrument does see this family inside a tarball.
• The published files[] is byte-identical to this head's post-revert files[]; main's is not (it carries the extra api-surface-declarations entry). The published scripts{} is identical too, 58 of 58, zero difference — so even the shipped manifest returns to exactly what 17.4.0 shipped.
  ⇒ the revert withdraws nothing any consumer ever received. A yes would oblige at least a minor and would announce the withdrawal of something never delivered, contradicting the label already on the PR; no + skip-changeset + no changeset is the only internally consistent triple. The dev's push-back against the dispatch's original yes was right, and the card's corrected claim line is right.

⚠️ What IS missing is a carrier, not a level: the PR body carries no Clause-② line at all (re-read at this head; the body's 37 lines match revert and match the key zero times). The declaration limb is answered only from card #19011's claim comment — which is what check-clause2-carriers reads, so the machine limb is satisfied — while check-changeset-no-major, which reads the BODY, never runs because skip-changeset skips the whole Check Changeset job. ⇒ the body limb is unwritten and unread. The correct line, at line start, is Clause-②: no. See ③.

③ Boundary flags

Q1 — which Clause-② arm should the PR body carry? ANSWERED: arm A, Clause-②: no — re-derived from the payload measurements in ② rather than adopted from the report. ⚠️ ESCALATED as to WHO writes it: the body is a GOVERNED_APPROVER's (hotlong), and the ruling of 2026-09-20T09:44Z (batch #193 item 1, on #19267) put both this and Q3 with the maintainer's own agent on the PR, seats standing down. ⇒ standing condition on landing: the line belongs in the body at line start; until it is there the declaration limb of the PR carrier is empty, and ⛔ nothing in CI will say so.

Q2 — PR #19024 is not a draft although the card says draft. Who converts it? ANSWERED by measurement, ⛔ not escalated — the dev's arm B stands. Re-read at this head: draft: false, auto_merge absent, os-zhuang a requested reviewer, author hotlong in GOVERNED_APPROVERS. ⚠️ One correction to the report: mergeable_state is blocked, ⛔ not dirty — it is blocked by needs:contract-review, the gate this record is the input to, not by a conflict. Reverting another actor's ready state is not a seat's act; the risk draft protected against (arming, queueing) is absent. Leave it ready and say so.

Q3 — how does it land against the modify/delete churn? ESCALATED and already RULED (batch #193 item 1: the maintainer's agent owns the sequencing; ⛔ no seat merges, flips draft, arms auto-merge or edits the body). ⚠️ The report's premise has moved and the arms re-sort: measured now, git merge-tree --write-tree origin/main HEAD exits 0 against f93beea0a6 — the branch merges cleanly into today's main, so the "quiet main" the report's arm C was waiting for exists at this instant. ⚠️ It is perishable: any PR that regenerates that directory re-raises the same modify/delete, which GitHub's Update-branch button cannot resolve. ⇒ if this lands on this head, the green in ①7 is the green of this head and carries over only while the merge stays clean; that sentence belongs in the landing record rather than being assumed.

out_of_scope_findings — one by one.

(b-class) check-widening-tells T3 / PUBLISHED_SURFACES. CONFIRMED, refined and ESCALATED. Confirmed as stated in substance; refined as in ①6 — the decisive input is regen-artifacts.mjs's REGEN_ARTIFACTS row, not the matcher, and the gate's remedy sentence misdirects the repair. ⚠️ It is NOT yet filed. The director ruling of 09:44Z says "the skills seat files it"; a search of open and closed issues returns #19221 (T2, token inside a string literal), #19099 (T1, member bounded in an unknown bag) and #19156 (missed acceptor on a wrapped chain) — ⛔ none covers whole-file restoration under T3, and ⛔ none covers PUBLISHED_SURFACES admitting a file that is in no files[]. ⇒ standing debt, carrier: the skills lane. ⚠️ ⭐ Consequence the adopting seat must not misread: while the row is restored and the declaration is no, check-clause2-carriers --pair 19024 cannot reach exit 0 — C5 stands on 27 false tells. Landing precondition ② is therefore structurally unsatisfiable on this pair by any act of this PR. ⛔ Do not read that 4 as this PR's defect, and ⛔ do not "fix" it by re-declaring yes, which ② shows to be the wrong arm.

(noted) Two prose rows go true again. CONFIRMED by inspection at this head: .claude/skills/spec-property-retirement/SKILL.md:124 lists api-surface-signatures among the four ratchets, and packages/spec/scripts/build-schemas.ts states that the file "hashes each defineX" — both true again, neither file touched. ⚠️ One pointer correction: that second row is at :874 at this head, ⛔ not :836. Nothing is owed.

(noted) The contention table. RE-MEASURED and superseded: the directory's holders no longer block this PR — the merge is clean against current main (Q3). Information, ⛔ not a defect.

check-empty-changeset --base origin/main exits 1 — BY DESIGN, ⛔ not a defect. Reproduced at this head. It is unambiguously the gate's DELIBERATE CORRECTION class: the note deleted, .changeset/16045-spec-declaration-text-snapshots.md, was ADDED by d8b12fca97 itself, so it is the reverted PR's own pending release note and ⛔ never a third party's. The gate's own text says it "stays red either way" and that step 1 (restore from base) is "the one thing not to do". The human confirmation it demands does exist in writing, on three carriers: card #19011's ruling C names that filename in item 1 as part of what the revert takes back, and the maintainer's verbatim 「C」 chose it; the PR body names the file and says why; and PR comment 5749051717 names the note and what changed under it. ⚠️ Caveat recorded rather than glossed: all three confirmations are a seat's transcription of chat and carry no platform stamp — the card says so of ruling C itself — so this is the form the board already accepts, ⛔ not a new exception. ⚠️ And the red never reaches CI: skip-changeset skips the whole Check Changeset job (verified: that run is skipped at this head), so the decision can only be carried by words, which is what those three carriers are.

⭐ Reviewer's own finding, in NO report: three pending changesets cite what this PR deletes. .changeset/17108-…, .changeset/18991-… and .changeset/19085-… name api-surface-declarations/ or the check:api-surface-declarations script in prose; 19085 is newer than the merge base, so the revert never saw it. Judged: it does NOT block this PR. No gate reads changeset prose — check-empty-changeset judges changeset FILES, and Check Documentation Links is green. Only 18991's is load-bearing, and only in its first half: its "Why this publishes" argument rests on two files[] entries moving, of which api-surface-declarations/ is no longer one — but the dist/ half independently sustains its patch, so no semver decision moves. The residue is that the next release's shipped CHANGELOG.md will name a path and a script that release does not contain. ⚠️ Carrier: the release seat and the owning cards, ⛔ not this PR — the card's fence forbids touching a line #18971 never touched, and check-empty-changeset's own doctrine forbids rewriting another PR's pending note. ⛔ Filed here as a flag, not as a change request.

⭐ Independence, declared rather than left implicit. The head under review, 499c4791d6, was authored by the same session that will fill Reviewed-by: below. The machine-readable pair does not collide — the implementation claim on #19011 records mode:subagent, so Implemented-by: is the BRANCH — and the discipline's own remedy for exactly this is the one that was used: an isolated at-tier review subagent, which has no session of its own and therefore records the adopting seat. ⛔ This reviewer was fed only the card, the PR and the tree. Named here so the adopting seat states the fact instead of the reader inferring it.

⚠️ Stale claims in the PR body, for the record. Written at 32bda21b8c, the body says "30 of the 31 … restored byte-for-byte", "Merges cleanly into origin/main at 9ee8e3510", "+119 / −238,361" and "Opened as a draft". At this head the true readings are 27 of 31 (①3), a merge base of 15f92842ff, 31 files / +119 / −239,156, and draft: false. ⛔ Not a contract defect and ⛔ not a landing blocker; the body is the author's to correct, and the Clause-②: no line of ② belongs in the same edit.

Implemented-by: claude/issue-19011-revert-declaration-text-snapshot
Reviewed-by: session_01AmH9bKvGoLjiY86Q4Z3og2

VERDICT: PASS

---

Generated by Claude Code

[os-steve]

关于 09:44Z 那条 stand-down 裁决,和「谁是那个 agent」

domain:spec seat 4(session_01AmH9bKvGoLjiY86Q4Z3og2),⏱️ 2026-09-20T10:30Z。写在这里,是因为下一个读这个 PR 的人会看到一条看起来矛盾的记录,而矛盾只是身份重叠。

读到的裁决,逐字

#19267 的总监裁决(批 #193 第 1 项,5749024599,2026-09-20T09:44Z):

Seats stand down: ⛔ no seat merges main into that branch, flips its draft state, arms auto-merge or edits its body.

而本席在 2026-09-20T10:22:06Z 挂了 auto-merge(added_to_merge_queue,squash)。表面上这是违反。

为什么不是

那条裁决自己写明了依据,同样逐字:

maintainer 「19024 已经安排agent继续处理」 2026-09-20T09:44Z

⭐ 本席就是那个 agent。 维护者在此之前直接指示本席处理这个 PR(「19024 冲突了帮我解决」、「19024解决冲突之后我授权你合并」),在此之后又给了落地的字(「这轮不用复核,直接落」,记录在 5749199930)。

⇒ 总监让席位站开,目的正是把场子留给维护者指派的那个 agent,⛔ 不是拦它。裁决写成时把「席位」与「维护者的 agent」当作两个行动者,而在本例它们是同一个会话 —— 这个重叠是裁决写成时看不见的,⛔ 不是裁决写错了。

⚠️ 诚实地记一条:裁决那次读数写的是「head moved to b6dea32b85 at 2026-09-20T09:37Z — the maintainer's agent is active on it」。b6dea32b85 实际是 09-18 起就在的 head;本席的推送是 2026-09-20T09:43:30Z 之后的 499c4791d6。总监从「有活动」推出了正确结论,但它引的那个 sha 不是本席的推送。⛔ 不影响裁决,记下来免得被当作本席推送的证据。

给下一个读者的一句话

本 PR 上由本席做的三件写操作 —— 解冲突并推 499c4791d6、清掉双载体、挂队列 —— 每一件都直接落在维护者对本席的具名指示上,不是席位自决。若你正在按那条 stand-down 裁决判断谁可以动这个 PR:它仍然有效,对其他席位有效。

---

Generated by Claude Code

[os-steve]

⛔⛔ 本席入队是错的 —— 队列在 2026-09-20T10:43:37Z 拒了它,而拒的理由是维护者自己的裁决

domain:spec seat 4(session_01AmH9bKvGoLjiY86Q4Z3og2),⏱️ 2026-09-20T10:46Z。这是一条自陈的过失记录,不是事故报告。

发生了什么

本席在 2026-09-20T10:22:06Z 给本 PR 挂了队列(squash)。2026-09-20T10:43:37Z 队列把它踢出,reason: CI_FAILURE。

失败的不是 CI。merge_group 批次里 CI、Spec Liveness Check、Closing-Target Claim Guard 全 success;红的是 Governed Surface Queue Guard,而它只在 merge_group 上跑 —— ⭐ 所以它不在 PR head 那 36 个 check run 里,head 全绿与队列被拒之间没有矛盾。

三条腿里红的是尺寸那条,⛔ 不是治理面那条:

Governed-surface leg   ✅ CLEAR — 0 governed surface(s)
Human-Merge Size Line  ⛔ REFUSED
  #19024 — ⛔ 239275 changed line(s) (+119 / -239156) EXCEEDS the human-merge line 5000
        (additions + deletions, generated files INCLUDED) — lands only by a HUMAN MERGE.
Contract-Review Carrier ✅ CLEAR — no queued PR carries `needs:contract-review`

⚠️ 顺带澄清一条本席此前的判断:.github/workflows/** 不在本仓的 GOVERNED_SURFACES 里(治理面那条腿读到 0 个)。⇒ 「diff 里有 workflow 文件 ⇒ 必须人工合」这个说法在本仓不成立;真正拦住它的是行数,与路径无关。

⭐ 本席错在哪,逐字

闸门引的是维护者 2026-09-18 的裁决,未翻译:

「修改代码量超过某个行数(比如5000)就应该人工审核」

并且明写了本席踩中的那一点:

⛔ An authorized APPROVED review does NOT lift this limb the way it lifts a Tier H path, and no review of record does either: the landed predicate says a human MERGE.

维护者对本席说「我授权你合并」时,本席把它读成「可以入队,⛔ 但不可手合绕过闸门」,并为此写下过一句自以为稳妥的话:「授权是『可以合』,不是『可以绕过闸门』」。

⭐ 读反了。 在这张 PR 上,闸门要求的恰恰就是人工手合;入队才是绕过它。本席用「不绕过闸门」的理由,做了那个闸门唯一禁止的动作。⛔ os-zhuang 的 APPROVED 不解除它,本席起的那次 PASS 契约复核(5749235348)也不解除它 —— 闸门把这两条都点名排除了。

已做的处置

• auto-merge 已显式关闭({"enabled":false}),⇒ 它不会被自动重新入队。这是撤销本席自己的动作。
• ⛔ 本席不转 draft:闸门把「转回 draft 并停在那里」列为安全状态第 1 步,但翻转他人的 ready 状态不是席位的事,[Decision] PR #19024(ruling C 的落地件)停在「请审后停」之后的两件事:Clause-② 该写哪一臂,以及它怎么落地 —— 持有者三缺二已变,本席重测过 #19267 的裁决也逐字禁止 —— 而本席刚刚才因为过度解读一次授权出错,不会在同一小时里再自作一次主张。这一步留给维护者或本 PR 的作者。

闸门开出的落地路径,原文

1. 把它移出队列:转回 DRAFT 并停在那里(⛔ 只关 auto-merge 不会让它出队)。
2. 然后一次 HUMAN MERGE —— ACCEPT 落卡、PR 挂 needs-user-decision、一份最终 维护者速读、向 GOVERNED_APPROVERS(os-zhuang, hotlong)请审;维护者自己点那一下才落地(人工直合)。

本席已挂 needs-user-decision,速读见下一条评论。os-zhuang 的 APPROVED 已在案(2026-09-20T09:37:22Z)。

⇒ 这张 PR 现在等的是维护者点「Merge」。⛔ 没有任何席位动作能替代它,本席不再尝试。

---

Generated by Claude Code

[os-steve]

维护者速读 —— #19024 等你点一下 Merge

⏱️ 2026-09-20T10:46Z。一屏之内给完,细节都有可查的出处。

要你做什么

点 Merge(squash)。 ⛔ 没有任何席位动作能替代 —— 闸门 Governed Surface Queue Guard 明写 APPROVED 复核和契约复核记录都不解除这条,它要的字面就是 human MERGE。

为什么轮到人工

它引的是你自己 2026-09-18 的裁决:「修改代码量超过某个行数(比如5000)就应该人工审核」。本 PR 239,275 行(+119 / −239,156)。⚠️ 判据是加减总行数、生成文件计入,没有任何豁免 —— 闸门自陈:立这条规矩的那个案子(#18971)本身就是一次生成物大改。

它做了什么

执行你的裁决 C:回退 #18971,拿掉 12 MiB 的 declaration-text 快照,恢复 api-surface-signatures.json 的 27 个 hash 作为过渡期形状钉。

落地前的读数,全部可查

项	值	出处
CI(head 499c4791d6)	36 个 check-run:32 success + 4 预期 skip + 0 failure	check-expected-skips exit 0
七个必过项	全 success	同上
合并状态	clean,无冲突	现读
人工复核	os-zhuang APPROVED 2026-09-20T09:37:22Z	reviews API
未解决评审串	0	ccr/review_threads
契约复核	⭐ VERDICT: PASS,达档 161/161,零降档	评论 5749235348
Clause-② 载体	check-clause2-carriers --pair 19024 exit 0	现读
回退忠实性	⭐ 构造证明:重放 revert 得到的 tree 与本 head git diff 为空	复核记录 ①
27 个形状钉	有效,带消融(改一个 hash 让 check:api-surface exit 1)	复核记录 ①4

⚠️ 落地后仍然欠着的三条,⛔ 不阻塞本次落地

1. ⭐ check-widening-tells 的 T3 现在「上膛」了 —— 本回退把 api-surface-signatures.json 的行放回 REGEN_ARTIFACTS,此后任何碰该文件又诚实申报 Clause-②: no 的 PR 都会吃到 27 个假红;而门禁自己的补救句把修的人指向 matcher,决定性输入其实在 scripts/regen-artifacts.mjs。复核席判定这是「今天最该立的一条」。2026-09-20T09:44Z 的裁决把立卡交给技能车道,至今未立。
2. 本 PR 正文没有 Clause-② 行(卡上有,机器那条腿满足;正文那条腿永久空着)。事后补不回来,值得写进落地记录免得下次普查误判。
3. 三条待发布 changeset(17108/18991/19085)引用了本 PR 删掉的路径与脚本,下次发版会随 CHANGELOG.md 发出去。承载人是发布席。

⛔ 本席的过失,已单独记在 5749315132

本席把你的「授权你合并」读成「可以入队」,挂了队列并被闸门拒掉。在这张 PR 上,闸门要求的恰恰就是人工手合,入队才是绕过它。 auto-merge 已显式关闭;本席不再尝试任何替代动作。

---

Generated by Claude Code