[objectstack-fleet]

Requested by Elon · project thread

domain:skills#2 · os-elon-musk · session_016WV4czoR81DDKSnGWnBYqA

Fixes #28057

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：契约复核记录的 Head-sha: 读取器再收紧两处，写入侧的拒收更准、报错点名新原因。(1) 围栏代码只在「同字符、不短于开栏、整行只有符号」的一行上关闭；三个反引号后面跟了文字的行是围栏内容，不关栏。(2) ## Contract review 题头缩进 4 个空格或 tab（渲染为代码块）不再打开读取范围，与 Head-sha: 行本身的 3 空格上限一致。(3) post-stamped.mjs 发帖前的 Head-sha 拒收改为只看「以该键开头的行」（任意缩进、引用、列表、粗体、反引号都算），不再因为正文句中提到 Head-sha: 就拒收。(4) 拒收文案与 RECORD_KEY_SPELLINGS['Head-sha'] 点名两个新原因：代码缩进的行、引用或代码缩进题头之下的行。(5) contract-review.md:33 写明 Head-sha: 行在「题头之下」，行数不变、120 字节；--template 的说明同步。4 个文件。
• 为什么改：这是 PR fix(pm): read a record's Head-sha line only below its heading, refuse an unreadable one at write time, and name the line in the rules #28042 delta 复核的 should-fix 4–8。两种残留写法在基线上同样会把引用或代码样式的行读成记录的 head；线上 713 条记录 0 例，属响亮度收尾。写入侧那条是误拒：引了题头、句中提到键名的普通评论被拒。无新门禁、无新拒收类。
• 风险与回滚：读取只收紧不放宽；写入侧拒收集缩到「有键行」，fix(pm): read a record's Head-sha line only below its heading, refuse an unreadable one at write time, and name the line in the rules #28042 钉住的每种拒收写法仍拒。实测 2026-10-23 以来 11482 条评论、724 条带题头记录：新旧读法逐条相同（0 变），拒收逐条相同（0 变）。回滚即 revert。
• 先看：check-half-states.mjs 的 FENCE_CLOSE_LINE 与 contractReviewHeadSha 的两行改动；再看 post-stamped.mjs 的 HEAD_SHA_KEY_LINE。
• 两分钟验证：本 head 五个自测全部 exit 0：half-states 5113、recognisers 337、post-stamped 747、owed-reviews 65、guard 403；四条消融各恰红一条新钉。
• 需要你做的：无。本 PR 欠一次契约复审（席位安排）；落地档以登记册为准（.claude/** ×1，本地 --test 读为 Tier S）。

What changes

• scripts/pm/check-half-states.mjs. FENCE_CLOSE_LINE (new, module-private) admits only whitespace after the run; contractReviewHeadSha now opens a fence on FENCE_LINE (info string allowed) and closes it only on a FENCE_CLOSE_LINE of the same character with a run at least the opening length. The heading scope opens only when the marker line also matches ^[ ]{0,3}# (no blockquote marker, no four-space or tab indent); CONTRACT_REVIEW_HEADING_MARKER itself is unchanged, so the locator, H43, owed-reviews, the guard and recordKeyedLineRefusals still see an indented or quoted heading as a record. Two pins in the H51 block: the trailing-text close (open stays open; a later bare run closes; trailing whitespace closes) and the indented heading (four spaces and a tab open nothing, three spaces does, the marker still finds it, latestContractReviewOnHead answers null).
• scripts/pm/post-stamped.mjs. HEAD_SHA_KEY_ANYWHERE becomes HEAD_SHA_KEY_LINE: a line opening on the key after any indent, blockquote markers, a -/*/+ bullet or a list number, bold or backticks, case-blind, m flag. Every refused shape the fix(pm): read a record's Head-sha line only below its heading, refuse an unreadable one at write time, and name the line in the rules #28042 battery pins still reads as a key line; a mid-sentence mention does not. The refusal why and RECORD_KEY_SPELLINGS['Head-sha'] name the code-indented line and the line under a quoted or code-indented heading. Three pins: the prose mention is untouched, decorated key lines (numbered, doubly quoted, +-bulleted, under a code-indented heading) are refused, the printed text names both causes.
• scripts/pm/record-recognisers.mjs. The --template note for Head-sha says the line is plain and BELOW the heading, and lists the shapes that read as prose. One line added to the printed template help; no reader touched.
• .claude/skills/pm-dispatch/references/contract-review.md (:33, line-neutral, 120 bytes): 「题头之下 Head-sha: 行独占码段」.

Why

The delta contract review of PR #28042 (record 6520969324) left should-fixes 4 to 8, filed as #28057 and triaged p3 (6522257381: loudness, no wrong head admitted). Measured on origin/main 549203d04 before the change:

1. FENCE_LINE matched a closing run with trailing text, so after ``` + ``` not a close the fence was read as closed and a Head-sha: line after it was read. CommonMark keeps the fence open. Same on base.
2. The scope opened on ## Contract review (an indented code block to the renderer) while the key line is held to three spaces. Same on base; 0 live instances.
3. HEAD_SHA_KEY_ANYWHERE matched the key anywhere, so a record-shaped comment that quotes a heading at line start and names Head-sha: mid-sentence was refused with "a Head-sha key is present". Loudness only.
4. The refusal text and the spelling enumerated "blockquoted, bulleted, fenced or pre-heading" and not the two causes fix(pm): read a record's Head-sha line only below its heading, refuse an unreadable one at write time, and name the line in the rules #28042 added.
5. contract-review.md:33 named the line but not that it sits below the heading; the --template note said "on THIS line" only.

No new refusal class and no new gate: the accept set of every reader is the same or narrower than base, and the write-time refusal fires on a strict subset of what it fired on before (a key LINE rather than the key anywhere).

Verification

• Self-tests on the committed head, exit captured before any pipe: check-half-states --self-test 0 (5113 cases), record-recognisers --self-test 0 (337), post-stamped --self-test 0 (747 across 26 batteries), check-owed-reviews --self-test 0 (65 in 9 batteries), check-governed-queue-guard --self-test 0 (403).
• Ablation on the committed head, each leg restored with git checkout and git status --porcelain empty: (A) FENCE_CLOSE_LINE back to the bare FENCE_LINE shape: half-states 1 of 5113 red (the trailing-text pin), recognisers 0, post-stamped 0. (B) the scope-open test back to !/^\s*>/: half-states 1 red (the indented-heading pin), post-stamped 1 of 747 (the code-indented-heading limb). (C) HEAD_SHA_KEY_LINE back to /head-sha[ \t]:/i: post-stamped 1 red (the mid-sentence pin). (D) the two new causes removed from the why` and the spelling: post-stamped 1 red (the wording pin). No other pin moves in any leg.
• Corpus: 11482 issue comments updated since 2026-10-23 (REST, 115 pages), 724 carrying the heading marker, driven through contractReviewHeadSha and recordKeyedLineRefusals in a worktree at this head and one at origin/main 6b125a7a: 0 records read differently, 0 records refused differently, 0 differences in the refusal over all 11482 comments; the 2 nulls are the two no-key legacy records, the 1 refusal on both sides is the pre-existing Local-runs row on record 6517315440.
• Skill text: check-skill-line-ratchet exit 0 (contract-review.md 60 lines, ceiling 60; line 33 is 120 bytes under MAX_LINE_BYTES 120), check-skill-id-lint exit 0 (105 files clean), check-skills-token-ratchet exit 0 (56 files within ceilings).
• Gates: dispatch-gates --commands at the committed head f619d317 derives 56 families; all 56 run in a second worktree (pnpm install --frozen-lockfile --ignore-scripts first), exit codes recorded; --ran reconciles 56 derived / 56 run / 0 NOT-MEASURED / 0 UNRUN. One first-pass exit 3 (check:doc-formula-expressions, no formula/lint dist) exits 0 after turbo run build --filter=@objectstack/formula --filter=@objectstack/lint. No family red. No changeset derived: no published package is touched, skip-changeset rides the create.
• Landing tier: check-governed-merges.mjs --test on the four paths answers Tier S (.claude/** ×1; the three scripts/pm/** paths are off the register); the register's reading at PR time is the seat's.

Human Minimum

Each item is one rule from
CONTRIBUTING.md › Human Minimum,
which links the AGENTS.md text that states it.

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (not touched)
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; the derived lint families pass.
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset. (no published package: skip-changeset)
• 6. packages/spec touched: its generated artifacts are regenerated and committed. (not touched)
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English (the 维护者速读 block is the one Chinese channel).
• The Before Submitting list in CONTRIBUTING.md is done.

🤖 Generated with Claude Code

https://claude.ai/code/session_016WV4czoR81DDKSnGWnBYqA

[objectstack-fleet]

domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS

Contract-review-claim: session_016WV4d1QkPVVzNz3FJqb2iS · head f619d31 · 2026-10-30T12:51Z

[objectstack-fleet]

domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS

Contract review

Head-sha: f619d317d724cc8dae9f673353ca2ddafa7831da
Served-tier: CONTRACT_REVIEW_TIER
Local-runs: probe — the five scripts' own --self-test batteries on the head, two ablation legs of my own in a detached worktree at this head (each one sed, restored with git checkout, git status --porcelain empty), the previous records' reader probe (56 synthetic shapes plus the live PR #28023 and PR #27964 threads) and write-side refusal probe (31 shapes plus the 14 live fixture comments) re-run against worktrees at this head and at origin/main, a new probe of 78 shapes (19 fence closes, 11 heading indents, 42 writer key lines, 6 prose mentions) driven through contractReviewHeadSha, recordKeyedLineRefusals and the four readers on both trees, and a read-only corpus scan (11305 issue comments updated since 2026-10-23, 713 carrying the heading marker, driven through the reader and the writer's refusal on both trees) were executed locally, because the card's wanted items 1 to 3 are behavioural claims about the readers and the writer that no check-run prints and the PR body's own evidence is a head-versus-base comparison; the skill line ratchet, the skill-id lint, the token ratchet and check-governed-merges.mjs --pr 28103 were run read-only beside them
Scope: .claude/skills/pm-dispatch/references/contract-review.md (:33) + scripts/pm/check-half-states.mjs (FENCE_LINE :12698, FENCE_CLOSE_LINE :12699, the contractReviewHeadSha docblock :12702-12738 and body :12739-12760, H51 pins :33562-33567), scripts/pm/post-stamped.mjs (RECORD_KEY_SPELLINGS :2062-2066, HEAD_SHA_KEY_LINE :2067-2072, headShaKeyLine :2075, recordKeyedLineRefusals :2096-2106, pins :5329-5331), scripts/pm/record-recognisers.mjs (--template note :1723-1727); read but not reviewed: check-half-states.mjs CONTRACT_REVIEW_HEADING_MARKER :12631, CONTRACT_REVIEW_HEAD_SHA_LINE :12681, contractReviewHeadMatch :12797, latestContractReviewOnHead :12815-12826, contractReviewVerdictOf :12853, record-recognisers.mjs keyLineRegex :534, locateReviewOfRecord :1991-2047, check-owed-reviews.mjs recordReading :196-216, check-governed-queue-guard.mjs recordVerdict :965, scripts/pm/check-skill-line-ratchet.mjs MAX_LINE_BYTES :2514.

① Derived judgments

Base is origin/main; the merge base is 549203d04, which already carries PR #28042's merge commit 18318361f, and origin/main has since moved to 59547058a with no touch of the four changed files or the two consumer scripts (git diff --stat 549203d04 origin/main -- .claude/skills/pm-dispatch scripts/pm is empty). The branch is the single commit f619d317 (+56 / -25, 4 files). check-governed-merges.mjs --pr 28103 at the head: 1 of 4 paths hits the register (.claude/**), Tier S, 81 changed lines under the human-merge threshold; the three scripts/pm/** paths are off the register. The register, the PR body and the dev report agree. Each claim, judged by reading the code and by running it:

1. Fence close (card item 1, previous should-fix 6). FENCE_CLOSE_LINE (:12699) is FENCE_LINE with [ \t]*$ after the run; the walker now tests the close FIRST while a fence is open, so a line inside a fence is content unless it is a bare run of the open fence's character at least the opening length, and FENCE_LINE with its info string is consulted only outside a fence. Probed on both trees: three backticks then prose after an open fence leaves it open, so a Head-sha: line after it is fenced and the record names null where base named the cited head (F1), and the author's own plain line after a later bare run is read where base read the cited line (F2, F3, and the previous probe's trailing-text shape); a longer run with trailing text is content too (F11: null, base named the cited head). An info-string opener still opens (F4 md, F17 ~~~ js, and a backtick inside the info string, F16, which CommonMark would not call a fence, still opens here in the fail-closed direction). A bare run with trailing spaces or a trailing tab still closes (F6, F7, F15), as does one indented up to three spaces (F13) and a longer bare run (F12); one indented four spaces does not (F14). CRLF bodies read the same as LF because the walker splits on \r?\n before the anchored test (F8, F9). TRUE.
2. Code-indented heading (card item 2, previous should-fix 7). The scope opens on CONTRACT_REVIEW_HEADING_MARKER.test(line) && /^[ ]{0,3}#/.test(line) (:12754); the second regex subsumes the blockquote refusal it replaces (a blockquote marker is not #) and refuses four spaces, a tab, two spaces then a tab, and a blockquote marker followed by four spaces (H1, H2, H6, H8: null; base read the line below). One to three spaces still open (H3 reads, as does the previous probe's one- and three-space shapes); a code-indented heading naming the cited head above the real heading is skipped and the author's line is read (H4: base read the cited head). The marker itself is byte-identical to base, so PRESENCE does not move anywhere: the locator, H43's filter, owed-reviews, the guard, contractReviewVerdictOf, the H64 adjacency pin and recordKeyedLineRefusals still see an indented-heading comment as a record, and the H51 pin (:33567) asserts exactly that (the marker finds it, latestContractReviewOnHead answers null). An indented-heading record therefore moves from current to stale in owed-reviews, never to none, and the writer refuses it before the write (W24). Intended, pinned, and the smaller of the two fixes the previous record named. TRUE.
3. Writer precision (card items 3 and 4, previous should-fixes 4 and 8). HEAD_SHA_KEY_LINE (:2072) is line-anchored with the m flag and tolerates any indent, repeated blockquote markers, a -/*/+ bullet or a list number, and backticks or stars around the key, case-blind. Every reader-null-with-key shape the fix(pm): read a record's Head-sha line only below its heading, refuse an unreadable one at write time, and name the line in the rules #28042 battery pins stays refused on this head: quoted, bulleted, fenced, pre-heading, code-indented (four spaces and a tab), the key folded into the span, bare hex, lowercase key, sub-floor span, a fully quoted record, a quoted heading over a plain line, a nested or unmatched fence, and the three new shapes (numbered, doubly quoted, +-bulleted, under a code-indented heading) (W16 to W29, W33, W36, W39, W41; the previous refusal probe's 31 shapes differ from base only in the two prose-mention rows). The two intended drops are measured: a non-record quoting a heading at line start and naming the key mid-sentence (P1) and a record-shaped prose mention (P2) are untouched on this head and refused on base; a record carrying its own plain line plus a prose mention below reads and passes on both (P6). The why text and RECORD_KEY_SPELLINGS['Head-sha'] now name the code-indented line and the line under a quoted or code-indented heading, and the printed text is pinned (:5331); each sentence is true against the reader. One imprecision: the spelling says the heading must be unindented, while the reader admits a heading indented one to three spaces (H3), which the same sentence grants the key line in words; cosmetic.
4. Shapes that DROP OUT of refusal under the new presence test while still reading null. Constructed and measured on both trees: a key line opening on a word before the key (Current Head-sha:, Reviewed Head-sha:, head: Head-sha:, W1, W13, W14), two keys on one line with the key second (Served-tier: X · Head-sha: A, W2), a table row (W3), underscore emphasis on the key (W4, W5), a task-list item (W6), a heading-styled key (W7), a unicode bullet or an emoji before the key (W8, W9), a bullet then a blockquote marker (W10), strikethrough (W11), parentheses (W12), a no-break space indent (W37) and a key inside an HTML comment (W42): 16 shapes, each refused on base and passing on this head, each reading null on both trees. The loss is loudness only: no reader on this head names a head on any of them (H43 null, locator absent, owed stale, guard absent, identical to base), so no wrong head is admitted and the queue still refuses; 0 of the 713 live heading-marker bodies carry a key anywhere without a key line, so no landed record is affected; and the new test matches the file's own keyLineRegex convention that already decides Local-runs presence in the same function, which is the shape the previous record's should-fix 4 asked for. Judged a should-fix, not a must-fix: a seat that copies the --template writes none of these, and the bound on the loss is the one the card accepted (no wrong head, triage 6522257381).
5. Monotone across the readers. My 78 shapes, the previous 56 and the 31 refusal shapes, on both trees: every reader change between base and this head is cited-head to null (F1, F11, H1, H2, H6, H7, H8, W24 and the previous probe's indented-heading shape) or cited-head to the author's own plain line (F2, F3, H4 and the previous probe's trailing-text shape); in no shape does this head name a sha that base did not read from a plain line below an unquoted, unindented heading. latestContractReviewOnHead, locateReviewOfRecord, owed recordReading and the guard's recordVerdict agree in every row on both trees, because all four reach the head through contractReviewHeadMatch and so through contractReviewHeadSha (the only call sites outside the self-tests are :12800, :12819, :12825, post-stamped.mjs :2100, record-recognisers.mjs :2013 and :2040; the guard and owed-reviews import the locator and spell no parser). Live threads: PR fix(pm): a contract-review record reviews only the head on its Head-sha line, never a head its prose names #28023 record 6518659368 at 40b5a25e found / current / stands and absent at a wrong head; PR feat(spec,metadata-protocol,rest,objectql,runtime): GET /meta/object serves switched-off packaged actions beside the item, and the disabled-action refusal reads as a plain sentence #27964 full thread found 6516322954 at b3d92fee and 6516042954 at 8216bec4; the truncated thread null at b3d92fee and found at 8216bec4. Identical to base and to the previous records.
6. Corpus. 11305 issue comments updated since 2026-10-23 (the previous review's REST snapshot, 713 heading-marker bodies; the dev's fresher 11482/724 snapshot is a superset): contractReviewHeadSha returns the same value on all 713 bodies on both trees (0 differences; the 2 nulls are the two no-key legacy records); recordKeyedLineRefusals returns the same rows on all 11305 comments on both trees (0 differences; the 1 refusal on each side is the pre-existing Local-runs row on record 6517315440); 711 records name a head and all 711 carry a Reviewed-by: line; 0 bodies carry a fence line with trailing text, a code-indented key line or a code-indented heading. The dev's 0 / 0 / 0 reproduces.
7. Self-tests on the committed head, exit captured: check-half-states --self-test 0, 5113 cases (dev 5113; base 5105, the H51 block gained two pins, each with four or five limbs); record-recognisers --self-test 0, 337 (unchanged: the template note is prose and gained no pin); post-stamped --self-test 0, 747 across 26 batteries (dev 747; base 744, three new pins); check-owed-reviews --self-test 0, 65 in 9 batteries; check-governed-queue-guard --self-test 0, 403. All five match the dev's report.
8. Ablation, mine, in a detached worktree at this head: (A) the close test back to FENCE_LINE (one sed, git diff --stat 1 file +1/-1): half-states 1 of 5113 red (:33564, the trailing-text pin), post-stamped 0 of 747, recognisers 0 of 337; (C) HEAD_SHA_KEY_LINE back to /head-sha[ \t]:/i: post-stamped 1 of 747 red (:5329, the mid-sentence pin). Each restored with git checkout, porcelain empty, HEAD still f619d31`. Both match the dev's legs A and C; legs B and D are read from the report and are consistent with the pins at :33567, :5330 and :5331, not re-run.
9. contract-review.md :33. 「同形 = ## Contract review 题头之下 Head-sha: 行独占码段、①②③逐项、独立性对、PASS/FAIL。」 True against the reader: the head is read from the first plain Head-sha: line BELOW the record's heading (:12752-12758), nowhere else. Line-neutral (60 lines on both trees, ceiling 60, headroom 0); the line is 120 bytes without its newline, equal to MAX_LINE_BYTES 120 (base 117; the space dropped before 逐项 paid for 之下); no # followed by three or more digits in the file. check-skill-line-ratchet.mjs --self-test (164 cases) then the ratchet: exit 0, contract-review.md 60 of 60; check-skill-id-lint.mjs --self-test (23) then the lint: exit 0, 105 files clean; check-skills-token-ratchet.mjs: exit 0, 56 files within ceilings. The --template note (:1723-1727) says the line is plain and BELOW the heading and lists the quoted, bulleted, fenced, code-indented and pre-heading shapes as prose; true against the reader, and the printed template itself is unchanged.
10. Scope and metadata. The diff touches the four files the card names and nothing else; no export is renamed or removed (FENCE_CLOSE_LINE and HEAD_SHA_KEY_LINE are module-private; CONTRACT_REVIEW_HEADING_MARKER, CONTRACT_REVIEW_HEAD_SHA_LINE, contractReviewHeadSha and RECORD_KEY_SPELLINGS keep their names and shapes). PR body: Fixes #28057 on its own line (the card closes on merge: all five wanted items landed), Clause-②: no, Metadata-protocol: none; labels documentation, size/s, skip-changeset. No new gate and no new refusal class: the reader's accept set is the same or narrower in every probed shape and the writer's refusal fires on a subset of what it fired on before.
11. Not measured here: ESLint on the touched scripts (no node_modules in the worktrees); the Lint · ESLint check-run on this head is success. The dev's 56 gate families are read from the report, not re-run; the Lint · PM dispatch-gates check-run on this head is success.

② Semver level

No published package is touched (.claude/** and scripts/pm/** only); skip-changeset carried. Clause-②: no is right; no narrowing declared or present.

③ Boundary flags

• Served tier versus face: the register answers Tier S on the one .claude/** path, so the governed rules-text face applies and this record is served at CONTRACT_REVIEW_TIER, the tier the queue guard reads. Triage 6522257381 graded p3, loudness, no wrong head admitted, no new gate; the diff adds no gate and no refusal class.
• Author: PR user.login is objectstack-fleet[bot] (attribution comment names os-elon-musk); no non-bot login to record.
• Contract-review-claim: comment 6523278850 names this seat session and this head; no competing claim, no hold, no hand-off; no reviews on the PR.
• CI at review time (third poll, 50 check runs on f619d317): 29 success, 20 skipped by path filter, 0 failure, 1 still in progress (Test Core 1/8). Success on Lint · ESLint, Lint · repo & tooling gates, Lint · PM dispatch-gates, Lint · docs & code guards, Lint · CI release & engine gates, the three Lint · scoped jobs, Type Check · workspace and its sub-jobs, Governed Surface Queue Guard, Dogfood Regression Gate, Test UI, Test Core 2/8, Check Changeset, Check PR Size, PR-body guards, Live required-set sweep, Platform checklist gate sweep, Release section-coverage sweep, board snapshot, Auto Label, filter, Plan Test Core shards, Live half-state sweep. The final all-green reading is the landing gate's.
• Draft PR, mergeable_state: blocked (draft, runs in progress); Tier S landing by the owning seat after this record and all-green.
• Dev report deviations: assignee and review request not set at pr_create (accepted per SKILL.md); ESLint not run directly, covered by the derived lint families and the check-run (accepted, ①.11); check:doc-formula-expressions exit 3 on the first pass then 0 after building the two packages (reporting only). open_questions empty, needs_decision: false, premise_still_valid: true; the premise (the three residuals and the two wording gaps named in record 6520969324) reproduces on the base worktree in the probe's base column.
• The previous record's should-fix 4 asked for exactly the line-initial presence test this head ships; the loss that test carries (①.4) was not named there and is named here as should-fix 1 so the next card can weigh it with the measurement in hand.

④ Design judgment

Rules face, per hits file:

• contract-review.md :33. The 同形 line is where a seat reads what a record of record looks like, and the reader has required the line to sit below the heading since PR fix(pm): read a record's Head-sha line only below its heading, refuse an unreadable one at write time, and name the line in the rules #28042; the edit says so in two characters inside the byte ceiling and the line ceiling, paying for them with one space, in the same word order RECORD_KEY_SPELLINGS uses (BELOW the heading). Against the code it describes, the rule now matches the one reader every gate reaches the head through. Holds.
• The code half, read as the gate the rule names. Fence: testing the close before the open while a fence is open is the smallest change that makes "inside a fence" agree with CommonMark on a close with trailing text, and the open keeps its info string; the one residual divergence (a backtick inside a backtick-fence info string, F16) errs toward reading less, not more. Heading: refusing four spaces at the one place the scope opens, through a second two-token regex that also covers the blockquote, keeps the marker's tolerance for every presence reader and holds the heading to the same column-four bound as the key line; a code-indented record stays a record that names no head, which every consumer files as absent, and the writer refuses it. Writer: presence as a key LINE is the convention keyLineRegex already imposes on Served-tier, Reviewed-by and Local-runs, so the two keys this function judges now share one notion of "written"; the cost is the 16 shapes of ①.4, all loudness, all outside the template. The union with a key-then-hex-span limb would buy most of them back at the price of one prose false positive (P3), and that trade belongs to a card with the measurement, not to this one. No new gate, no new refusal class, consistent with triage. Holds, with should-fix 1.

Implemented-by: claude/project-thread-tk5mmg
Reviewed-by: session_016WV4d1QkPVVzNz3FJqb2iS

VERDICT: PASS

Must-fix: none.

Should-fix (file on a follow-up card):

1. HEAD_SHA_KEY_LINE (post-stamped.mjs :2072) drops 16 reader-null shapes from the write-time refusal that base caught (①.4): a key line opening on a word (Current Head-sha:), two keys on one line with Head-sha second, a table row, underscore emphasis, a task-list item, a heading-styled key, a unicode bullet or emoji before the key, a bullet then a blockquote marker, strikethrough, parentheses, a no-break-space indent, an HTML comment. Loudness only, 0 live. Either add a second presence limb, the key followed directly by a 7-to-40 hex span anywhere on a line (which refuses a prose mention only when it carries the span, P3), or state in the docblock that a key behind a leading word or symbol is not a written key, so the next reader of the function knows the bound was chosen.
2. RECORD_KEY_SPELLINGS['Head-sha'] (:2063) says unindented of the heading while the reader admits one to three spaces (H3), as the same sentence grants the key line; say indented at most three spaces for both, or not indented as code for the heading too. Cosmetic.
3. FENCE_LINE (:12698) opens a backtick fence whose info string contains a backtick (F16), which CommonMark does not; harmless here (it reads less, and a bare run still closes it), noted so the next tightening of the fence model has the list. Cosmetic.

[objectstack-fleet]

domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS

维护者速读

• 改了什么：收紧契约复核记录 Head-sha: 行的读法，并让写入侧的报错更清楚。共 4 个文件。
  • 围栏：只在一行仅有同字符、长度不短于开栏的连续符号时才算关栏。像 ``` 后面还跟文字 这样的行不再关栏。
  • 题头：缩进 4 格以上的 ## Contract review 题头不再打开读取范围。
  • 写入侧：只在出现键行时，才判定记录里有 Head-sha:，正文中顺带提到这个键不再被拒。报错原因写明两种情况：缩进成代码的行、引用题头下的行。
  • 规则文本：contract-review.md:33 写明「题头之下」。
• 为什么改：这是 PR fix(pm): read a record's Head-sha line only below its heading, refuse an unreadable one at write time, and name the line in the rules #28042 复核留下的 should-fix 4–8。前两项是读法上的残余边角，后几项是写入侧的报错精度。
• 风险与回滚：读法只收紧不放宽。用 11305 条评论（其中 713 条复核记录）对比基线：读法差异 0，拒收差异 0。写入侧放宽了一种情况：只是在正文里提到这个键的普通评论，不再被拒。回滚就是 revert。
• 先看：先看 check-half-states.mjs 里关栏的判断，再看 post-stamped.mjs 的 HEAD_SHA_KEY_LINE。
• 两分钟验证：五个自测在本 head 上全部 exit 0：half-states 5113、recognisers 337、post-stamped 747、owed-reviews 65、guard 403。
• 需要你做的：无。登记册判定为 Tier S（.claude/** ×1）。契约复核 PASS，记录在本评论之前，Head-sha: f619d317d724cc8dae9f673353ca2ddafa7831da。本席转 ready 并开自动合并。

席位意见：ACCEPT。契约复核 PASS，没有 must-fix。复核构造了 78 种新写法，加上之前的 56 种和 31 种拒收写法，再加两个真实评论串，四个读者在新旧两边都做了对比：每一处变化都是从「读到被引用的 head」变成「读不出」或「读到作者自己那一行」，没有一处比基线更宽，四个读者每一行结论一致。

should-fix 1 是：写入侧不再拒收 16 种读者本来就读不出的写法，比如以普通单词开头的键行、表格行、行内第二个键。这些写法不会让任何 head 被误读成已审，线上 0 例，所以只是报错没那么及时，不是安全问题。它和 should-fix 2–3（措辞、CommonMark 信息串规则）一起转到跟进卡 #28111。

席位核对

• 形态: one PR, Fixes #28057, four files: scripts/pm/check-half-states.mjs, scripts/pm/post-stamped.mjs, scripts/pm/record-recognisers.mjs, and .claude/skills/pm-dispatch/references/contract-review.md (line 33, 120 bytes, which is the ceiling; line-neutral). skip-changeset. check-governed-merges.mjs --pr 28103: Tier S (.claude/** ×1).
• 前提实测: the heading marker is byte-identical to base, so record presence in the locator, H43, owed-reviews, the guard and the writer is unchanged. An indented-heading record reads stale in owed-reviews and is refused by the writer, and that is pinned. Every reader still reaches the head through the one contractReviewHeadSha.
• 门禁 check-runs: head f619d317d724cc8dae9f673353ca2ddafa7831da: 50 check-runs, 29 success, 20 skipped, 0 failed, 1 in progress (Test Core 1/8); auto-merge waits on it. Locally, the skill line ratchet, the skill-id lint and the token ratchet exit 0. The dev report shows 56 of 56 derived gate families exit 0, reconciled with --ran.
• 接受的偏差: none. The write-side narrowing is what the card asked for (the fix(pm): read a record's Head-sha line only below its heading, refuse an unreadable one at write time, and name the line in the rules #28042 record's should-fix 4). The shapes it no longer refuses are listed on pm(post-stamped): the key-line Head-sha presence test no longer refuses 16 reader-null record shapes base refused; restore loudness or record the bound #28111.
• 范围外去向: pm(post-stamped): the key-line Head-sha presence test no longer refuses 16 reader-null record shapes base refused; restore loudness or record the bound #28111 (pm:blocked on this PR) takes review should-fixes 1–3.
• 落地条款: Tier S. On the contract review PASS on the current head, the seat posts the record and this ACCEPT, flips the PR ready and arms auto-merge, under the maintainer's landing grant for this term (seat thread, 2026-10-29 22:04Z).