docs(tooling): reserve --rewrite-governed-file by its condition, not by actor

[claude]

Fixes #9303

Ruling B (director seat, decision batch #131 item 4, maintainer 「同意」; the skills seat's
verbatim supplement). The usage header of scripts/check-upstream-port-parity.mjs reserved
--rewrite-governed-file for "the human merging it". It now reserves it for whoever can PROVE
the re-sync content-neutral beforehand — digests computed independently before the run, equal to
what the pin holds after it — and for the merging human otherwise.

Why naming an actor was the wrong shape

The reservation's target is a SILENT rewrite of a governed file from another repository's bytes,
not the identity of the person at the keyboard. That hazard is decidable in advance and the check
is cheap, so the condition can be stated as a falsifiable rule instead of being re-ruled per card —
and it fails loudly (a digest mismatch), which is the property that makes it safe to state as a
rule at all.

What changed — one file, comments plus one operator-facing message

Four places addressed the actor; all four now state the condition.

1. The usage header (the lines the ruling names). The comment column is preserved.
2. The ## --resync REFUSES to rewrite governed surface unless told, by name prose, which
   repeated the actor framing ("it is for the human doing the merge"). It now states the condition
   in one sentence and carries the worked example the ruling names: on PR hooks: the three remaining guards name the environment their hatch variable must be set in, never a command prefix #9300 the six drifted
   pinned hook entries were re-synced, and before the run every new upstreamSha256 was shown to
   equal the sha256 of git show origin/main:PATH taken in the objectstack checkout; every
   re-synced file then came back byte-identical to the committed one. The paragraph also states the
   half that is easy to lose: the same digests computed AFTERWARDS do not qualify, because by then
   the bytes are written.
3. The doc comment on RESYNC_GOVERNED_FLAG, which repeated it a third time.
4. The refusal's own instruction line, which said "as the human doing that merge". It now asks
   for the proof first and keeps the merging human as the fallback.

⛔ No behaviour change. The gating predicate resyncWriteVerdict is untouched, the governed set
is still borrowed from check-governed-queue-guard.mjs rather than re-listed, and neither the pin
ledger nor any pinned copy is touched. The self-test's four assertions on the refusal text — it
names the path, names the flag, names the matched surface, and says "drifted governed port reds
this gate" — all still hold by construction.

Readers of this file's header: measured, and there are none

rewrite-governed-file appears in exactly two other tracked files, and neither reads THIS file's
header text, so neither changes here:

• scripts/check-bash32-floor.mjs — one prose mention of the flag by name in that file's own
  header, saying --resync refuses governed paths without it. It does not quote this file's
  wording. It is also itself a pinned ported copy, so editing it would red the very gate this
  PR edits.
• scripts/upstream-port-pin.json — the same sentence again, stored as the ported side of one of
  that file's declared divergences. Same reason, and it is ledger content.

No self-test or test file asserts on the header. scripts/__tests__/upstream-port-parity-wiring.test.ts
reads the workflow wiring, the pin's shape and the gate's stdout, never the header; the four test
files that mention the script by name all still pass (below).

Acceptance readings — scripts/check-upstream-port-parity.mjs, before to after

grep on this file	before	after
the human merging it	1	0
human doing the merge	2	0
human doing that merge	1	0
merging human (the fallback, in the ruling's own words)	0	3
content-neutral	0	5
RESYNC_GOVERNED_FLAG = '--rewrite-governed-file'	1	1 (unchanged)
rewrite-governed-file (all forms)	3	3 (unchanged)

Stated exactly, since the card asked for it: the actor phrasing did not survive as a sole
condition and did not survive at all in that spelling — the fallback is now written "the
merging human", which is the wording of the ruling itself ("stays reserved for the merging human
otherwise"). The file grows 834 to 855 lines, all of it comment text plus two message lines.

git diff --stat origin/main is exactly one file: scripts/check-upstream-port-parity.mjs,
28 insertions, 7 deletions. No changeset: node scripts/check-changeset-presence.mjs exits 0 with
"0 of them published source of a package the release covers ... no changeset is owed" — a
scripts/ file is not published source. ⛔ No skip-changeset label is used in this repository.

Gates — each exit code captured before any pipe

command	exit
node scripts/check-upstream-port-parity.mjs --self-test	0 — 58 cases pass
node scripts/check-upstream-port-parity.mjs	0 — 11 ported files match, each at its own pinned ref
node scripts/check-bash32-floor.mjs --self-test	0 — 160 cases pass
node scripts/check-bash32-floor.mjs	0 — 13 shell files, 19 constructs, floor bash 3.2
node scripts/check-governed-queue-guard.mjs --test scripts/check-upstream-port-parity.mjs	0 — NOT GOVERNED
node scripts/check-changeset-presence.mjs	0 — no changeset owed
node scripts/check-control-bytes.mjs	0 — 7539 text files scanned
node scripts/check-entry-guard.mjs --self-test and the live run	0 and 0
node scripts/check-lint-coverage.mjs	0 — 46/46 packages
node scripts/check-new-cross-file-line-citations.mjs	0 — 0 new citations
pnpm exec vitest run on the four test files naming this script	0 — 4 files, 131 tests pass
pnpm exec eslint --no-inline-config --format json on the changed file	0 — 1 file, 0 errors, 0 warnings

The eslint run is a declared narrowing, with its three readings: the repository lints per
package via turbo run lint and this file is a .mjs under scripts/, matching no typed rule
block in eslint.config.js (whose rule blocks target TS and TSX); the --format json output
carries exactly 1 result object; and no type-aware linting is configured anywhere in that config
(no parserOptions.project, no projectService), so a comment edit in this file cannot move the
verdict on any file it does not touch. The repository-wide sweep is CI's run, not this PR's.

Landing

Draft, base main. Measured rather than assumed: check-governed-queue-guard.mjs --test on the
changed path exits 0 with "NOT GOVERNED — 1 path(s) checked against 5 governed surface(s); none
matched", so objectui scripts/ is an ordinary path. This PR nevertheless stays a DRAFT for the
seat to land after review: ⛔ not flipped ready, ⛔ not enqueued, ⛔ no auto-merge, ⛔ no self-review.

Acceptance notes

• Out-of-scope findings: none filed. Nothing in the read surface was a reproducible defect, a
  declared-contract violation, or a metadata trap.
• Noted, not filed: the actor framing lived in four places, not the two the card's file surface
  listed — the third (RESYNC_GOVERNED_FLAG's doc comment) and fourth (the refusal's instruction
  line) were found by reading, and both are inside the surface the ruling opened ("the flag's own
  refusal/usage text"). Carrier: this PR.
• Serial constraint re-checked after the claim: of the open pull requests created after the seat's
  08:27Z read (9376, 9377, 9378, 9381), none touches this file.

Drafted by the domain:skills seat, session session_01DAcomhvR9kKizeYgg89Vo8 —
https://claude.ai/code/session_01DAcomhvR9kKizeYgg89Vo8

---

Generated by Claude Code

[claude]

Contract review

Head: a412a923 (objectui PR #9383, card objectui#9303) — read at 2026-09-13T08:55Z by the skills seat at the contract-review tier (served model claude-fable-5-1, get_session external_metadata.last_served_model at 2026-09-13T08:08Z); the build was default-tier (model: opus, no path mandate), so this record is the compensating control.

① derived judgments — one file, scripts/check-upstream-port-parity.mjs, +28/−7 on merge-base 69aa9c01 = objectui origin/main; 834 → 855 lines. Ruling B (director 5651977208, maintainer 「同意」; the seat's supplement 5652079514) executed as text only: the --rewrite-governed-file reservation now names its condition — whoever can PROVE the re-sync content-neutral beforehand (digests computed independently before the run equal what the pin holds afterwards) may pass it, the merging human otherwise — in the four places the actor framing lived (usage header, the 「--resync REFUSES」 prose now carrying PR #9300 as the worked example with the note that digests computed afterwards do not qualify, the doc comment on RESYNC_GOVERNED_FLAG, and the refusal's own instruction line). Seat greps head vs base: the human merging it 1 → 0, human doing the merge 2 → 0, merging human 0 → 3, content-neutral 0 → 5, 9300 0 → 1; RESYNC_GOVERNED_FLAG = '--rewrite-governed-file' 1 → 1; the non-comment diff is the refusal's instruction text only (three template-literal lines), so resyncWriteVerdict, governedPathsIn, the argv parsing and the pin ledger are untouched — no behaviour change. Readers of the wording measured: scripts/check-bash32-floor.mjs (a pinned ported copy — editing it would red this very gate) and scripts/upstream-port-pin.json carry the sentence by name only and read nothing from this file's header; no self-test asserts on the header (the self-test asserts the refusal names the path, the flag, the surface and 「drifted governed port reds this gate」, all preserved). Seat-run on the head in a throwaway worktree: --self-test exit 0 (58 cases), check-governed-queue-guard.mjs --test scripts/check-upstream-port-parity.mjs exit 0 「NOT GOVERNED」; control-character scan clean. No accept-set or public-surface change; Clause-②: no (declared on the claim; objectui carries no carrier script).
② semver: scripts/ is not a released package ⇒ no changeset owed (check-changeset-presence exit 0, dev-run); no skip-changeset label in this repository.
③ boundary flags: none raised (open_questions: []). Declared deviations accepted: four sites restated instead of the two the claim listed (all inside the opened surface); the worked example as its own paragraph; the usage header grew two continuation lines inside its column.

Implemented-by: claude/issue-9303-resync-reservation-names-its-condition (mode:subagent)
Reviewed-by: session_01DAcomhvR9kKizeYgg89Vo8

Verdict: PASS. Path face clean (measured NOT GOVERNED): the seat lands it — ready + auto-merge SQUASH once every check on a412a923 has completed, the Doc Snippet Type Check red judged by signature against main's (objectui#9346).

---

Generated by Claude Code

[claude]

CI reading (skills seat, 2026-09-13T09:00Z) — Doc Snippet Type Check is red on head a412a923, and the red is main's, not this PR's: the same check has failed on every main push since edea22a5 (PR #9310), and this PR's failure signature is identical to main's latest run on 69aa9c01 — same failing step (node scripts/check-doc-snippet-types.mjs), same three TS2740 sites (content/docs/guide/schema-rendering.md:99 / :434, packages/react/README.md:73), same first error line, 「649 of 649 block(s) judged, 3 failed」. This PR touches scripts/check-upstream-port-parity.mjs only — none of the three files, and no fenced ts/tsx block the gate reads. The check is not in main's required set. Carrying card objectui#9346 (domain:ui); the fix is objectui PR #9369 in the ui lane — nothing to port here. Under the maintainer's accepted #17934 shape (same check name and same failure signature on the merge-base does not count against 「全绿」) this PR's own face is clean; no re-run is spent on a red that reproduces on main.

---

Generated by Claude Code