本贴是 domain:engine 座位的唯一权威登记。 索引 = label:pm:seat,总入口 #4604 。
本车道 2026-08-19 由 engine-core + metadata + drivers 三车道合并而成(维护者裁决见 #9854 )。#6019 / #6020 已关闭并留迁入审计评论。合并请求卡:#9912 。
单写手规则 :只有在任座位 PM 编辑本贴正文;接管/移交 = 改正文 + 一条审计评论。读取边界 :接管者读本正文 + 仅读晚于其最后一次编辑 的评论。
⛔⛔ 本贴是缓存,缓存会过期 —— 包括这一行
pm:* 标签与卡片自己的评论才是状态。打开那张卡、把评论读到底 。
⭐⭐⭐ 本任期最贵的教训:PM 六次「量错了对象」
六次都不是算错,而是测了一个看起来相关、实际回答另一个问题的东西 。这是本贴留给下一任最有用的一段:
我读的
我以为它答
它实际答
代价
退役车道标签
队列几张
合并前 的车道几张数小时空报「队列 0」,被维护者抓到
gh-readonly-queue/* ref谁在队列里
队列此刻在测 哪一个
把排队中的 #10006 误判为卡死,已动手去强推,被 422 拦下
PR 的 updated_at
dev 报告了没
PR 最后被推动的时间
报「两个 dev 静默 8 小时」,实际两个都早已报告 —— 报在 issue 线程
merge-tree | grep 'changed in both'有几处冲突
有几个文件两侧都动过
派了一整轮解冲突,而真冲突从头到尾是 0
Test Core 分片红 → 「main 进了东西」
谁引入的
(被 #10060 证伪:它没并 main 也红)
差点往错的方向找修复
按卡号 grep 提交标题找 squash
这张卡落地了吗
标题里恰好写了卡号 的提交有哪些
两次误判「未落地」(#9984 →PR #9995 、#9864 →PR #10094 )
⇒ 规则:一个测量在被当作答案之前,必须能说出它在否定情形下返回什么。 六次我都只见过肯定情形,就把它当成了通用读法。这与本贴关于控制量的老规矩是同一条,只是作用在平台事实 而非代码探针上。
⭐ 反面样板(本任期最好的一次收尾) :#10134 的合并前置条件是「无法从仓内确认 branch protection」。解法不是推断,而是把 PR 本身变成实验 :workflow 只在 head 分支被删,所以若该 context 是 required,这张 PR 会停在 Expected;它报了 clean 并被队列接受 ⇒ 不是 required。合并后 main 上又跑起一代新队列 ,从另一侧确证。⇒ 当一个事实读不到时,先问「什么样的观察会因它而不同」。
一、当前 PM
🟢 os-elon · session session_019yDEhPBC3tcGkW9bkce1HM当前:在飞 0 · 队列 0 (2026-08-20 ~09:0xZ)。
二、继承台账
本任期已落地 —— 23 张 ,1 次返工,2 次补丁轮次
另 #9701 / #9390 ⚠️ #9984 与 #9864 的提交标题只带 PR 号、不带卡号
返工 1 次 :#9853 的类型债棘轮 +19,在作者端修好,⛔ 未抬基线 。补丁轮次 2 次 :#9974 的 CI 红(以因果证明 结案,未改一行代码);#9960 的 check:type-source-resolution 红(在作者端修好,⛔ 未加宽注册表)。
在飞 —— 0 张
阻塞中
本任期立的卡(findings)
卡
内容
为什么值得看
#10091 sys_attachment 的更新动词根本没注册授权钩子 (只有 insert/find/delete),而明确抄自它的 sys_comment 四个都有比 #9974 修的洞更大:那是「守卫判错对象」,这是「没有守卫」。⚠️ 首项交付应是「是不是故意的」(附件是否本就不可更新)
#10106 deliveredInbox 超时返回短值 :一处把超时报成「消息从未送达」,另一处期望 0 因而因错误理由通过 假绿那半边不是「把超时喊响」能修的。⛔ 已禁止「只是把 5 秒改大」
#10121 eslint . 间歇性在 migrations/registry.ts 栈溢出(6795 行 / 528 KB,按流程只增不减)⚠️ #10124 已用「调大解析栈」止血,但本卡故意保持开着哪个构造在递归 )未答
#10142 ADR-0082 附录仍点名一个已被 #10143 删除的步骤
docs/adr/** 是 governed surface,#10143 刻意没碰,免得为一条陈旧子句把 PR 变成维护者专属合并
#10062 / #10063 / #10064 dev 立:published src 从 dev-only 依赖 type-import · 提升门无法说出写入的包(#9612 的缩窄在那里永不触发path 用闸门私有下标定位
#10063 尤其:「照那个形状读会编译通过、类型干净,并产出一个看起来在工作、实则永不触发的缩窄」
#9873 dispatch-gates 无法为 scripts/** 点名 check:type-check-debt
⭐ PM 补注 5338592920:这是刻意的 逐耦合手工维护设计,不是疏漏
✅ 本任期核销
[finding] Test Core is red on three unrelated PRs across three different shards, and main has not advanced in ~2.5h — the merge queue looks stalled repo-wide #10125 不同 分片各红一个)。维护者确认 test(plugin-dev): pay the plugin-security transform at module load, out of every clocked window #10120 e61ee6832 全部转绿。finding: #5617's standing "never require" list is stale on Console Pin Freshness — #6121 added the merge_group: trigger that was the stated reason #6991 Console Pin Freshness 排除理由已陈旧。被 ci(release): the objectui pin is a decision — stop resolving objectui main at release time #10143 变为无实义 (workflow 删除后其重启条件不可达),已 not_planned 关闭。⭐ 其实质被保留在更好的位置 :check-required-contexts.mjs 的 ⛔ 排除注记不但没删,还被加强 —— 它现在因为 workflow 消失而更该留 ,是唯一挡住「重建同名 gate 再把它加进 required」的东西。$regex on driver-sql is not a regex — it compiles to a substring LIKE, so it both over-matches and silently matches nothing #4706 $regex 不是正则)—— 一张 bug 卡,无任何 pm:* 标签 ,对每次队列计数都隐形,躺了 11 天。裁决 8 月 6 日就下了、两个子卡也早关了,但没人验过「裁决是否完整 落地」。已从构建树验证并关闭。⇒ 无 pm:* 标签的卡是独立盲区,车道普查要单独扫。 finding: SqlDriver's #3821 recovery ladder widens an unresolvable projection to every field #7589
⚠️ 继承自三张旧贴 —— 未经逐条核实 ,动手前必须重读卡片
维护者决策箱(旧记) :The i18n catalog is resolved ahead of the document, so a tenant's own Studio rename never reaches either /meta/object read — and neither do extension scalar overrides #8284 views: 数组的三个门形状判断不一致:栈级 schema 只收容器、授权 lint 按记录门映射、运行时注册循环全收 —— declared ≠ enforced 的「运行时更宽」向 #5320 Package export emits views: entries the stack manifest vocabulary refuses — the export→import round trip works only through the runtime loop's undeclared wider acceptance #8070 已裁可派(旧记) :The metadata door accepts a dashboard widget dataset binding that names nothing — 200 on both save and publish, referential integrity enforced only at runtime #7529 ⚠️ [P2] 运行时授权门扩到 object 写入 + 全量 runtime-safe 规则快照(#4463 P1 之后) #4716 meta-field-write-inert: an accepted field PUT never reaches the object — a runtime-created field is stored valid=true and is absent from fields forever #7893 ⚠️ 正文被 API 截断,决策段只在网页可见;⚠️ 退役会故意 翻红一条 pin,⛔ 不许「修绿」)· [finding] MetadataFacade.get/list unwrap item?.content ?? item, but content is a real authorable field — a doc registered through the facade reads back as its Markdown string, not the document #7519 metadata-facade.ts 工作同批)。阻塞 / 移出 :MetadataFacade answers three register → get round-trip cases differently from every other shipped IMetadataService #7378 Blocked-by: #8350 在评论里不在正文 )· spec: the IMetadataService contract still states the SUPERSEDED 2026-08-11 register ruling — including a "do not implement" instruction for behaviour now shipped (#7378 spec half) #8350 domain:spec。owed 未扫 :external-datasource-federated-read: federated read returns empty — the external object→remote-table mapping never registers (boot ordering) #7737 [观察,机制未确认] 对不存在的记录 id 走 action body 更新时,afterUpdate hook 的 condition 读 previous 报 400 HookConditionError,而非干净的 not-found #5571 锚点,pm:dispatched 无 dev :finding: 16 test doubles short-circuit $or in their WHERE matcher, dropping sibling filters — the suite stays green while testing a different query #7620 #4649 的「记录对已声明字段全量」只落在两个接缝上 —— 另外三处求值仍是稀疏绑定 #4953 hold(drivers 侧) :driver-memory has no policy for an unsupported comparand TYPE: a BigInt crashes with a raw mingo TypeError, and four other types silently answer zero rows #7872 Turso remote:带 id/conflictKeys 但没匹配上的 upsert 仍会静默写入 NULL 自增号(#6944 拒绝闸门覆盖不到的那条腿) #7099 TursoDriver remote 面根本不生成自增号:RemoteTransport.create 自建 INSERT,auto_number 只是个 TEXT 列 #6944 已过期 )· flaky: sql-driver-overlay-index-drift.test.ts 「stays silent on the SECOND boot, when the runtime ledger starts empty again」偶发判红 #6522 drivers(sql): 共享 canonical 修复表达式把「裸数字文本」当儒略日读,backfill 会把这个误读写进盘里(观察项) #6009 ADR-0053 D-E3：mongo 的遗留形态是永久态，但它既无 backfill 也无读修复——#4191 storage-form 轴最尖的一格无法闭合 #4220 finding: the #7929 read-scope disclosure is NOT analytics-only — an RLS $field filter injected by the security middleware discloses the same policy column on the ordinary CRUD path, and predates #7598 #7988 findings 积压(旧) :metadata-fs: parseItemPath's dot guard rejects only the literal .objectstack, not dot segments generally — narrower than its callers read #7216 revertCommit attributes its revert commit to the request's organization even when the commit it reverted was env-wide — newly reachable as of #7819 tier 1 #7860 [lead, detail lost] A rowToItem driver-path bug was measured during #8006 but never filed — the container was archived before the text was recovered #8100 _diagnostics.valid=true and editable/deletable are asserted for metadata rows no consumer reads — the envelope has no "in effect" axis #8169 The metadata write refusal answers a different code per TOPOLOGY: saveMetaItem's scoped-kernel branch refuses before the repository's package door ever runs #8184 GET /meta/object/:name drops nameField for artifact-ingested objects — the third materialization stamp to diverge on this seam #8268 packages/rest serves /meta/:type/:name/published from the code snapshot too — #8031's fix does not reach the REST transport #8278 ADR-0017 §3.4 cites a path that does not exist — sys-view-definition.object.ts is in metadata-core, not platform-objects #8285 objectql: transaction()'s ambient txStore has no WebContainer AsyncLocalStorage polyfill, so rollback silently covers nothing there #7880 [finding] Realtime DataEvent.after carries the raw driver row — a fifth __search surface that #7868 deliberately did not strip #7877 Uninstalling a package orphans its tenants' bare-key ADR-0005 overlays — warned about, but nothing resolves them #7951 [finding] EngineAggregateOptions.groupBy is declared string[] but the engine also reads { field, dateGranularity } buckets — every correct caller must lie to the type #8032 [finding] The os-regen pre-commit hook and the documented four-step landing procedure give opposite instructions — one of them has to change #8047 finding: author-time expression validation resolves injected anchors on external objects but cannot warn they are unprovisioned — the #7865 provenance marker is unreachable from @objectstack/lint #8116 [finding] Existence coherence of engine/driver doubles is enforced only at the two consumer seams — check:engine-double-contract still cannot see it #8194 [finding] query-options/no-any-erasure's test surface promises a guard tsc cannot deliver — 20 packages exclude **/*.test.ts from their tsconfig #8210 objectql test driver doubles are any-annotated at scale — the retired-capability tombstone has no tsc channel in 64 files #7264 [finding] isSystem 写入的 owner_id 缺口有两处彼此独立的补偿、没有共享机制 —— 第三条系统写入路径两者都拿不到 #6896 ⚠️ GET /meta/object/:name drops nameField for artifact-ingested objects — the third materialization stamp to diverge on this seam #8268 The i18n catalog is resolved ahead of the document, so a tenant's own Studio rename never reaches either /meta/object read — and neither do extension scalar overrides #8284 Object-extension fold leaks the extension's label onto ?layers=true only — the two reads #7556 reconciled on FIELDS now disagree on LABEL #8037
hold 堆规模
全仓 pm:on-hold = 79 ;本车道 = 18 :#9350 · #9276 · #9236 · #9167 · #8924 · #8753 · #8740 · #8722 · #8414 · #8006 · #7880 · #7877 · #7611 · #6009 · #5930 · #5180 · #4220 · #3166 ,加 #9613 (随 #9612 落地可关 )。
⚠️ 这 18 张的 updated_at 全部落在 2026-08-19 07:28–07:29Z ⇒ 今早已有全量扫描走过。再扫全堆低产出 ;有增量的问题是窄的:07:28Z 之后落地的东西解锁了哪些 hold 。
三、热文件串行队
当前:空(在飞 0)。
⚠️ 区域放行只能来自对方卡的实际改动行程 —— 有 PR 就读 diff,没有就申报 UNKNOWN。⛔ 永不 从「它名字里那个符号的地址」推。
实测失败:[finding] Audit the remaining 3 entries of engine.ts's delete-phase hook bullet list — 1 of 3 was measurably stale, and the same rot landed independently in packages/spec the same day #7933 fix(objectql): gate by-id update/delete on record existence — 404 RECORD_NOT_FOUND instead of a 400 from further down the pipeline (#7867) #7989 fix(objectql): gate by-id update/delete on record existence — 404 RECORD_NOT_FOUND instead of a 400 from further down the pipeline (#7867) #7989 退役 一道闸。⛔ 做删除/缩窄的卡,其行程没人能从「它加了什么」推出。
⭐ 本任期实测成功 :runtime gate: full runtime-safe rule snapshot for the publish door — the expensive half split out of the object-gating card #9612 [finding] protocol.deletePackage has no declared spec shape — three hand-rolled types that disagree, and the runtime twin reaches it through as any #9960 packages/metadata-protocol/src/protocol.ts(发布闸门 seam vs deletePackage verb,区域不相交),两张按符号申报区域 、先后入队,队列自己把投机分支串成了 pr-10058 建在刚落地的 #10060 之上 ,零冲突落地。⇒ 区域申报 + 队列串行是有效组合;但 ⛔ 落地后仍要复核另一张的分歧 (本任期核过:真冲突 0)。
⚠️ 行号数小时内即腐烂 —— 本任期实测三次::6996 → ~:7161;authoring-rules.ts 的 :1382 → :1397 / :1408 → :1423。恒按符号定位 ,连 PM 派发令里的行号也不可信(#4716's object-write cost delta was measured on a stub-shaped stack — its real-shape value is unmeasured, on the hottest metadata path in the product #9859 runtime gate: full runtime-safe rule snapshot for the publish door — the expensive half split out of the object-gating card #9612
并发编辑上限 3 ,认领评论里做区域级 申报。纪律四条:认领时申报区域 · 开 PR 前先并 main · 每有同侪落地后再并一次 · 让队列仲裁。
四、说明
📌 岗位说明版本化于 .claude/skills/pm-dispatch/references/lanes/engine.md。⛔ 本贴不复制、不摘抄 —— 读那里。
平台事实 —— 已实测,⛔ 不要重新推导
⛔ 裸 GitHub HTTP 一律 403 (GH_TOKEN/GITHUB_TOKEN 存在但为空 ;无 gh CLI)。只有 mcp__github__* 可用 。⇒ scripts/pm/check-half-states.mjs 永久 401。⚠️ 同源:GET /repos/.../branches/main/protection 也是 403,所以 branch protection 读不到 —— 但可以用 PR 的 mergeable_state 反推 (见 24)。
⭐ git push/fetch/ls-remote 是通的 —— 只有 API 层被封。
⭐ 子代理能到达 GitHub (自开 PR、自贴报告)。
⛔ 远端分支删除不可用 (四次指数退避全败,而 ls-remote 同时是活的)。
⚠️ list_issues 的多标签过滤是 OR 不是 AND不返回 assignees ⇒ 车道列表不是认领检查,交集只能本地算。⚠️ pull_request_read method=get_status 只显示遗留 commit status(Vercel),不是 check runsget_check_runs;其分页有 bug(page=2 返回空),用足够大的 perPage。⛔⛔ refs/heads/gh-readonly-queue/* 回答的是「队列此刻在测哪一个」,不是「谁在队列里」。不是 「没进队」的证据。
⭐⭐ auto-merge 与队列成员资格不跨越 draft 转换。 在 draft 状态下开 auto-merge,转 ready 时会被清掉 —— 这就是本任期 feat(objectql,plugin-audit): refuse an unscoped multi-UPDATE on the shape, not by accident (#9974) #10093 fix(core): both kernels agree a duplicate plugin registration supersedes, and say so out loud #10094 enable_pr_auto_merge 报成功却从没进队」的真因。⇒ 正确顺序:先 draft:false,再 enable_pr_auto_merge。
⭐⭐ 订阅 subscribe_pr_activity 后,pull_request.enqueued / pull_request.closed{outcome:merged} 事件会直接推来 —— 入队与落地都不必再探,也不必用定时器轮询。⚠️ 事件是 best-effort,仍应留一个长兜底检查点。
⚠️ 422 要读它说了什么。 update_pull_request_branch 对已入队 PR 返回 422 并点名 merge queue(可作成员判别);但 expected head sha didn't match current head ref 是另一回事 —— GitHub 的 PR 记录与分支 ref 不同步(本任期 feat(lint,metadata-protocol): judge a package write against its own closure #10058 112c3ffc3、ref 已是 d4c72dbcc,新 head 因此从未跑过 CI ,90 分钟未自愈)。解法:让 dev 并新 main 再推一次,真实提交会强制重新同步。⚠️ enable_pr_auto_merge 返回空字段签名,零诊断价值⚠️ API 会截断长 issue 正文 (meta-field-write-inert: an accepted field PUT never reaches the object — a runtime-created field is stored valid=true and is absent from fields forever #7893 ⚠️ issue_read get_comments 在长卡上会超输出上限⚠️ actions_list 在本仓会超输出上限branch=main 只返回 push 事件 —— 合并走队列 ,main 的真实 CI 历史在 merge_group 里。⚠️ GitHub 的 job 日志尾部会落在 post-job cleanup 段内 ,失败任务自己的输出在更前面且常常取不到。⇒ 逐 PR 定根因的成本被这件事显著抬高。⛔ post_turn_summary / status_detail 不可靠
⚠️ 座位 roster 横跨至少三个 GitHub 账号 ⇒ 跨账号交接是常态。get_session 的 not found 是账号作用域,不是死亡信号 。⚠️ 共用登录使 assignee 字段失声 —— 认领评论里的 session ID 是唯一判别符 。分诊的 assignee 是收件箱路由,不是认领 。⚠️ 同源后果:PR 上的 actor 也分不清是维护者还是别的 agent。⛔ git fetch A 之后再 git fetch B 然后读 FETCH_HEAD,读到的可能是 A。git ls-remote origin 'refs/heads/<pattern>' 并打印控制量 (claude/* ≈ 217–229 条)。⚠️ 已合并分支会被自动删除,⛔ 不能当探针控制量。
⭐ dev 的报告发在 issue 线程,不是 PR。 PR 的 updated_at 早于报告时间(实测两次)。⛔ 永不用 PR 时间戳判断 dev 是否回报。
⭐ git merge-tree | grep 'changed in both' 数的是共同修改的文件,不是冲突。^<<<<<<< 是冲突标记。实测两次:同一输入 ^<<<<<<< = 0、changed in both = 2。
⭐ git diff A..B -- <paths> 两点式会把你自己的新增打印成删除merge-base 锚定 才回答得了「main 动了我的面没有」。
⭐ squash 必须按 sha 或 PR 号记,⛔ 不能靠卡号 grep 提交标题。 实测两次:docs(validation-rules): the multi-value required callout still says the non-empty half is "declared but not yet enforced" — false since #9476 landed, and it tells authors to work around it #9984 docs(validation-rules): required-means-non-empty is enforced, not pending #9995 core(finding): duplicate plugin registration throws on LiteKernel and silently overwrites on ObjectKernel — a fourth instance of the two-kernel semantic split #9864 fix(core): both kernels agree a duplicate plugin registration supersedes, and say so out loud #10094
⭐⭐ branch protection 读不到,但可以用 PR 反推。 一个 required context 若不报,PR 会是 blocked(Expected — waiting for status)且队列不收;若 PR 报 clean 并被队列接受,该 context 不在 required 集。⚠️ 删 workflow 的 PR 尤其适用:pull_request 跑的是 head 分支 的 workflow 文件,所以该 context 在合并前就已从这张 PR 上消失,而影响只限于这张 PR 。合并后再看 main 是否仍有新一代队列在跑,即从另一侧确证。ci(release): the objectui pin is a decision — stop resolving objectui main at release time #10143
本任期新增的方法论
⭐⭐ grep 分不清「主张」和「对主张的描述」。 本任期实例:fix(objectql): discriminate a failed sys_organization probe from a genuinely empty one #9817 [finding] node-metadata-manager's watcher has the same one-shot delivery structure #9339 just repaired, with no reconciliation behind it #9701 authoring-rules.ts:1276 是引用了声明的注释 (朴素 grep 数 8,锚定后是 7);$regex 在 packages/spec 有 48 处命中全是散文 ;showcase 的 multi: true 三处命中里两处是解释它的注释 。⇒ 结构性探针锚在散文模仿不了的语法上 ,或读构建产物 —— 并说明你用的是哪种 。⚠️ 还要防多行 :implements 子句换行时单行 grep 返回 0 。⭐ The objectui pin target is objectstack's decision — stop resolving objectui main at release time (freshness gate + cut-rc auto-bump) #10134 凡是对一个已不存在的活机制做现在时断言的,改;凡是历史/出处引用或一个被命名的形态,留。
⭐⭐ 一个不能因正确理由失败的零,不是证据 —— 控制量必须先于被测对象存在、且被测改动不会移除它。 我自己栽过一次(拿 Measure the two unknowns blocking #9612/#9613, plus package-scoping viability #9920 totalMode 当控制量)。本任期三个 dev 各自的控制量抓住了自己的坏探针 。⭐ 最高级的一次是 runtime gate: full runtime-safe rule snapshot for the publish door — the expensive half split out of the object-gating card #9612 没有把它记成通过 ,而是源码验证「object 门根本没有 objects×objects 耦合,该断言在此不可能因闭包原因失败」—— 控制量不可能失败时,要报告这件事,不是把它当成绿灯 。
⭐⭐ 「不是我的红」要用因果证明,不是消失证明。 Decision: should an unscoped multi: true UPDATE get the whole-operation dispatch that #9719 gave DELETE? (the update half split out of #9798) #9974 执行 0 次 (正控 9 次)。
⭐⭐ 单张 PR 的作者看不见的东西,要横跨 PR 看。 [finding] Test Core is red on three unrelated PRs across three different shards, and main has not advanced in ~2.5h — the merge queue looks stalled repo-wide #10125 不同 分片各红一个。⭐ 而最先被证伪的是最像的那个假设(「main 进了东西」),因为没并 main 的那张也红 。
⭐⭐ 禁令要能被升级成测量。 我把「⛔ 不许用总量比倒推 delta」写成纪律,#4716's object-write cost delta was measured on a stub-shaped stack — its real-shape value is unmeasured, on the hottest metadata path in the product #9859 算术证明 :倒推预测 ~+110 ms,实测 ~+265 ms;且增量比在两次复现间不稳 (53×/66×),总量比却稳定 ~34×。
⭐⭐ 卡本身会错,而树是对的。 The objectui pin target is objectstack's decision — stop resolving objectui main at release time (freshness gate + cut-rc auto-bump) #10134 唯一设 git 身份 的地方(照删会让后续 commit 以 empty ident name 失败,且只在发 RC 时炸);卡要求的「空 frontmatter changeset」本仓禁止 (空 frontmatter changeset 相对 skip-changeset 标签零收益、单向风险 —— 「禁止空 changeset 进 .changeset/」的决策证据(#5292 结案后无处存放) #5471 skip-changeset 标签。⇒ 派发令要求 dev 先自查全集,而不是照卡的清单做 —— 这一条本轮回报三次。
⭐⭐ dispatch-gates 的并集不穷尽 —— 三个独立实例: (a) scripts/** 无法被点名(finding: dispatch-gates cannot name check:type-check-debt for a scripts/** card — the root package's tsc scope is defined by EXCLUSION, so no path literal will ever describe it #9873 被别的包消费的符号 时,本地检查集必须含消费方 (Decision: should an unscoped multi: true UPDATE get the whole-operation dispatch that #9719 gave DELETE? (the update half split out of #9798) #9974 check:type-source-resolution 落在该脚本自己的 "undetermined" 桶 ,脚本自陈「NOT known irrelevant」而 dev 读成了套话([finding] protocol.deletePackage has no declared spec shape — three hand-rolled types that disagree, and the runtime twin reaches it through as any #9960
⭐⭐ 按每个承重 job 自己的 conclusion 把关,⛔ 永不看聚合。 ⚠️ 补丁提交会重置整个闸门农场 。
⭐ 确认「文件没被弄丢」要用 diff 为空,不是 grep 命中。 runtime gate: full runtime-safe rule snapshot for the publish door — the expensive half split out of the object-gating card #9612 git diff <旧head>..HEAD 对被保护文件得到空 ,即逐字节相同 —— 排除的是「被弄丢」;grep 只能证明「看起来在」。
⭐ 一个不存在的 paths 目标会让 tsc 静默回落到 node 解析(即回到 dist) ⇒「多写一条 /* 更保险」是反的。
⭐ 并行吞吐的瓶颈是重验锁,不是派发宽度。 flock /tmp/os-heavy-verify.lock,实测一个 dev 静默 80 分钟。EXIT=99 是锁的排队超时,⛔ 永远不是工具判红
⭐ 「未测量」和「通过」是两回事。 本任期四个实例:check:i18n 的「PREREQUISITE NOT MET」;pnpm --filter 匹配不到脚本时 exit 0 什么也没跑 ;check:type-check-debt 对未构建闭包拒绝测量 ;重建 worktree 后的 Failed to resolve entry 只是未构建闭包。四次 dev 都没读成绿。
⭐ PM 前提被证伪是成功结局,但前提是它被写下来。 本轮四次,都已在卡上标注已证伪、不得再继承 。
未决,已上报维护者(⛔ 非本席可闭)
迁移注记:2026-08-19 由 #6019 (engine-core)+ #6020 (drivers)+ 本贴(metadata)三合一;请求卡 #9912 。
本贴是
domain:engine座位的唯一权威登记。 索引 =label:pm:seat,总入口 #4604。本车道 2026-08-19 由 engine-core + metadata + drivers 三车道合并而成(维护者裁决见 #9854)。#6019 / #6020 已关闭并留迁入审计评论。合并请求卡:#9912。
单写手规则:只有在任座位 PM 编辑本贴正文;接管/移交 = 改正文 + 一条审计评论。读取边界:接管者读本正文 + 仅读晚于其最后一次编辑的评论。
⛔⛔ 本贴是缓存,缓存会过期 —— 包括这一行
pm:*标签与卡片自己的评论才是状态。 把本贴任何一条当成开着的卡之前,打开那张卡、把评论读到底。⭐⭐⭐ 本任期最贵的教训:PM 六次「量错了对象」
六次都不是算错,而是测了一个看起来相关、实际回答另一个问题的东西。这是本贴留给下一任最有用的一段:
gh-readonly-queue/*refupdated_atmerge-tree | grep 'changed in both'⇒ 规则:一个测量在被当作答案之前,必须能说出它在否定情形下返回什么。 六次我都只见过肯定情形,就把它当成了通用读法。这与本贴关于控制量的老规矩是同一条,只是作用在平台事实而非代码探针上。
⭐ 反面样板(本任期最好的一次收尾):#10134 的合并前置条件是「无法从仓内确认 branch protection」。解法不是推断,而是把 PR 本身变成实验:workflow 只在 head 分支被删,所以若该 context 是 required,这张 PR 会停在
Expected;它报了clean并被队列接受 ⇒ 不是 required。合并后 main 上又跑起一代新队列,从另一侧确证。⇒ 当一个事实读不到时,先问「什么样的观察会因它而不同」。一、当前 PM
🟢
os-elon· sessionsession_019yDEhPBC3tcGkW9bkce1HM· 本任期 2026-08-19 ~00:3xZ 起。当前:在飞 0 · 队列 0(2026-08-20 ~09:0xZ)。二、继承台账
本任期已落地 —— 23 张,1 次返工,2 次补丁轮次
ca19ee81f6a5e6adf152fbba6db1258dcaee2a9752cf091c4ff5c7855591fe788a4c7af51408ae337— object 门 2 → 7 条规则cfe1c4902fb62bd19e— 落下可复跑的闸门基准ae555f429— 基准增--mode per-rule/--mode closureb7355075290f4d5dc321995d73b477fd59f55302c7548— object 门真实形状 BEFORE 基线907c11d2c4639cec4d— 未限定范围的批量更新按形状拒收c766ec360—deletePackage三形状收敛为单一声明类型6f5a44976— 按软件包自身闭包校验包的写入a38408af3— 双内核对重复注册达成一致并出声5a2ce6c0d— objectui pin 是决定,发版不再扫描 objectui main另 #9701 / #9390 交付后无 PR 关闭。⚠️ #9984 与 #9864 的提交标题只带 PR 号、不带卡号,按卡号 grep 找不到 —— 见上表第六行的教训。
返工 1 次:#9853 的类型债棘轮 +19,在作者端修好,⛔ 未抬基线。
补丁轮次 2 次:#9974 的 CI 红(以因果证明结案,未改一行代码);#9960 的
check:type-source-resolution红(在作者端修好,⛔ 未加宽注册表)。在飞 —— 0 张
阻塞中
searchableFieldsandsort) are CLI-only — the reference-integrity suite dispatches at the runtime publish gate forflowalone, so a Studio/MCPviewwrite gets neither #9313 ——pm:blocked,Fable 5 配额。dev 会话ab405a4caf345b039的自有提交f2e1822ce(585 行 / 10 文件)已代推,未追踪的 changeset 原样保存在卡上评论里。⛔ 配额恢复前不复派,永不降档。 ⛔ 我拒绝了替它提交那个 changeset:changeset 声明的是一个已发货的minor,而其证明义务从未履行。config.sort/config.searchableFieldsis judged by neither list-view field rule — the same runtime-door gap #9313 closed for the flattened overlay, one member over #10001 ——pm:blocked,压在 [finding] Both field-resolution gates for a list view (searchableFieldsandsort) are CLI-only — the reference-integrity suite dispatches at the runtime publish gate forflowalone, so a Studio/MCPviewwrite gets neither #9313 上。本任期立的卡(findings)
sys_attachment的更新动词根本没注册授权钩子(只有 insert/find/delete),而明确抄自它的sys_comment四个都有deliveredInbox超时返回短值:一处把超时报成「消息从未送达」,另一处期望 0 因而因错误理由通过eslint .间歇性在migrations/registry.ts栈溢出(6795 行 / 528 KB,按流程只增不减)docs/adr/**是 governed surface,#10143 刻意没碰,免得为一条陈旧子句把 PR 变成维护者专属合并path用闸门私有下标定位scripts/**点名check:type-check-debt5338592920:这是刻意的逐耦合手工维护设计,不是疏漏✅ 本任期核销
Test Coreis red on three unrelated PRs across three different shards, andmainhas not advanced in ~2.5h — the merge queue looks stalled repo-wide #10125 —— 全仓 CI 停摆(三张互不相关 PR、三个不同分片各红一个)。维护者确认 test(plugin-dev): pay the plugin-security transform at module load, out of every clocked window #10120 修的是队列合并问题;三张随e61ee6832全部转绿。Console Pin Freshness— #6121 added themerge_group:trigger that was the stated reason #6991 ——Console Pin Freshness排除理由已陈旧。被 ci(release): the objectui pin is a decision — stop resolving objectui main at release time #10143 变为无实义(workflow 删除后其重启条件不可达),已not_planned关闭。⭐ 其实质被保留在更好的位置:check-required-contexts.mjs的 ⛔ 排除注记不但没删,还被加强 —— 它现在因为 workflow 消失而更该留,是唯一挡住「重建同名 gate 再把它加进 required」的东西。$regexon driver-sql is not a regex — it compiles to a substring LIKE, so it both over-matches and silently matches nothing #4706($regex不是正则)—— 一张bug卡,无任何pm:*标签,对每次队列计数都隐形,躺了 11 天。裁决 8 月 6 日就下了、两个子卡也早关了,但没人验过「裁决是否完整落地」。已从构建树验证并关闭。⇒ 无pm:*标签的卡是独立盲区,车道普查要单独扫。/meta/objectread — and neither do extension scalar overrides #8284 ·views:数组的三个门形状判断不一致:栈级 schema 只收容器、授权 lint 按记录门映射、运行时注册循环全收 —— declared ≠ enforced 的「运行时更宽」向 #5320(Package export emitsviews:entries the stack manifest vocabulary refuses — the export→import round trip works only through the runtime loop's undeclared wider acceptance #8070 在其上,同一决策,⛔ 不单独答)。fieldPUT never reaches the object — a runtime-created field is storedvalid=trueand is absent fromfieldsforever #7893(裁 option 2;item?.content ?? item, butcontentis a real authorable field — a doc registered through the facade reads back as its Markdown string, not the document #7519(⛔ 永不与其它metadata-facade.ts工作同批)。MetadataFacadeanswers threeregister→getround-trip cases differently from every other shippedIMetadataService#7378(Blocked-by: #8350在评论里不在正文)· spec: the IMetadataService contract still states the SUPERSEDED 2026-08-11 register ruling — including a "do not implement" instruction for behaviour now shipped (#7378 spec half) #8350 已转domain:spec。pm:dispatched无 dev:finding: 16 test doubles short-circuit $or in their WHERE matcher, dropping sibling filters — the suite stays green while testing a different query #7620 · #4649 的「记录对已声明字段全量」只落在两个接缝上 —— 另外三处求值仍是稀疏绑定 #4953 ⛔ 永不回收、⛔ 不重贴标签。BigIntcrashes with a raw mingoTypeError, and four other types silently answer zero rows #7872 · Turso remote:带 id/conflictKeys 但没匹配上的 upsert 仍会静默写入 NULL 自增号(#6944 拒绝闸门覆盖不到的那条腿) #7099(旧记「等 TursoDriver remote 面根本不生成自增号:RemoteTransport.create 自建 INSERT,auto_number 只是个 TEXT 列 #6944 处置 A」已过期)· flaky:sql-driver-overlay-index-drift.test.ts「stays silent on the SECOND boot, when the runtime ledger starts empty again」偶发判红 #6522 · drivers(sql): 共享 canonical 修复表达式把「裸数字文本」当儒略日读,backfill 会把这个误读写进盘里(观察项) #6009 · ADR-0053 D-E3：mongo 的遗留形态是永久态，但它既无 backfill 也无读修复——#4191 storage-form 轴最尖的一格无法闭合 #4220 · finding: the #7929 read-scope disclosure is NOT analytics-only — an RLS$fieldfilter injected by the security middleware discloses the same policy column on the ordinary CRUD path, and predates #7598 #7988。parseItemPath's dot guard rejects only the literal.objectstack, not dot segments generally — narrower than its callers read #7216 ·revertCommitattributes its revert commit to the request's organization even when the commit it reverted was env-wide — newly reachable as of #7819 tier 1 #7860 · [lead, detail lost] ArowToItemdriver-path bug was measured during #8006 but never filed — the container was archived before the text was recovered #8100 ·_diagnostics.valid=trueandeditable/deletableare asserted for metadata rows no consumer reads — the envelope has no "in effect" axis #8169 · The metadata write refusal answers a different code per TOPOLOGY:saveMetaItem's scoped-kernel branch refuses before the repository's package door ever runs #8184 ·GET /meta/object/:namedropsnameFieldfor artifact-ingested objects — the third materialization stamp to diverge on this seam #8268 ·packages/restserves/meta/:type/:name/publishedfrom the code snapshot too — #8031's fix does not reach the REST transport #8278 · ADR-0017 §3.4 cites a path that does not exist —sys-view-definition.object.tsis inmetadata-core, notplatform-objects#8285 · objectql:transaction()'s ambient txStore has no WebContainer AsyncLocalStorage polyfill, so rollback silently covers nothing there #7880 · [finding] RealtimeDataEvent.aftercarries the raw driver row — a fifth__searchsurface that #7868 deliberately did not strip #7877 · Uninstalling a package orphans its tenants' bare-key ADR-0005 overlays — warned about, but nothing resolves them #7951 · [finding]EngineAggregateOptions.groupByis declaredstring[]but the engine also reads{ field, dateGranularity }buckets — every correct caller must lie to the type #8032 · [finding] Theos-regenpre-commit hook and the documented four-step landing procedure give opposite instructions — one of them has to change #8047 · finding: author-time expression validation resolves injected anchors on external objects but cannot warn they are unprovisioned — the #7865 provenance marker is unreachable from @objectstack/lint #8116 · [finding] Existence coherence of engine/driver doubles is enforced only at the two consumer seams —check:engine-double-contractstill cannot see it #8194 · [finding]query-options/no-any-erasure's test surface promises a guard tsc cannot deliver — 20 packages exclude**/*.test.tsfrom their tsconfig #8210 · objectql test driver doubles areany-annotated at scale — the retired-capability tombstone has no tsc channel in 64 files #7264 · [finding]isSystem写入的 owner_id 缺口有两处彼此独立的补偿、没有共享机制 —— 第三条系统写入路径两者都拿不到 #6896。GET /meta/object/:namedropsnameFieldfor artifact-ingested objects — the third materialization stamp to diverge on this seam #8268 / The i18n catalog is resolved ahead of the document, so a tenant's own Studio rename never reaches either/meta/objectread — and neither do extension scalar overrides #8284 / Object-extension fold leaks the extension'slabelonto?layers=trueonly — the two reads #7556 reconciled on FIELDS now disagree on LABEL #8037 必须一起读再分配。hold 堆规模
全仓
pm:on-hold= 79;本车道 = 18:#9350 · #9276 · #9236 · #9167 · #8924 · #8753 · #8740 · #8722 · #8414 · #8006 · #7880 · #7877 · #7611 · #6009 · #5930 · #5180 · #4220 · #3166,加 #9613(随 #9612 落地可关)。updated_at全部落在 2026-08-19 07:28–07:29Z ⇒ 今早已有全量扫描走过。再扫全堆低产出;有增量的问题是窄的:07:28Z 之后落地的东西解锁了哪些 hold。三、热文件串行队
当前:空(在飞 0)。
protocol.deletePackagehas no declared spec shape — three hand-rolled types that disagree, and the runtime twin reaches it throughas any#9960 都碰packages/metadata-protocol/src/protocol.ts(发布闸门 seam vsdeletePackageverb,区域不相交),两张按符号申报区域、先后入队,队列自己把投机分支串成了pr-10058建在刚落地的#10060之上,零冲突落地。⇒ 区域申报 + 队列串行是有效组合;但 ⛔ 落地后仍要复核另一张的分歧(本任期核过:真冲突 0)。:6996→~:7161;authoring-rules.ts的:1382→:1397/:1408→:1423。恒按符号定位,连 PM 派发令里的行号也不可信(#4716's object-write cost delta was measured on a stub-shaped stack — its real-shape value is unmeasured, on the hottest metadata path in the product #9859 与 runtime gate: full runtime-safe rule snapshot for the publish door — the expensive half split out of the object-gating card #9612 的 dev 各自撞到过我给的陈旧行号)。并发编辑上限 3,认领评论里做区域级申报。纪律四条:认领时申报区域 · 开 PR 前先并
main· 每有同侪落地后再并一次 · 让队列仲裁。四、说明
📌 岗位说明版本化于
.claude/skills/pm-dispatch/references/lanes/engine.md。⛔ 本贴不复制、不摘抄 —— 读那里。平台事实 —— 已实测,⛔ 不要重新推导
GH_TOKEN/GITHUB_TOKEN存在但为空;无ghCLI)。只有mcp__github__*可用。⇒scripts/pm/check-half-states.mjs永久 401。GET /repos/.../branches/main/protection也是 403,所以 branch protection 读不到 —— 但可以用 PR 的mergeable_state反推(见 24)。git push/fetch/ls-remote是通的 —— 只有 API 层被封。ls-remote同时是活的)。list_issues的多标签过滤是 OR 不是 AND,且不返回assignees⇒ 车道列表不是认领检查,交集只能本地算。pull_request_read method=get_status只显示遗留 commit status(Vercel),不是 check runs —— 用get_check_runs;其分页有 bug(page=2返回空),用足够大的perPage。refs/heads/gh-readonly-queue/*回答的是「队列此刻在测哪一个」,不是「谁在队列里」。 排队等待的 PR 一条都不给,空结果不是「没进队」的证据。enable_pr_auto_merge报成功却从没进队」的真因。⇒ 正确顺序:先draft:false,再enable_pr_auto_merge。subscribe_pr_activity后,pull_request.enqueued/pull_request.closed{outcome:merged}事件会直接推来 —— 入队与落地都不必再探,也不必用定时器轮询。update_pull_request_branch对已入队 PR 返回 422 并点名 merge queue(可作成员判别);但expected head sha didn't match current head ref是另一回事 —— GitHub 的 PR 记录与分支 ref 不同步(本任期 feat(lint,metadata-protocol): judge a package write against its own closure #10058 实测:API 停在112c3ffc3、ref 已是d4c72dbcc,新 head 因此从未跑过 CI,90 分钟未自愈)。解法:让 dev 并新 main 再推一次,真实提交会强制重新同步。enable_pr_auto_merge返回空字段签名,零诊断价值,且返回 success 不等于进队(见 8)。它是幂等的。fieldPUT never reaches the object — a runtime-created field is storedvalid=trueand is absent fromfieldsforever #7893 的「Decision Required」整段落在未返回的那半)⇒ 派发令要让 dev 自查正文截断。issue_read get_comments在长卡上会超输出上限 —— 从尾部分页读。actions_list在本仓会超输出上限(单次 46 万字符),且branch=main只返回push事件 —— 合并走队列,main 的真实 CI 历史在merge_group里。post_turn_summary/status_detail不可靠(一个班次内两次确认为假)。get_session的not found是账号作用域,不是死亡信号。actor也分不清是维护者还是别的 agent。git fetch A之后再git fetch B然后读FETCH_HEAD,读到的可能是 A。 用git ls-remote origin 'refs/heads/<pattern>'并打印控制量(claude/*≈ 217–229 条)。updated_at早于报告时间(实测两次)。⛔ 永不用 PR 时间戳判断 dev 是否回报。git merge-tree | grep 'changed in both'数的是共同修改的文件,不是冲突。 只有^<<<<<<<是冲突标记。实测两次:同一输入^<<<<<<<= 0、changed in both= 2。git diff A..B -- <paths>两点式会把你自己的新增打印成删除,读起来像 main 删了你的工作。只有按 merge-base 锚定才回答得了「main 动了我的面没有」。requiredcallout still says the non-empty half is "declared but not yet enforced" — false since #9476 landed, and it tells authors to work around it #9984 落在 PR docs(validation-rules): required-means-non-empty is enforced, not pending #9995、core(finding): duplicate plugin registration throws onLiteKerneland silently overwrites onObjectKernel— a fourth instance of the two-kernel semantic split #9864 落在 PR fix(core): both kernels agree a duplicate plugin registration supersedes, and say so out loud #10094。blocked(Expected — waiting for status)且队列不收;若 PR 报clean并被队列接受,该 context 不在 required 集。pull_request跑的是 head 分支的 workflow 文件,所以该 context 在合并前就已从这张 PR 上消失,而影响只限于这张 PR。合并后再看 main 是否仍有新一代队列在跑,即从另一侧确证。ci(release): the objectui pin is a decision — stop resolving objectui main at release time #10143 实测两侧皆通。本任期新增的方法论
node-metadata-manager's watcher has the same one-shot delivery structure #9339 just repaired, with no reconciliation behind it #9701 的字面量带反引号;authoring-rules.ts:1276是引用了声明的注释(朴素 grep 数 8,锚定后是 7);$regex在packages/spec有 48 处命中全是散文;showcase 的multi: true三处命中里两处是解释它的注释。⇒ 结构性探针锚在散文模仿不了的语法上,或读构建产物 —— 并说明你用的是哪种。implements子句换行时单行 grep 返回 0。⭐ The objectui pin target is objectstack's decision — stop resolving objectui main at release time (freshness gate + cut-rc auto-bump) #10134 给出了处理散文命中的可复用判据:凡是对一个已不存在的活机制做现在时断言的,改;凡是历史/出处引用或一个被命名的形态,留。totalMode当控制量)。本任期三个 dev 各自的控制量抓住了自己的坏探针。⭐ 最高级的一次是 runtime gate: full runtime-safe rule snapshot for the publish door — the expensive half split out of the object-gating card #9612:object 门两个控制量都无变化,dev 没有把它记成通过,而是源码验证「object 门根本没有 objects×objects 耦合,该断言在此不可能因闭包原因失败」—— 控制量不可能失败时,要报告这件事,不是把它当成绿灯。multi: trueUPDATE get the whole-operation dispatch that #9719 gave DELETE? (the update half split out of #9798) #9974 的 dev 给构建产物打桩,量到新代码路径在出错的包里执行 0 次(正控 9 次)。Test Coreis red on three unrelated PRs across three different shards, andmainhas not advanced in ~2.5h — the merge queue looks stalled repo-wide #10125:三张互不相关 PR、三个不同分片各红一个。⭐ 而最先被证伪的是最像的那个假设(「main 进了东西」),因为没并 main 的那张也红。empty ident name失败,且只在发 RC 时炸);卡要求的「空 frontmatter changeset」本仓禁止(空 frontmatter changeset 相对skip-changeset标签零收益、单向风险 —— 「禁止空 changeset 进 .changeset/」的决策证据(#5292 结案后无处存放) #5471),正确工具是skip-changeset标签。⇒ 派发令要求 dev 先自查全集,而不是照卡的清单做 —— 这一条本轮回报三次。scripts/**无法被点名(finding: dispatch-gates cannot name check:type-check-debt for a scripts/** card — the root package's tsc scope is defined by EXCLUSION, so no path literal will ever describe it #9873);(b) 改了被别的包消费的符号时,本地检查集必须含消费方(Decision: should an unscopedmulti: trueUPDATE get the whole-operation dispatch that #9719 gave DELETE? (the update half split out of #9798) #9974 的 showcase 红);(c)check:type-source-resolution落在该脚本自己的 "undetermined" 桶,脚本自陈「NOT known irrelevant」而 dev 读成了套话([finding]protocol.deletePackagehas no declared spec shape — three hand-rolled types that disagree, and the runtime twin reaches it throughas any#9960)。conclusion把关,⛔ 永不看聚合。git diff <旧head>..HEAD对被保护文件得到空,即逐字节相同 —— 排除的是「被弄丢」;grep 只能证明「看起来在」。paths目标会让 tsc 静默回落到 node 解析(即回到dist) ⇒「多写一条/*更保险」是反的。flock /tmp/os-heavy-verify.lock,实测一个 dev 静默 80 分钟。EXIT=99是锁的排队超时,⛔ 永远不是工具判红(与 tsc 自己的 exit 2 区分)。check:i18n的「PREREQUISITE NOT MET」;pnpm --filter匹配不到脚本时 exit 0 什么也没跑;check:type-check-debt对未构建闭包拒绝测量;重建 worktree 后的Failed to resolve entry只是未构建闭包。四次 dev 都没读成绿。未决,已上报维护者(⛔ 非本席可闭)
domain:services席空缺([PM seat] domain:services — 🟢 occupied（合并后车道：services + 原 identity） #6021),压着含 The #4630 unscoped multi-write refusals on sys_comment never fire through the wired engine — per-row dispatch bypasses resolveTargetRows on both verbs #9798 在内的队列。记录在 The #4630 unscoped multi-write refusals on sys_comment never fire through the wired engine — per-row dispatch bypasses resolveTargetRows on both verbs #9798 评论5337296482。fieldPUT never reaches the object — a runtime-created field is storedvalid=trueand is absent fromfieldsforever #7893 /recordIdFieldis not harvested into the grid's$select—sys_session"Revoke Session" reports success and revokes nothing #8018 /reassignOrphanedMetadata/ Check whethersys_session.token— a live session credential — serializes over the data API (ADR-0100 channel 3 has no read protection) #7823 / view-authoring-live: the documented view-container authoring path is inert at runtime — the container is stored but never served #7736 / The i18n catalog is resolved ahead of the document, so a tenant's own Studio rename never reaches either/meta/objectread — and neither do extension scalar overrides #8284)。packages/core的局部惯例本身就是那笔债:该包其余测试用无扩展名相对导入,照着写会加 TS2835 并抬高只能降的台账(core(finding): duplicate plugin registration throws onLiteKerneland silently overwrites onObjectKernel— a fourth instance of the two-kernel semantic split #9864 的 dev 实测 98 → 102)。⇒ 每个进这个包的人都要付一轮修复。迁移注记:2026-08-19 由 #6019(engine-core)+ #6020(drivers)+ 本贴(metadata)三合一;请求卡 #9912。