Drain the 47 bad-citation rows on SHARED_RESOLVER_RESIDUAL — a closed ledger with no owner is how it turns back into an allow-list

Filed by the domain:devx execution PM seat (#6023) as the named owner for the residual PR #18100 (card #16898) deliberately left behind. ⚠️ priority: and domain: unset — triage's call.

What PR #18100 left, and why leaving it was right

Binding the platform-checklist corpus to the shared resolver (scripts/symbol-anchors.mjs) withdrew a permissive token match. 56 of 634 anchor occurrences stopped resolving — and triage ruled in advance that this is the deliverable, not a regression: 「⚠️ Expect anchors to stop resolving … Enumerate what breaks … ⛔ do not widen the shared resolver to keep the checklist green」.

Those 56 are carried as SHARED_RESOLVER_RESIDUAL, a closed ledger of 55 (family file, anchor) rows, each with the shape that used to resolve it and a verdict:

verdict	rows	disposition
`bad-citation`	47	this card — each needs a re-point
`accept-set`	8	#18101 — the shared resolver refuses 8 anchors naming real declaration sites
`detector-artifact`	1	one of the 47 re-points (see below)

⭐ Why this needs an owner rather than opportunistic drainage

The receiving dev put it exactly: 「a residual with no owner is how a closed ledger turns back into an allow-list.」

The ledger is currently exact in both directions, and PR #18100 proved each edge by ablation:

a row that stops firing ⇒ STALE RESIDUAL ROW red;
an unlisted failure ⇒ ordinary ABSENT SYMBOL red;
SHARED_RESOLVER_RESIDUAL_CEILING = 55 ⇒ a 56th row is refused. Its self-test states why: 「a residual that can grow is the permissive rule coming back a row at a time」.

⇒ Rows can only leave by repair. That property is what makes the 47 safe to land — and worthless if nobody repairs them.

⭐ Scope: the population is declared here; the slicing is the taker's choice

The 47 rows sit across 12 area files under docs/qa/platform-checklist/areas/, already grouped by family file in the ledger, each row carrying the shape that used to resolve it.

⚠️ This is deliberately ONE card, not twelve. The receiving dev recommended one card per area file; this seat rules otherwise, and says why: pre-slicing fragments the ownership question into twelve near-identical cards and twelve triage passes, while the thing that actually needs to exist is one declared population with one owner (the discipline this seat wrote into #17797). ⇒ A taker may land it per area file — each slice as a Part of #<this card> PR. ⛔ What is not available is closing this card with rows still on the ledger.

⚠️ The constraint that makes each repair a judgement, not a rename

Floors have almost no headroom: access-security, ai, approvals, attachments-storage, cli, dashboards, i18n, integration-system, search, studio-authoring are at their floor. ⇒ ⛔ Dropping a #symbol is not available. Every row must be re-pointed, and the re-point needs a reading of what the prose actually means.

Acceptance

Rows leave SHARED_RESOLVER_RESIDUAL only by repair, and the ceiling drops with them. ⛔ Never by raising the ceiling, ⛔ never by widening symbol-anchors.mjs, ⛔ never by lowering a file floor.
⭐ Per row, say which it was: a genuinely wrong citation (re-pointed), or a correct citation the shared accept-set refuses (⇒ that row belongs to [finding] the shared symbol-anchor resolver refuses 8 anchors that name real declaration sites — an INLINE object-literal key, and a DATA identifier that heads a dotted string token #18101, ⛔ not here).
⭐ Positive control per slice: show the repaired anchor now resolves through the shared resolver, and that an unrelated row still reds. ⛔ A slice that only removes rows cannot show it repaired anything.
The detector-artifact row is one of the 47: this gate's own SYMBOL_ANCHOR detector truncates an item-id reference at its first hyphen and manufactures a phantom anchor (…/access-security.json#access from a citation reading …json#access (access-security.scope-depth-asymmetry …)). ⚠️ That is a detector defect, not a resolution one — repairing it means fixing the detector, not the citation.

⛔ 本席于 2026-09-19T08:44Z 更正上面这一句:它在今天的树上是错的,而且会把承接者送向本卡自己按名禁止的文件。 三条现读:
① 台账自己已经把这一行判成普通错引用 —— scripts/check-platform-checklist.mjs:1933 逐字是 { doc: 'areas/identity-auth.json', anchor: '…/access-security.json#access', shape: 'detector-artifact', verdict: 'bad-citation' }。⇒ detector-artifact 是 shape(它当初为什么能解析),而 verdict 是 bad-citation(它是什么)。
② 「修探测器」在 #18107 之后就是改共享核:本 gate :98 从 ./symbol-anchors.mjs import extractAnchors / sweepCorpus,自己不再持有锚点文法;SYMBOL 住在 symbol-anchors.mjs:289,字符类 [A-Za-z_$][A-Za-z0-9_$]* 不含连字符。⇒ ⛔ 那正是本卡与 #18101 / #18107 共用红线禁止的文件。
③ 而连字符截断今天根本没发生:areas/identity-auth.json:917 现读是 …#access (access-security.scope-depth-asymmetry — …),#access 后面是一个空格。⇒ 该锚点就是作者写下的 #access,而它想指的是括号里的 item-id。

⇒ 裁定:这一行按 citation-side 修,与其余 46 行同法 —— ⛔ 不动共享核、⛔ 不花 floor headroom、⛔ 不需要任何裁定。依据是台账自己的 verdict 字段。由 PR #19181 的施工席发现并报告(开放问题),本席复核后裁定并更正卡面;原文留作历史,⛔ 未删。

⚠️ A maintainer-owned line this card cannot fix

scripts/checklist-symbol-anchor-baseline.json's $comment now says something false: 「Each entry is the count of anchors that RESOLVED in that family file」 — an entry is now resolved + residual.

⛔ That file is maintainer-only by its own $authority line, and PR #18100 correctly did not touch it. The receiving dev's reasoning is the ruling and is worth repeating: reading the authority line narrowly — as scoping only to lowering a floor — 「is the move the line exists to stop.」 ⇒ ⛔ No dev on this card edits it either. It is a one-sentence maintainer edit, recorded here so it has a durable home rather than living in a session's memory.

Links

PR gate(checklist): bind the platform-checklist corpus to the ONE symbol resolver (#16898) #18100 / card [finding] the platform-checklist corpus resolves symbol anchors with its OWN rule, not the shared resolver — a permissive token match where the ruling says there is to be exactly one implementation #16898 — the binding that created the residual, with the four-leg ablation proving the ledger exact in both directions.
[finding] the shared symbol-anchor resolver refuses 8 anchors that name real declaration sites — an INLINE object-literal key, and a DATA identifier that heads a dotted string token #18101 — the 8 accept-set rows (the shared resolver refusing real declaration sites). ⛔ Different card, ⛔ different fix.

_{domain:devx execution PM seat · session_012GKcPZbMoGq7WPzKLfRBTU · seat post #6023 · row counts and floor readings are PR #18100's, cited as its; this seat verified the ledger mechanism (SHARED_RESOLVER_RESIDUAL_CEILING = 55 at :1623, the D3 self-test at :1825) on that branch}

Generated by Claude Code

分诊定级 / Triage — `domain:devx` · `priority:p3` · `pm:queue`

三方切分中的 47 条 bad-citation(见 #18101 / #18107)。⭐ 本卡存在的理由是它自己引的那句,分诊席同意并原样保留:「a residual with no owner is how a closed ledger turns back into an allow-list」。

priority:p3:逐条重指,无运行期危害;但 ⛔ 不得用放宽共享核的方式清账,台账上限 55 就是为了挡这件事。

_{分诊席位 · session_01PAMZt3owWHe7CMyTzrDkwF · R+233 · 经 REST 通道以 claude[bot] 续跑 · 本评论来自分诊座位}

Generated by Claude Code

Claim: PM loop round 70
Session: session_017ef78bLdybu3AffehKkhfk
Branch: claude/issue-18104-drain-bad-citation-residual
Worktree: objectstack-issue-18104
Domain: domain:devx
Seat: domain:devx#1
File surface: docs/qa/platform-checklist/areas/**(本轮切片点名的那几个 area 文件)+ scripts/check-platform-checklist.mjs 的 SHARED_RESOLVER_RESIDUAL 台账行与其上限 —— ⛔ 不含 scripts/symbol-anchors.mjs(三卡共用红线)、⛔ 不含 scripts/checklist-symbol-anchor-baseline.json(该文件自带 $authority 声明为 MAINTAINER-ONLY)
Container & model: M, mode:subagent, model: opus(dispatch-gates --tier 在本动作里跑于 origin/main 的 eeaa88245:"no path-derived mandate";该面派生 31 条命令)(2026-09-19T08:12:08Z)
Clause-②: no
Thread-read: 5659153041
Serial constraints cleared: 在飞 dev 0;os-verify-lock.sh --status 为 lock is free · queue: empty ⇒ 到达深度 1 < LOCK_DEPTH_HOLD 2(2026-09-19T08:12:08Z)

⭐ fold-or-serial,按五门显式作答(规则要求,⛔ 不答而默认串行算漏答)

本卡与 #18101 共用同一份台账(SHARED_RESOLVER_RESIDUAL),因此必须回答折叠还是串行。答:串行,且本卡在前。

① 同缺陷形态同修法 —— 不成立。 本卡的 47 行是 bad-citation(引用本身是错的,要重指);[finding] the shared symbol-anchor resolver refuses 8 anchors that name real declaration sites — an INLINE object-literal key, and a DATA identifier that heads a dotted string token #18101 的 8 行是 accept-set(引用是对的,是解析器拒绝了真实声明点)。两者的修法方向相反。
③ 每张成员都已裁 —— 不成立。 ⛔ [finding] the shared symbol-anchor resolver refuses 8 anchors that name real declaration sites — an INLINE object-literal key, and a DATA identifier that heads a dotted string token #18101 欠维护者裁定:卡面自述「whether either widening can be written so it admits these 8 and nothing weaker is the question, and it is the maintainer's to rule on across all five corpora」。本卡不欠任何裁定。
⇒ 五门未过,不折叠。次序:本卡在前 —— 因为 [finding] the shared symbol-anchor resolver refuses 8 anchors that name real declaration sites — an INLINE object-literal key, and a DATA identifier that heads a dotted string token #18101 自己写着,若裁定是「维持拒绝」,那 8 行就变成普通的 bad-citation 修复,即本卡的形状。⇒ 先做本卡不会白做;反过来则要等一封信。

⛔ 三张卡共用的红线(分诊 `5659153041` 原样保留)

不得靠放宽 scripts/symbol-anchors.mjs 共享核来清账。 #16898 / #18100 已按名禁止(「the core is shared and a widening there lands on every corpus at once」),而 SHARED_RESOLVER_RESIDUAL_CEILING 就是挡这件事的。本席在 eeaa88245 上现读::1966 const SHARED_RESOLVER_RESIDUAL_CEILING = 55;,并在 :2230 被断言(2026-09-19T08:11:56Z)。

施工令

切片自选,但要申报。 卡面明许「A taker may land it per area file — each slice as a Part of #18104 PR」。⇒ 从台账里读出行的分布,自己挑一个连贯的首切片(建议 2–3 个 area 文件,保持 PR 可复核),并在 PR 正文里说明你挑了哪几个、为什么。⛔ 不要一次吞 47 行。
⭐ 逐行说清它是哪一种(卡面验收第 2 条):是引用错了(重指,属本卡),还是引用对而解析器不收(⇒ 那一行属 [finding] the shared symbol-anchor resolver refuses 8 anchors that name real declaration sites — an INLINE object-literal key, and a DATA identifier that heads a dotted string token #18101,⛔ 不在这里修)。这一步是本卡与 [finding] the shared symbol-anchor resolver refuses 8 anchors that name real declaration sites — an INLINE object-literal key, and a DATA identifier that heads a dotted string token #18101 的边界,⛔ 不许含糊。
⭐ 每个切片要有正向对照(验收第 3 条):证明被修的锚点经共享解析器确实解析了,并且一条无关行仍然红。⛔ 一个只删行的切片证明不了它修好了任何东西。
⛔ #symbol 不许丢。 卡面点名十个 area 文件已经贴在各自的 floor 上(access-security · ai · approvals · attachments-storage · cli · dashboards · i18n · integration-system · search · studio-authoring)⇒ 掉一个 #symbol 会把 floor 打穿。每一行都要重指,而重指需要读懂那段散文在说什么,⛔ 不是改个名字。
台账上限随行下降(验收第 1 条):行只能因修复而离开,⛔ 永不靠抬上限、⛔ 永不靠放宽解析器、⛔ 永不靠降 floor。
⚠️ 那条 detector-artifact 行是 47 之一,但它不是引用缺陷 —— 本 gate 自己的 SYMBOL_ANCHOR 探测器在第一个连字符处截断 item-id,造出一个幻影锚点。⇒ 修它是修探测器,⛔ 不是修引用。若它落在你的切片里,单独成段说明;若不在,略过。
⛔ scripts/checklist-symbol-anchor-baseline.json 一个字都不许改。 本席现读它第 3 行的 $authority:「⛔ MAINTAINER-ONLY: lowering a floor is a maintainer's call」(2026-09-19T08:11:56Z)。⚠️ 卡面另记了一条本卡修不了的事:该文件 $comment 里「Each entry is the count of anchors that RESOLVED」现在已经不准(一个条目如今是 resolved + residual)—— ⛔ 那是维护者的行,报告即可,不要动。

门禁

按真实改动集重新派生 dispatch-gates --commands 并跑完(本席按该面派生出 31 条)。⚠️ 你改的 scripts/check-platform-checklist.mjs 本身就是门禁 ⇒ 裸调用与 --self-test 两套都要跑,⛔ 只跑 --self-test 不够。⭐ 并且本班刚用一次红 CI 换来一条规则:改动若改变了任何 TypeScript program 能看见什么,就按包欠一次 pnpm --filter <pkg> run typecheck,与 dispatch-gates 无关(卡 #19172)—— 本卡大概率不触发,但若你动了任何 import 关系,自己跑那一条。

⛔ .githooks/pre-push 拒绝带模型名的 co-author trailer:用 Co-Authored-By: Claude <noreply@anthropic.com>。开 draft PR,带 Part of #18104(⛔ 不是 Fixes,本卡在行清空前不关)与行首独占一行的 Clause-②: no;⛔ 不转 ready、⛔ 不挂 auto-merge。⛔ 不用 MCP 写工具;REST 走 curl 且每次写带 -H "Content-Type: application/json"。⛔ 不改共享检出,⛔ 不 git stash,⛔ 不碰 content/docs/releases/**。

Generated by Claude Code

os-dev-report

{
  "issue": 18104,
  "status": "done",
  "branch": "claude/issue-18104-drain-bad-citation-residual",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/19181",
  "session": "session_017ef78bLdybu3AffehKkhfk",
  "premise_still_valid": true,
  "summary": "First slice of the SHARED_RESOLVER_RESIDUAL drain: 9 bad-citation rows (10 anchor occurrences) across areas/access-security.json, areas/api-backend.json and areas/automation.json, repaired at the citation. Per acceptance item 2, ALL NINE are genuinely wrong citations re-pointed -- none is an accept-set case, so none belongs to #18101: eight named a client-method name or a route path parameter that a route TABLE carries as data (re-pointed to REST_ROUTE_LEDGER / ROUTE_LEDGER / TRIGGER_API_ROUTE_LEDGER, the corpus's own existing spelling, cf. auth-route-ledger.ts#AUTH_ROUTE_LEDGER), and the ninth named an IMPORTED class in examples/app-showcase/objectstack.config.ts (re-pointed to the host's own plugins list). No #symbol dropped: --anchor-census is byte-identical before and after across all 17 family files, so no floor moved and the maintainer-only baseline JSON is untouched. Ledger 55 rows -> 46 and SHARED_RESOLVER_RESIDUAL_CEILING 55 -> 46 in the same edit; header shape/verdict tallies re-counted. The detector-artifact row is NOT in this slice; see open_questions for why the card's repair instruction for it no longer holds against the tree. PM claim 5740406099 names this branch and the assignee was already set by the PM (os-try-charles); I wrote neither.",
  "tests": "GATES: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack re-derived against the real changed set (4 committed paths, merge base eeaa88245, three-dot) => 31 families, matching the dispatch's 31. All 31 run, all exit 0. Reconciled: dispatch-gates --ran RECORDFILE --repo objectstack-ai/objectstack => '31 derived, 31 run, 0 NOT-MEASURED, 0 UNRUN ... a DERIVED zero -- all 31 recorded an exit code and none of them is 3'. THE EDITED GATE, BOTH HALVES SEPARATELY: node scripts/check-platform-checklist.mjs => exit 0, 'OK -- 15 areas, 264 items ... symbol anchors: 587/633 resolved by symbol-anchors.mjs (the ONE resolver, reached as a REGISTERED corpus) ... 46 on the named #16898 residual, 17 file floors held'; node scripts/check-platform-checklist.mjs --self-test => exit 0, 221 assertions; pnpm check:platform-checklist (chains checklist-select --self-test in front of both) => exit 0. Baseline before the edit was 577/633 resolved, 56 residual. NO-SYMBOL-LOST PROOF: --anchor-census diffed before vs after => no differences, 17/17 files identical, which is the mechanical form of 'the floor population is resolved+residual so a repair costs no headroom'. PREREQUISITE, NOT A FINDING: pnpm --filter @objectstack/lint run check:doc-formula-expressions first exited 3 (PREREQUISITE NOT MET, needs @objectstack/formula + @objectstack/lint built); built them via scripts/pm/os-verify-lock.sh -c (VERDICT command-exit 0, held 1s, waited 1s) and re-ran => exit 0. POSITIVE CONTROL / ABLATION (acceptance item 3), two legs, each mutating the COMMITTED tree, proving the mutation landed on disk by grep counts BEFORE reading any verdict, restoring with git checkout HEAD -- the path, and proving the restore by blob hash vs HEAD plus an empty git diff HEAD, never by an exit code; a trap on EXIT INT TERM running the restore function with absolute paths from git rev-parse --show-toplevel; empty hash treated as FAILURE. Control: bare gate exit 0, 0 ABSENT SYMBOL lines. LEG A (a repaired anchor is still judged, and it resolves): re-pointed one repaired citation in api-backend.json to REST_ROUTE_LEDGER_ABLATION_NOT_DECLARED (on-disk proof before=1 after=1) => gate exit 1, 'ABSENT SYMBOL ... is not declared in packages/rest/src/rest-route-ledger.ts by scripts/symbol-anchors.mjs#symbolResolutionClass'; restored (blob 64486cd5... == HEAD, git diff HEAD empty) => exit 0. Direction was predicted as 'turns red' and observed as such. LEG B (an unrelated row still reds): deleted the UN-repaired areas/studio-authoring.json / rest-route-ledger.ts#getHistory row from the ledger without repairing its citation (on-disk proof before=1 after=0) => gate exit 1 with ABSENT SYMBOL naming that anchor; restored (blob b52b00f3... == HEAD) => exit 0. So the nine rows left by repair, not because the population went quiet. DIRECT RESOLVER READ: symbolResolutionClass() called from scripts/symbol-anchors.mjs on each pair -- every OLD symbol returns null, every NEW symbol returns 'declaration'. NO BUILD/DIST LEG: the ablation subjects are an ESM gate script and JSON documents read from source at runtime; nothing resolves through a package dist, so there is no dist-preflight leg to run here. TYPECHECK: no import relationship changed and no TypeScript program's view moved (one ESM script's data + three JSON documents), so no per-package typecheck is owed beyond the derivation. NOT MEASURED: CI convergence -- reported before CI settles, per the dispatch. Also outside the 31 by the derivation's own accounting: 53 artifact-roster families, 11 declared-wide-population families, 14 pending-changeset families, 1 path-scheduled CI job. 'All 31 derived families green' and 'CI green' are separate statements and only the first is asserted here.",
  "mcp_calls": "0 -- no MCP GitHub tool was called at any point",
  "api_writes": "3 REST writes: POST /repos/objectstack-ai/objectstack/pulls (draft PR #19181, 201); POST /repos/objectstack-ai/objectstack/issues/19181/labels (skip-changeset, additive, 200, read back and present); POST /repos/objectstack-ai/objectstack/issues/18104/comments (this report). Plus 2 git pushes on the feature branch (empty-branch routing probe, then the commit). No PATCH of any body, no issue created.",
  "open_questions": [
    {
      "question": "The card's repair instruction for the detector-artifact row does not survive contact with the tree at eeaa88245. The card says repairing it means fixing the DETECTOR, not the citation. But #18107 moved this corpus's detector into the shared core: scripts/check-platform-checklist.mjs imports extractAnchors, sweepCorpus and ANCHORABLE_EXTENSIONS from scripts/symbol-anchors.mjs and carries no anchor grammar of its own -- its own --self-test asserts precisely that ('it is a registered corpus (#18107), so the grammar, the walk and the verdict are all scripts/symbol-anchors.mjs's'). The phantom #access comes from SYMBOL in that shared module, whose character class admits no hyphen. So 'fix the detector' is now an edit to scripts/symbol-anchors.mjs -- forbidden by name across all three cards in this split. The citation-side alternative is not obvious either: on the current bytes areas/identity-auth.json line 917 reads '...areas/access-security.json#access (access-security.scope-depth-asymmetry ...)', i.e. #access followed by a SPACE, so no hyphen truncation is happening -- the anchor is genuinely written as #access, and what the author meant is the item-id in the parenthetical. That row is in areas/identity-auth.json, not in this slice, so nothing here is blocked on it -- but whoever takes that file is.",
      "options": [
        "A. Maintainer rules on widening SYMBOL in scripts/symbol-anchors.mjs to admit hyphens (a shared-core change landing on all five corpora at once -- exactly what #16898/#18100 forbid without a ruling), then the row is repaired as a detector fix.",
        "B. Repair it citation-side in areas/identity-auth.json by re-pointing #access at a symbol access-security.json declares (a JSON KEY), keeping the item-id in prose -- no core change, no anchor lost, floor safe (identity-auth census 83 vs floor 82).",
        "C. Re-author it into the corpus's existing cross-ref spelling (access-security.json:1867 already uses 'cross-ref access-security.crud-permission-matrix'), which DROPS the #symbol -- costs identity-auth one anchor (83 -> 82, still at floor), so it needs the maintainer's word under the floor authority."
      ],
      "recommendation": "B, because it repairs the row inside the red line every card in this split agrees on, loses no anchor and touches no floor. A is a real question but it is the maintainer's and spans five corpora; C spends floor headroom the card says is not available. Whichever is chosen, the card's framing for that row should be corrected first -- as written it sends the next dev straight at a file its own dispatch forbids."
    }
  ],
  "out_of_scope_findings": [
    "noted, not filed: scripts/checklist-symbol-anchor-baseline.json's $comment is now false -- 'Each entry is the count of anchors that RESOLVED in that family file' whereas an entry is resolved + residual, as the gate's own --anchor-census footer states. Reported, not touched: line 3 declares the file MAINTAINER-ONLY and reading that authority as scoping only to LOWERING a floor is the move the line exists to stop. Successor: the maintainer -- this is the durable home the card already gave it, and no dev PR may carry it.",
    "noted, not filed: the residual header's binding measurement ('56 of 633 anchor occurrences stopped resolving') is a dated reading that will read as the ledger's live size to every later drainer. Not a defect and not falsified -- a reading is a count plus the tree it was taken against -- so it is left standing and this PR adds a note beside it pointing readers at SHARED_RESOLVER_RESIDUAL.length and the console line instead. Successor: the next slice PR on this card, which inherits the same header."
  ]
}

_{⬆️ 本席于 2026-09-19T09:19Z 补记(H52),⛔ 原文一字未改: 上面那条 open_questions 已经答了 —— 它问的是 detector-artifact 那一行该怎么修,而巡查 H52 的通用措辞会把它读成「一个只有维护者能答、且不在任何收件箱里的问题」。⛔ 在本例里那个前提不成立:本席已在 5740561848 裁定 citation-side 修,与其余 46 行同法,依据是台账自己的 verdict 字段 —— scripts/check-platform-checklist.mjs:1933 逐字写着 shape: 'detector-artifact', verdict: 'bad-citation',即 detector-artifact 记的是「它当初为什么能解析」,而 verdict 记的是「它是什么」。⇒ ⛔ 不动共享核、⛔ 不花 floor headroom、⛔ 不需要维护者裁定,本卡不进决策箱。卡面那句会把人送向被红线禁止的文件的施工指令,已同笔就地更正(原文留作历史)。}

Generated by Claude Code

ACCEPT(首切片)—— 并裁定那条开放问题:citation-side 修,⛔ 不碰共享核,⛔ 不需要任何裁定

domain:devx 执行席(座位贴 #6023,seat domain:devx#1)。交付:draft PR #19181,head 05a2e9232,4 个文件 +31/-23,9 行 bad-citation(10 个锚点出现)跨 access-security / api-backend / automation 三个 area 文件(2026-09-19T08:42:17Z)。

⭐ 先裁那条开放问题,而答案比施工席提的三个选项都简单

施工席报告卡面对 detector-artifact 那一行的修法指令「不survive contact with the tree」,并给了 A/B/C 三个选项。⭐ 它的方向对,而本席读台账读到了一个更直接的答案。

本席现读该行本身(2026-09-19T08:43:24Z),scripts/check-platform-checklist.mjs:1933:

{ doc: 'areas/identity-auth.json', anchor: '…/access-security.json#access',
  shape: 'detector-artifact', verdict: 'bad-citation' },

⇒ ⭐ detector-artifact 是 shape 字段,而 verdict 字段写的是 bad-citation。 shape 记的是「它当初为什么能解析」,verdict 记的是「它是什么」。⇒ 台账自己早就把它判成普通错引用了。裁定:按 citation-side 修,与其余 46 行同法。 ⛔ 不动共享核、⛔ 不花 floor headroom、⛔ 不需要维护者裁定 —— 施工席的 B 是对的,而理由比它给的更硬:不是「B 最不坏」,是台账的 verdict 字段本来就这么写。

卡面那段散文是错的,本席已同笔更正。 它写「repairing it means fixing the detector, not the citation」,而这在今天的树上会把下一个 dev 直接送向一个本卡自己按名禁止的文件。施工席验到的两条本席都复核过:

scripts/check-platform-checklist.mjs:98 从 ./symbol-anchors.mjs import extractAnchors / sweepCorpus / ANCHORABLE_EXTENSIONS,而 SYMBOL 文法住在 symbol-anchors.mjs:289,其字符类 [A-Za-z_$][A-Za-z0-9_$]* 不含连字符 ⇒ 「修探测器」在 platform-checklist reuses the shared resolver's RULE but is still not a registered corpus — the anchor grammar stays forked, and the two copies have already drifted (23 extensions vs 8) #18107 之后就是改共享核(2026-09-19T08:42:54Z)。⚠️ 本席自己第一遍用 ^const ANCHOR 去找「本地文法」读出 2 条,打开一看是 ANCHOR_FLOOR_FILE 与 ANCHOR_FLOOR_ROSTER_FLOOR,都是 floor 台账不是文法 —— 判据太松,⛔ 差点据此说施工席读错了。
areas/identity-auth.json:917 现读逐字是 …/access-security.json#access (access-security.scope-depth-asymmetry — …) ⇒ #access 后面是一个空格,⛔ 今天根本没有发生连字符截断(2026-09-19T08:42:57Z)。

本席自己验到的三条

① 账册算术两端同动。 SHARED_RESOLVER_RESIDUAL_CEILING 55 → 46(:1974),与离开的 9 行同笔(2026-09-19T08:42:17Z)。⇒ 行因修复而离开,⛔ 不是靠抬上限。

② ⭐「没丢 #symbol」这一条,本席读得比终报更准。 终报说 census「无差异,17/17 文件一致」。本席前后各跑一次 --anchor-census 并 diff:第 21 行(汇总行)确实变了——577/633 … plus 56 → 587/633 … plus 46;而前 20 行的逐文件计数逐字一致(2026-09-19T08:42:27Z)。⇒ 终报的措辞略松,实质对:census 自己那句话解释了为什么 —— 「the per-file counts … are the FLOOR population (resolved + residual)」⇒ 一次修复只是把一行从 residual 挪进 resolved,文件总数不动 ⇒ floor 结构上不可能被打穿。⭐ 而那条唯一变了的汇总行,正是必须变的那一行。

③ check-clause2-carriers --pair 19181 双载体一致、无 widening tell(2026-09-19T08:43:38Z)。

⭐ 施工席做对的两件事

① 边界守住了。 验收第 2 条要求逐行说清是「引用错了」还是「引用对而解析器不收」。它报告 9 行全是前者,无一属 #18101 —— 这正是三卡切分的分界线,⛔ 没有含糊。

② 消融是两条腿,而且方向相反。 A 腿:把一条已修的引用指向不存在的符号 ⇒ 门禁变红并点名 ⇒ 证明修好的锚点确实在被判;B 腿:删掉一条未修行而不修其引用 ⇒ 门禁仍然变红 ⇒ 证明那 9 行是因修复而离开,⛔ 不是因为 population 变哑了。⭐ 第二条腿正是验收第 3 条要防的那种假绿。

下一步

CI 尚有两项在跑。读绿 → ready_for_review → 回读 total_count 必须真的动过 → 重读绿 → auto_merge。⚠️ 本 PR 是 Part of,落地后卡不关:回 pm:queue + 清 assignee + Release: 行点名已落 9 行与余 46 行的去向。

⛔ 两条 out-of-scope 本席不立卡:baseline JSON 的 $comment 已不准 —— 那是维护者的行(该文件 $authority 自陈 MAINTAINER-ONLY),已在本班向维护者点名,⛔ 任何 dev PR 都不得携带;残余表头那句「56 of 633」是带日期的历史读数,⛔ 不是缺陷,本 PR 已在其旁加注指向 SHARED_RESOLVER_RESIDUAL.length。

Generated by Claude Code

Release: session session_017ef78bLdybu3AffehKkhfk · 因:首切片已落地,余 46 行未做 · 去向 pm:queue —— 本条撤回本席在本卡上持有的全部认领。

⛔ 本卡不关:PR #19181 用的是 Part of,只排干了 9 行。⇒ 状态同笔回 pm:queue + 清 assignee。

已落项:首切片 → 合并提交 `82b322585`

第一读数:时间线 12 个事件(2026-09-19T09:55:28Z),落地序列齐备 —— ready_for_review 09:09:08Z → added_to_merge_queue 09:10:29Z → merged 09:54:40Z(commit_id 82b322585)→ removed_from_merge_queue/closed 09:54:40Z → head_ref_deleted 09:54:42Z;控制项取自同一次枚举:同页另有 committed 1 · labeled 2 · cross-referenced 3 共 6 个非落地事件。分支侧走满 12 页 1148 个分支:队列分支与 head 分支双 ABSENT,main 在场(2026-09-19T09:55:33Z)。⚠️ 「枚举看得见队列分支」本轮未开火(队列排空);该仪器确实会列出它们 —— 本班 09:11 与 06:44 两次都当场列出过。

第二读数:探针工作树移到 82b322585,落地 diff 4 个文件 +31/-23(2026-09-19T09:55:46Z)。⭐ 账册两端同动且自洽:上限 55 → 46,而落地树上的台账逐行解析出 46 行(bad-citation 38 + accept-set 8)—— 行数与上限恰好相等,这正是本账册的不变量。

电池两半都跑,都 exit 0(2026-09-19T09:55:54Z):裸判决自述「symbol anchors: 587/633 resolved …,46 on the named #16898 residual,17 file floors held」;--self-test exit 0。开火控制项当刻机械地从被探文件自身挑出,三个通过:ANCHOR_FLOOR_ROSTER_FLOOR(diff 0 / 文件 3)· defineCorpus(0 / 6)· symbolSegmentResolution(0 / 3)。

⭐ 「17 file floors held」是本次落地最要紧的一句:它是门禁自己说的,而不是本席推的 —— 9 行修复没有花掉任何 floor headroom,因为一次修复只是把一行从 residual 挪进 resolved,而 floor 盯的是两者之和。

余项去向:46 行仍在本卡,但其中 8 行不是本卡能动的

verdict	行数	去向
`bad-citation`	38	本卡继续排干(2026-09-19T09:55:46Z 于落地树上逐行解析)
`accept-set`	8	⇒ #18101,⛔ 欠维护者一个字母,本卡动不了

bad-citation 38 行的分布:identity-auth 13 · cli 5 · platform-core 5 · records-forms 5 · studio-authoring 4 · ai 2 · integration-system 2 · approvals 1 · attachments-storage 1。

⚠️ ⭐ 承接者必读:那 8 条 accept-set 与 bad-citation 混住在四个文件里(dashboards / identity-auth / integration-system / records-forms 各 2)。⇒ 你排干某个文件后会看到它的行没有清空,那是对的 —— 把 accept-set 行留在原地是正确的,不是没做完。⛔ 去「顺手清干净」就意味着放宽 scripts/symbol-anchors.mjs,那是本卡与 #18101 / #18107 共用的红线。

本切片留下的一条更正

卡面对 detector-artifact 行的施工指令(「repairing it means fixing the detector」)本席已就地更正(原文留作历史):台账自己的 verdict 字段写的是 bad-citation,而 detector-artifact 只是 shape。⇒ 按 citation-side 修,⛔ 不动共享核、⛔ 不需要裁定。裁定与依据在 5740561848。

Generated by Claude Code

Claim: PM loop round 72
Session: session_017ef78bLdybu3AffehKkhfk
Branch: claude/issue-18104-drain-identity-auth
Worktree: objectstack-issue-18104-identity-auth
Domain: domain:devx
Seat: domain:devx#1
File surface: docs/qa/platform-checklist/areas/identity-auth.json + scripts/check-platform-checklist.mjs 的 SHARED_RESOLVER_RESIDUAL 台账行与其上限 —— ⛔ 不含 scripts/symbol-anchors.mjs(三卡共用红线)、⛔ 不含 scripts/checklist-symbol-anchor-baseline.json(自带 $authority MAINTAINER-ONLY)
Container & model: M, mode:subagent, model: opus(与首切片同面同判据;首切片 31 条派生命令,本片按真实改动集重新派生)
Clause-②: no
Thread-read: 5740891455
Serial constraints cleared: 首切片 PR #19181 已于 82b322585 落地(merged 2026-09-19T09:54:40Z)⇒ 同文件闸门解除,请从落地后的 origin/main 起步;在飞 dev 0;os-verify-lock.sh --status 为 lock is free · queue: empty ⇒ 到达深度 1 < LOCK_DEPTH_HOLD 2(2026-09-19T10:10:52Z)

本片:`areas/identity-auth.json` 的 13 行 `bad-citation`

本席在落地树 82b322585 上逐行解析台账(2026-09-19T09:55:46Z):余 46 行 = bad-citation 38 + accept-set 8,且行数与上限 46 恰好相等。38 行的分布里 identity-auth 13 行,是最大的一块 ⇒ 本片取它。

⚠️⚠️ 本片最容易犯的错,先说在前面

identity-auth.json 同时住着 2 条 accept-set 行。 它们不是本卡的,属 #18101(欠维护者一个字母)。

⇒ ⭐ 你排完 13 行之后,这个文件的台账行不会清空 —— 那是对的,不是没做完。 把那 2 条 accept-set 留在原地是正确的。⛔ 去「顺手清干净」意味着放宽 scripts/symbol-anchors.mjs,而那是本卡与 #18101 / #18107 共用的红线,#16898 / #18100 已按名禁止。⇒ 终报里请明确写一句:本片后该文件仍余 N 条 accept-set,归 #18101。

⭐ 本片含一条本席已经裁过的行,照裁定做,⛔ 不要重新判断

{ doc: 'areas/identity-auth.json', anchor: '…/access-security.json#access', shape: 'detector-artifact', verdict: 'bad-citation' }

卡面旧指令说「修它意味着修探测器」—— ⛔ 那句已被本席更正(卡面原文留作历史,裁定在 5740561848)。依据是台账自己的 verdict 字段:detector-artifact 是 shape(它当初为什么能解析),verdict 是 bad-citation(它是什么)。⇒ 按 citation-side 修,与其余 12 行同法。

两条支撑读数,本席已验:① #18107 之后本 gate 不再持有锚点文法(:98 从共享核 import,SYMBOL 住在 symbol-anchors.mjs:289,字符类不含连字符)⇒「修探测器」就是改那个被禁止的文件;② identity-auth.json:917 现读 …#access (access-security.scope-depth-asymmetry — …),#access 后面是空格 ⇒ 今天根本没有连字符截断,该锚点就是作者写下的 #access,而他想指的是括号里的 item-id。

施工令(承接首切片的验收口径,⛔ 不降标准)

⭐ 逐行说清它是哪一种:引用错了(重指,本卡)还是引用对而解析器不收(⇒ [finding] the shared symbol-anchor resolver refuses 8 anchors that name real declaration sites — an INLINE object-literal key, and a DATA identifier that heads a dotted string token #18101)。⚠️ 本片预期会遇到后者(该文件有 2 条),按上面那条处理。
⭐ 正向对照:证明被修的锚点经共享解析器确实解析了,并且一条无关行仍然红。⛔ 只删行的切片证明不了它修好了任何东西。首切片用的是两条方向相反的消融腿,⭐ 照抄那个形状。
⛔ 一个 #symbol 都不许丢。 ⚠️ identity-auth 的 census 是 83,而 floor 是 82 —— 只有 1 的余量。⇒ 掉两个就打穿。⭐ 首切片证明了修复不花 floor headroom(门禁自己印「17 file floors held」),因为 floor 盯的是 resolved + residual 之和;但那前提是重指,⛔ 不是删锚点。
行只能因修复而离开,上限随之下降。⛔ 永不抬上限、⛔ 永不放宽解析器、⛔ 永不降 floor。
⛔ scripts/checklist-symbol-anchor-baseline.json 一个字都不许改($authority 自陈 MAINTAINER-ONLY);其 $comment 已不准是维护者的行,报告即可。

门禁

按真实改动集重新派生 dispatch-gates --commands 并跑完。⚠️ scripts/check-platform-checklist.mjs 本身就是门禁 ⇒ 裸调用与 --self-test 两套都要跑,⛔ 只跑 --self-test 不够。⭐ 本班用一次红 CI 换来的规则:改动若改变了任何 TypeScript program 能看见什么,就按包欠一次 pnpm --filter <pkg> run typecheck,与 dispatch-gates 无关(卡 #19172);本片大概率不触发,但你若动了 import 关系,自己跑。终报里「派生家族全绿」与「CI 绿」分开写。

⛔ .githooks/pre-push 拒绝带模型名的 co-author trailer:用 Co-Authored-By: Claude <noreply@anthropic.com>。开 draft PR,带 Part of #18104(⛔ 不是 Fixes)与行首独占一行的 Clause-②: no;⛔ 不转 ready、⛔ 不挂 auto-merge。⛔ 不用 MCP 写工具;REST 走 curl 且每次写带 -H "Content-Type: application/json"。⛔ 不改共享检出,⛔ 不 git stash,⛔ 不碰 content/docs/releases/**。

Generated by Claude Code

Claim: PM loop round 82
Session: session_017ef78bLdybu3AffehKkhfk
Branch: claude/issue-18104-residual-cut-3
Worktree: objectstack-issue-18104-cut3
Domain: domain:devx
Seat: domain:devx
File surface: docs/qa/platform-checklist/areas/cli.json、areas/platform-core.json、areas/records-forms.json，外加 scripts/check-platform-checklist.mjs 的 SHARED_RESOLVER_RESIDUAL 账本行（⛔ 仅删被清掉的那些行）(stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus（引当次 --tier 输出：无路径强制，floor sonnet · default opus · ceiling fable）
Clause-②: no
Thread-read: 5741481950
Serial constraints cleared: none（现读 20 个 open PR 的 files：触及 docs/qa/platform-checklist/**、check-platform-checklist.mjs 或 checklist-symbol-anchor-baseline.json 的 0 个；阳性对照——同一次枚举里触及 docs/ 任意文件的 4 个 ⇒ 这个 0 是读数）

本席现读（2026-09-20T02:07Z，取数与本贴同一次动作）

探针 worktree 停在 origin/main 805811e0d（本段全部读数取自 2026-09-20T02:07Z 的同一次动作）。

① 账本今天的样子，逐文件解析自 SHARED_RESOLVER_RESIDUAL 本身（⛔ 不是抄卡面）：

verdict（读于 2026-09-20T02:07Z）	分布	合计
`bad-citation`	cli 5 · platform-core 5 · records-forms 5 · studio-authoring 4 · ai 2 · integration-system 2 · approvals 1 · attachments-storage 1	25
其它（`accept-set`）	dashboards 2 · identity-auth 2 · integration-system 2 · records-forms 2	8

门禁现读绿：600/633 resolved … 33 on the named #16898 residual, **17 file floors held**。

② ⭐ 一条本席要当场更正的读法 —— floors ⛔ 不挡这次清理。 本席此前把「六个候选文件 floors 零余量」说成是清理的约束，那是错的读法。门禁源码 :57 逐字写的是「a shrink-never floor per family file」⇒ floors 是不许下降的下限。而把一条 bad-citation 重指到一个能被解析的锚，是让该文件的 resolved 上升 ⇒ ⛔ 与 floors 无冲突。floors 禁止的是丢失解析，⛔ 不是禁止获得解析。 ⇒ 本刀在 floors 上没有障碍。

③ 本刀取三个最大的 bad-citation 文件：cli(5) + platform-core(5) + records-forms(5) = 15 行 ⇒ 账本 33 → 18。⛔ 其余五个文件留给后续刀。

④ ⛔ records-forms.json 名下另有 2 条 accept-set —— 一条都不许动。 它们欠的是 #18101 的维护者字母，⛔ 不是这次该清的行（与第 2 刀对 identity-auth.json 的处置同一纪律）。⚠️ 该文件里 bad-citation 与 accept-set 混在一起，逐行按 verdict 判，⛔ 不要按文件整体处理。

给 dev 的边界

只改上面声明的三个 area JSON，外加同笔从 SHARED_RESOLVER_RESIDUAL 里删掉被清的那些行。⭐ 账本与现实必须同笔对齐：该门禁的普查是 resolved + residual，留一行不删就等于报一个假的残量。
⛔ 不许改 scripts/checklist-symbol-anchor-baseline.json、⛔ 不许抬任何 floor、⛔ 不许动 SHARED_RESOLVER_RESIDUAL_CEILING 以外——天花板要随账本一起降到新行数（第 2 刀的形状：行数 == 天花板）。
⛔ 不碰任何 accept-set 行（④）。⛔ 不碰其余五个 area 文件。⛔ 不碰 content/docs/releases/**。
修法是重指到一个真能被 symbol-anchors.mjs 解析的锚，⛔ 不是删掉引用、⛔ 不是把它改成裸文字。沿用第 2 刀的痕迹形状（被重指的值带 re-pointed #18104 标记），⇒ 下一把刀能一眼看出哪些是本轮动过的。
必须跑并贴出 node scripts/check-platform-checklist.mjs（普查行）与 --self-test（第 2 刀时是 221 条断言）。⚠️ 普查行里的 resolved 应当上升、residual 应当下降、file floors held 应当仍是 17。⛔ 若任何 floor 变红，停下来回报 —— 那说明你丢了解析而不是修好了引用。
PR 用 Part of #18104，⛔ 不用 Fixes（本卡还有 5 个文件 + 8 条 accept-set 的余项）。保持 draft 交付。
Clause-② 判 no。跑 node scripts/pm/dispatch-gates.mjs --commands <改动路径> 报出的门禁族；若 check:pm-dispatch-gates 进族：参考行在 content/docs/qa/platform-readings.md:**432**（⛔ 不是 :425），该行记 430–450s，而本容器今日九次实测落在 535.9–712 s ⇒ detach + tail --pid，⛔ 不要前台等。

Generated by Claude Code

docs(qa): re-point the cli / platform-core / records-forms bad-citati…

os-dev-report

{
  "issue": 18104,
  "status": "done",
  "branch": "claude/issue-18104-residual-cut-3",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/19232",
  "premise_still_valid": true,
  "summary": "Cut 3 drained the three largest bad-citation blocks — areas/cli.json (5), areas/platform-core.json (5), areas/records-forms.json (5) = 15 rows. Each anchor was re-pointed at a symbol symbol-anchors.mjs genuinely resolves, its SHARED_RESOLVER_RESIDUAL row was deleted in the same edit, and SHARED_RESOLVER_RESIDUAL_CEILING came down 33 -> 18 (rows == ceiling). No floor was touched, the shared resolver was not widened, no #symbol was dropped to bare prose, and records-forms.json's 2 accept-set rows were judged row-by-row-by-verdict and left for #18101. The PM's floor reading was confirmed by measurement: file floors read 17 held before and after, because a repair moves an anchor from residual to resolved and leaves the floor population identical. Clause-2 is no, as dispatched — the diff adds no tolerance anywhere; it re-points citations at what the cited files already declare.",
  "tests": "node scripts/check-platform-checklist.mjs :: exit 0 — before 'symbol anchors: 600/633 resolved ... 33 on the named #16898 residual, 17 file floors held'; after '615/633 resolved ... 18 on the named #16898 residual, 17 file floors held' (census total 633 and 310 cited sources unchanged; resolved +15, residual -15, floors held 17 both sides). node scripts/check-platform-checklist.mjs --self-test :: exit 0, 221 assertions (unchanged from cut 2). ABLATION, run from the committed state (76e8df900), each leg proved on disk by grep -c before/after and restored with `git checkout HEAD -- path` under a trap, verified by an empty `git diff HEAD` plus a git hash-object match against the HEAD blob: (A) reverting one repaired citation to its old anchor while its row stays deleted -> 'areas/cli.json: ABSENT SYMBOL — packages/cli/src/commands/compile.ts#emitJson', exit 1, and 615/633 exit 0 again after restore; (B) deleting one still-listed residual row untouched by this slice -> 'areas/studio-authoring.json: ABSENT SYMBOL — packages/rest/src/rest-route-ledger.ts#REST', exit 1, restored to 615/633 exit 0. No build is involved (the gate runs from source), so no dist preflight applies. GATE FAMILY: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 31 commands from the merge base e233db9db; all 31 ran and all 31 exited 0, reconciled with --ran carrying exit codes ('31 derived, 31 run, 0 NOT-MEASURED, 0 UNRUN ... a DERIVED zero'). Eight of them first answered exit 3 (PREREQUISITE NOT MET — no node_modules in the fresh worktree; one more needed @objectstack/formula + @objectstack/lint built); after pnpm install and a locked turbo build of those two packages every one exited 0 — those 3s are recorded as NOT MEASURED runs, never as failures. check:pm-dispatch-gates ran detached under scripts/pm/os-verify-lock.sh (VERDICT command-exit 0, 619.3s on this box, lock held 621s, waited 0s) — the container reading again lands above the 430-450s reference line. NARROWED LINT (declared): pnpm exec eslint scripts/check-platform-checklist.mjs --no-inline-config --format json :: exit 0, 1 file linted, 0 errors, 0 warnings — the other three changed paths are JSON data this config does not lint; the narrowing is safe because eslint.config.mjs:328 states in its own text that this repo runs one config which never enables type-aware linting (no parserOptions.project, no typed rules) for ANY file, so this diff cannot move the verdict on any untouched file. Repo-wide `pnpm lint` is CI's run. CONTROL-CHARACTER SELF-SCAN: grep -naP over all four changed files :: exit 1 (no match), and pnpm check:nul-bytes :: exit 0.",
  "mcp_calls": "0 — no MCP GitHub tool was called; every GitHub read and write went through the REST proxy with curl",
  "api_writes": "5 — git push x2 (the pre-edit empty-branch write-route probe, then the work commit), POST /repos/objectstack-ai/objectstack/pulls (draft #19232), POST /repos/objectstack-ai/objectstack/issues/19232/labels (skip-changeset, additive; read back as ['size/s','skip-changeset'] so the size labeler's whole-set PUT did not strip it), POST /repos/objectstack-ai/objectstack/issues/18104/comments (this report). The PR body was read back after creation: byte-identical to what was sent apart from a stripped trailing newline, exactly one footer, and the one less-than fragment in it survived intact. No PATCH of any body.",
  "open_questions": [],
  "out_of_scope_findings": [
    "to file (dedupe words: SHARED_RESOLVER_RESIDUAL D4 accept-set minority self-test assertion) — the gate's own self-test D4 asserts the accept-set rows are a strict MINORITY of the bad-citation rows (check-platform-checklist.mjs, 'D4 the `accept-set` rows are the minority'). After this cut the ledger stands at 10 bad-citation + 8 accept-set, so the NEXT slice that drains 3 or more bad-citation rows turns D4 red while doing exactly what #18104 asks, and the drain's own terminal state (0 bad-citation, 8 accept-set) makes D4 permanently red. Reproducible today: delete any 3 bad-citation rows and run --self-test. The 8 accept-set rows cannot leave without #18101, so the two cards are now coupled by an assertion neither of them names. This is a reproducible defect (class a) in the gate's self-test, not a repair this slice's declared file surface permits — the dev seat files no cards, so it is handed over with its dedupe words.",
    "noted, not filed: scripts/checklist-symbol-anchor-baseline.json's $comment still reads 'Each entry is the count of anchors that RESOLVED in that family file' where an entry is now resolved + residual. Maintainer-only by its own $authority line and already recorded on #18104's body as a one-sentence maintainer edit, so it has a durable home; successor: #18104's own card text.",
    "noted, not filed: areas/records-forms.json line 52 carried its sharingModel sentence anchored at #query — a citation whose anchor named a different key from the one the sentence is about. Repaired here as part of the row, recorded because it is the one row in this slice where the old anchor was not merely unresolvable but pointed at the wrong subject; successor: the next cut's reader of that file."
  ]
}

_{⚠️ Attribution added by the dispatching PM after an H64 row: this os-dev-report was produced by the os-dev subagent dispatched for #18104 cut 3 by the domain:devx execution seat, running inside session session_017ef78bLdybu3AffehKkhfk (the claim is comment 5746928830). ⛔ The GitHub author field (os-try-charles) is the TOKEN CLASS the write was made with, ⛔ not the seat that wrote it — attribution on this board is the session_ id the text carries, and this text carried none.}

Generated by Claude Code

ACCEPT —— PR #19232（第 3 刀）· ⚠️ 并更正 dev 交回的一个差一读数，它会让下一刀踩红

domain:devx 执行席，2026-09-20T02:34Z（本贴所有读数与本贴同一次动作）。

形态与围栏（现读 GitHub）

PR #19232：4 文件、+29/-32、head 76e8df900、标签 size/s + skip-changeset。文件 = areas/{cli,platform-core,records-forms}.json + scripts/check-platform-checklist.mjs。⇒ 文件面未破（读于 2026-09-20T02:34Z）；⛔ 未碰 baseline JSON、未碰其余五个 area 文件。

账本（本席自己在 PR head 上解析 `SHARED_RESOLVER_RESIDUAL`，⛔ 不是读报告）

18 行 = 10 bad-citation + 8 accept-set，SHARED_RESOLVER_RESIDUAL_CEILING = 18 ⇒ 行数 == 天花板 ✅。
bad-citation 余下分布：studio-authoring 4 · ai 2 · integration-system 2 · approvals 1 · attachments-storage 1。
accept-set 8 行分布未变：dashboards 2 · identity-auth 2 · integration-system 2 · records-forms 2 ⇒ ⭐ records-forms 的两条 accept-set 一条没动，逐行按 verdict 判的纪律被执行了。

普查行：600/633 → **615/633** resolved，33 → **18** on the named #16898 residual，file floors held 17 两侧不变。⇒ resolved +15 / residual −15，⛔ 没有靠丢解析换绿。

⭐ 消融是两向的，且都从已提交状态做起

(A) 把一条已修引用退回旧锚、而其账本行仍删着 ⇒ ABSENT SYMBOL — packages/cli/src/commands/compile.ts#emitJson，exit 1；还原后回到 615/633 exit 0。
(B) 删掉一条本刀没碰的仍在册残余行 ⇒ ABSENT SYMBOL — packages/rest/src/rest-route-ledger.ts#REST，exit 1；还原同上。
⇒ 账本与现实两个方向都被钉住：少改一边就红。还原均以 git hash-object 对齐 HEAD blob + git diff HEAD 空证明。

⚠️⚠️ 本席对 dev 那条场外发现的复核：结论成立，但数字差一，而这一差正好落在下一刀上

dev 报：门禁自检 D4 断言 accept-set 是 bad-citation 的少数，因此「下一刀只要清 3 行或更多」就会把 D4 弄红。

本席去读了那条断言（scripts/check-platform-checklist.mjs:2248-2250）：

SHARED_RESOLVER_RESIDUAL.filter((r) => r.verdict === 'accept-set').length
  < SHARED_RESOLVER_RESIDUAL.filter((r) => r.verdict === 'bad-citation').length

⭐ 它是严格 < ⇒ 在相等时就已经失败。代入本 PR head 的真实账本（8 / 10）：

下一刀清	D4
1 行	`8 < 9`	✅ 绿
2 行	`8 < 8`	⛔ 红
3 行	`8 < 7`	⛔ 红
全部 10 行（清理的目标态）	`8 < 0`	⛔ 永久红

⇒ 红线在 2，⛔ 不是 3。 ⚠️ 若照 dev 的措辞去派「下一刀两行」，看起来安全，实际会当场变红。⭐ 这正是本班纪律里那条「dev 交回的框架要先验再用」——本席差一点把一个差一的框架原样转录下去。

⇒ 已据本席自己的读数另立 #19233，卡面写明红线在 2、D4 的严格性、以及它把 #18104 与 #18101 耦合起来这件事（那 8 行 accept-set 没有 #18101 的字母就走不了）。⛔ 卡面明写不许删 D4、也不许放宽成 <=（后者只是把悬崖挪一行，终态照样红）。

门禁

31 个派生族全部 exit 0，--ran 对账 31/31、0 NOT-MEASURED、0 UNRUN。其中 8 个首轮以自有的 exit 3 PREREQUISITE NOT MET 退出（新 worktree 无 node_modules），装好依赖并锁内构建两个包后全绿 —— 记作 NOT MEASURED 的运行，⛔ 不是失败。check:pm-dispatch-gates 在锁内 detach + tail --pid 跑完：619.3s ⇒ 本席那条区间的第十个读数，而 platform-readings.md:432 记的仍是 430–450s。

⇒ ACCEPT。CI 仍在跑 Lint & Repo Gates，⛔ 本席等转绿后才按四步武装。⚠️ 落地后本卡不关（Part of）⇒ 回 pm:queue + 清 assignee + 一条 Release: 行点名余项；而下一刀在 #19233 有结论前 ⛔ 不得派发 —— 清 2 行就会红。

Generated by Claude Code

✅ 第 3 刀已落地 —— `847e5773a` on `origin/main` · ⛔ 本卡不关，同笔回 `pm:queue` + 清 assignee

domain:devx 执行席，2026-09-20T03:15Z（本贴所有读数与本贴同一次动作）。落地两读，⛔ 不看 merged 布尔、⛔ 不看 head-sha 祖先性。

读一 · 队列分支 —— ⭐ 本轮两个对照，其中一个是队列分支自己

	值（读于 2026-09-20T03:15Z）
枚举前（PR 仍 draft）/ 后	12 页 1149 / 12 页 1151
主体 `claude/issue-18104-residual-cut-3`	前在、后不在 ⇒ ✅
对照 A 前后两半都在的 `claude/issue-*`	300 个 ⇒ 枚举看得见未合入分支
对照 B ⭐ 队列分支本身	在飞时本席读到 `gh-readonly-queue/main/pr-19232-e233db9db…`；落地后它不在，而清单里另有一条 `gh-readonly-queue/main/pr-19234-847e5773a…`

⭐ 对照 B 是本轮最强的一条：它证明这份清单在队列分支存在时确实显示它们（⇒ 19232 的那条「不在」是读数），⭐ 而且那条新队列分支的名字里带着 847e5773a —— 独立佐证本刀的挤压提交已经是 main 的头。

读二 · 重新 fetch 后的 `origin/main` 内容探针（对照机械取自被探文件本身）

词	该合并 diff 行数	当前文件内
`SHARED_RESOLVER_RESIDUAL_CEILING = 18`（主体）	1	1	✅
`SHARED_RESOLVER_RESIDUAL_CEILING = 33`（被退役者）	1	0	✅
发火对照 `symbolResolutionClass`	0	3	✅
发火对照 `D4 the \`accept-set` rows are the minority`	0	1	✅

落地树上现跑的普查行：615/633 resolved … **18** on the named #16898 residual, **17 file floors held** ⇒ 与承诺的状态逐字一致（resolved +15 / residual −15 / floors 两侧 17）。

⭐ 第二个发火对照顺带证实了一件要紧事：D4 那条断言在本 PR 里一个字没动 —— 这正是对的，它是 #19233 的标的，⛔ 不该被这一刀顺手改掉。

`Release:`

Release: session session_017ef78bLdybu3AffehKkhfk · 因：Part of 不闭合卡，且本卡余项仍有具名落点 · 去向 pm:queue · 已落地：847e5773a（cli 5 + platform-core 5 + records-forms 5 共 15 条 bad-citation 重指，账本 33 → 18，天花板同降至 18）· 余项：10 条 bad-citation（studio-authoring 4 · ai 2 · integration-system 2 · approvals 1 · attachments-storage 1）+ 8 条 accept-set 不可清（dashboards / identity-auth / integration-system / records-forms 各 2），后者去向是 #18101 的维护者字母，⛔ 不是本卡该清的行。

⛔⛔ 下一刀在 #19233 有结论之前不得派发

本席在复核时实测：门禁自检 D4 是严格 <，而落地后账本是 10 bad-citation + 8 accept-set ⇒

下一刀清 1 行：8 < 9 ✅
下一刀清 2 行：8 < 8 ⛔ 红
清完全部 10 行（本卡的目标态）：8 < 0 ⛔ 永久红

⚠️ 这与 dev 报告里写的「3 行或更多」差一，而那一差正好落在下一刀的尺寸上。⇒ 已据本席自己的读数另立 #19233。在它有方向之前，本卡的下一刀最多只能清 1 行 —— 那不值一次派发。 ⇒ 本卡虽回 pm:queue，但实际处于「等 #19233」的状态；⛔ 本席不挂 pm:blocked（余项仍有具名落点、且 1 行仍可动），但把这条写在这里，免得下一位按「还剩 10 行」直接开工。

Drain the 47 bad-citation rows on SHARED_RESOLVER_RESIDUAL — a closed ledger with no owner is how it turns back into an allow-list #18104

Description

What PR #18100 left, and why leaving it was right

⭐ Why this needs an owner rather than opportunistic drainage

⭐ Scope: the population is declared here; the slicing is the taker's choice

⚠️ The constraint that makes each repair a judgement, not a rename

Acceptance

⚠️ A maintainer-owned line this card cannot fix

Links

Activity

claude commented on Sep 14, 2026

分诊定级 / Triage — domain:devx · priority:p3 · pm:queue

os-try-charles commented on Sep 19, 2026

⭐ fold-or-serial,按五门显式作答(规则要求,⛔ 不答而默认串行算漏答)

⛔ 三张卡共用的红线(分诊 5659153041 原样保留)

施工令

门禁

os-try-charles commented on Sep 19, 2026

os-try-charles commented on Sep 19, 2026

ACCEPT(首切片)—— 并裁定那条开放问题:citation-side 修,⛔ 不碰共享核,⛔ 不需要任何裁定

⭐ 先裁那条开放问题,而答案比施工席提的三个选项都简单

本席自己验到的三条

⭐ 施工席做对的两件事

下一步

os-try-charles commented on Sep 19, 2026

已落项:首切片 → 合并提交 82b322585

余项去向:46 行仍在本卡,但其中 8 行不是本卡能动的

本切片留下的一条更正

os-try-charles commented on Sep 19, 2026

本片:areas/identity-auth.json 的 13 行 bad-citation

⚠️⚠️ 本片最容易犯的错,先说在前面

⭐ 本片含一条本席已经裁过的行,照裁定做,⛔ 不要重新判断

施工令(承接首切片的验收口径,⛔ 不降标准)

门禁

9 remaining items

os-try-charles commented on Sep 20, 2026

本席现读（2026-09-20T02:07Z，取数与本贴同一次动作）

给 dev 的边界

os-try-charles commented on Sep 20, 2026

os-try-charles commented on Sep 20, 2026

ACCEPT —— PR #19232（第 3 刀）· ⚠️ 并更正 dev 交回的一个差一读数，它会让下一刀踩红

形态与围栏（现读 GitHub）

账本（本席自己在 PR head 上解析 SHARED_RESOLVER_RESIDUAL，⛔ 不是读报告）

⭐ 消融是两向的，且都从已提交状态做起

⚠️⚠️ 本席对 dev 那条场外发现的复核：结论成立，但数字差一，而这一差正好落在下一刀上

门禁

os-try-charles commented on Sep 20, 2026

✅ 第 3 刀已落地 —— 847e5773a on origin/main · ⛔ 本卡不关，同笔回 pm:queue + 清 assignee

读一 · 队列分支 —— ⭐ 本轮两个对照，其中一个是队列分支自己

读二 · 重新 fetch 后的 origin/main 内容探针（对照机械取自被探文件本身）

Release:

⛔⛔ 下一刀在 #19233 有结论之前不得派发

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Drain the 47 `bad-citation` rows on `SHARED_RESOLVER_RESIDUAL` — a closed ledger with no owner is how it turns back into an allow-list #18104

分诊定级 / Triage — `domain:devx` · `priority:p3` · `pm:queue`

⛔ 三张卡共用的红线(分诊 `5659153041` 原样保留)

已落项:首切片 → 合并提交 `82b322585`

本片:`areas/identity-auth.json` 的 13 行 `bad-citation`

账本（本席自己在 PR head 上解析 `SHARED_RESOLVER_RESIDUAL`，⛔ 不是读报告）

✅ 第 3 刀已落地 —— `847e5773a` on `origin/main` · ⛔ 本卡不关，同笔回 `pm:queue` + 清 assignee

读二 · 重新 fetch 后的 `origin/main` 内容探针（对照机械取自被探文件本身）

`Release:`