pm(tooling): the contract-review tier is fable — revert the opus constant and the retired-word list

[huangyiirene]

Fixes #19680

Clause-②: no

The contract-review tier is fable. PR #19573 moved CONTRACT_REVIEW_TIER to the opus id and filled RETIRED_TIER_WORDS because one agent's first request at the tier came back HTTP 429 on 2026-09-21. The maintainer's ruling of 2026-09-22 (issue comment 5771798588) is that this was a temporary lack of authorization on one session, not a retirement, and that it must not have changed the skills — verbatim and untranslated, in order:

「复核档应该就是 fable 啊」 · 「某个agent临时没有fable给的特殊授权,不应该改变skills」 · 「fable 撤回卡 你来创建」

What lands — scripts/pm/dispatch-gates.mjs only

1. The constant. CONTRACT_REVIEW_TIER reads the fable id again, so TIER_CEILING derives back to the fable word and the ladder reads floor sonnet · default opus · ceiling fable.
2. The retired list is empty. RETIRED_TIER_WORDS = Object.freeze([]) — no tier word is retired. The guard itself stays.
3. The docblock beside the constants carries the principle, as one rule with the ruling quoted by date and comment id: a tier word is RETIRED only by the maintainer's explicit ruling that NAMES a retirement; a 429, an exhausted quota or a missing authorization on one session is never a retirement; and a seat this tier is not served to renders the review through an isolated at-tier subagent or waits outside the queue — never by editing the constant. What one session is authorized for is a property of that session; the constant is a property of the lane's governance. SKILL.md:516 points every tier value at this file, so this docblock is that principle's home.
4. The non-vacuity pin moved off the live list onto a MUTATED copy (see below).

Kept, deliberately — these were never the defect. tierWordOf(), the derived TIER_CEILING, the retired-spelling guard, and every rendering that reads the constant (the ladder, the exits, the clause-② note, the suspicion line) are PR #19573's structurally sound half: deriving the ceiling from the constant is exactly what stops the pair drifting, in either direction. The exits text is tier-agnostic and reads TIER_DEFAULT, so it follows the constant with no edit.

Not touched: .claude/** (step ② of #19061 owns the reference text), scripts/check-commit-card-trailers.mjs:848 (a rejection vocabulary that must keep listing the id), any workflow.

The pin that could not survive the revert, and what replaced it

the retired-spelling guard is not vacuous — it names at least one word cannot hold on an empty list, and an empty list clears every rendering for free. Counting entries on the LIVE list is therefore not available as a control any more. The guard now runs through one function that both legs call, and the non-vacuity case is proved on a mutated copy: feed the guard a word the ladder demonstrably prints and it must red. Three cases now stand where one stood:

✓ ⛔ no RETIRED tier word survives in any live RULE — … (dirty: none)
✓ no tier word is RETIRED today — the list is empty and frozen, which is what
  "a temporary lack of authorization is not a retirement" looks like in data (holds: none)
✓ …and the guard is NOT vacuous, proved on a MUTATED copy: a list naming the ladder's own
  ceiling word (fable) REDS, so the green above is the empty list and not a broken search
  (mutated hits: 0/fable 1/fable 2/fable 3/fable)
✓ …and the invariant that copy stands for: no tier word still in the ladder may ever enter the live list

The mutated-copy control fires on all four renderings, printed on every run — so the guard's green is measured on every run, not only in the one-off ablation below.

Evidence

The two --tier renders, verbatim, at c39a60e (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --tier PATH, exit 0 both):

Model tier — MANDATORY: claude-fable-5-1 (derived from the file surface, not recalled).

Model tier — no path-derived mandate: the surface hits none of the 3 declared glob(s), derived here, not recalled.
  The tier stays the PM's per-card judgment call (floor sonnet · default opus · ceiling fable).

pnpm check:pm-dispatch-gates — EXIT=0, ✓ dispatch-gates self-test: 1906 cases pass., zero reds, run to completion on the final commit c39a60e. Run detached per this file's own header (the battery re-spawns the tool's CLI and took 675.0s on this box, over the container's foreground cap) with the exit code captured to a file, never through a pipe.

Derived gate families — node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at the FINAL head derived 29 commands (byte-identical to the derivation taken at the first commit). All 29 were run, each exit code captured before any pipe, and handed back through --ran:

✓ dispatch-gates --ran: 29 derived famil(ies) accounted for — 29 run,
  0 NOT-MEASURED (a DERIVED zero — all 29 recorded an exit code and none of them is 3).

Four of them (check-ci-filter-parity, check-closing-keyword-parity and its self-test, check-comment-mask-corpus) first exited 3 PREREQUISITE NOT MET in a worktree with no node_modules. That is NOT MEASURED, never a pass and never a finding — they were re-run green after pnpm install, and only the second reading is recorded above.

Run by hand, outside the derivation — node scripts/pm/check-clause2-carriers.mjs --self-test → exit 0, 1140 cases pass. It imports CONTRACT_REVIEW_TIER, so this change moves its verdict, and the path derivation does not name it (the watch-hint blind spot PR #19573 reported).

Governed-surface predicate — node scripts/pm/check-governed-merges.mjs --test scripts/pm/dispatch-gates.mjs → exit 0, governed-surface predicate: 0 of 1 path(s) hit the register (6 surfaces, repo-agnostic), NOT governed — ordinary queue landing applies to a PR with exactly this file list. Head repo and size are NOT MEASURED by --test; re-read on the PR's own number before landing.

Changed lines — 62 (+50 / −12, 1 file), under the 5000 human-merge threshold.

Lint, narrowed and declared. eslint scripts/pm/dispatch-gates.mjs --no-inline-config → 0 errors, 0 warnings. The narrowing is measured, not assumed: ① eslint's own population is **/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs} (eslint.config.mjs:971), so the population is the JS/TS tree; ② the file count is read from --format json (1); ③ eslint.config.mjs:327 states the config enables no type-aware linting for ANY file (no parserOptions.project, no typed rules), so this diff cannot move the verdict on a file it does not touch. The repo-wide pnpm lint sweep is CI's run.

Control bytes. grep -naP for the control class over the changed file prints nothing (exit 1); the control — the same -P engine asked for printable ASCII on the same file — fires on 28,427 lines. pnpm check:nul-bytes exit 0.

Changeset — skip-changeset, measured. Every one of the 70 published packages in this workspace declares an explicit files[], and the distinct entries across all of them are CHANGELOG.md, README.md, api-surface, dist, json-schema, liveness, llms.txt, prompts, spec-changes.json, src/**/*.zod.ts. Not one reaches scripts/, so scripts/pm/dispatch-gates.mjs ships in no tarball and this diff publishes nothing.

Reverse verification — the live guard can still fail

Landed through scripts/ablation-replace.mjs (anchor count checked, blob hash recorded before and after), the direction declared BEFORE the run: put the fable word back into the retired list, expect exactly three reds in the retired-guard block and no others.

ablation-replace: ok mutation landed: anchor 1 -> 0, blob f04cb35cdb94 -> 2d7ada7ab81a
  ✗ ⛔ no RETIRED tier word survives in any live RULE — … (dirty: 0/fable 1/fable 2/fable 3/fable)
  ✗ no tier word is RETIRED today — the list is empty and frozen … (holds: fable)
  ✗ …and the invariant that copy stands for: no tier word still in the ladder may ever enter the live list
✗ dispatch-gates self-test: 3 of 1906 case(s) failed.
ablation-replace: ok restored: blob == HEAD (f04cb35cdb94) and `git diff HEAD` is empty

Three reds out of 1906, exactly the three predicted and no others — the guard, the emptiness reading and the invariant are three different halves of one promise, and each one binds. The restore is proved by blob equality against HEAD and an empty git diff HEAD, not by an exit code.

维护者速读(草稿)

改了什么 — 复核档常量改回 fable;退役词表清空;常量旁的注释块写下这条原则的正文(含 2026-09-22 三句裁决原话与评论号);那条「表里至少有一个词」的自检钉不可能在空表上成立,改成在变异副本上证明守卫仍会红。只动 scripts/pm/dispatch-gates.mjs 一个文件。

为什么改 — 2026-09-21 把常量从 fable 改成 opus 的依据,是某个 session 的 HTTP 429。那是「这一个 agent 此刻没拿到授权」,不是「这个档位退役了」。把前者写进常量,等于让一次临时授权缺失改写整条车道的治理值。维护者 2026-09-22 明确撤回。

风险与代价(含回滚) — 风险低:改动只在一个未受管文件里,29 个派生门禁族全绿、自检 1906 例全过,并做了消融证明守卫仍会红。代价是复核档重新高于默认档,席位若当时拿不到 fable,须走隔离子 agent 或在队列外等档,⛔ 不得自行降档。回滚就是把这两行改回去 —— 但那正是本卡禁止的动作,除非维护者另行裁决退役。

席位意见 — (留空,待席位定稿)

你要做的 — 确认这条原则的措辞就是你的意思:「档位退役只认你点名退役的裁决;429/额度/单 session 无授权都不算退役」。确认后本 PR 可照常走队列落地。

Acceptance notes

Reported, not fixed here — all outside this card's declared file surface (scripts/pm/dispatch-gates.mjs):

• Three of PR pm(tooling): move the contract-review tier off the retired ceiling, and give the fuse the case it never had #19573's own acceptance notes are cleared by this revert without an edit, and are recorded here so nobody files them again: .claude/skills/checklist-test/SKILL.md:103 states 「floor sonnet · default opus · ceiling fable」 as a live rule — the ladder prints exactly that again; scripts/pm/check-dispatch-gates.mjs:263 calls the mandated surface "the fable-mandatory surface" — accurate again; .claude/skills/pm-dispatch/SKILL.md:538 「额度耗尽豁免仅当契约复审档实测不可用才落默认判断档」 had no room left to exempt while the ceiling equalled the default, and has room again now.
• A forward interaction worth naming before Retire the in-seat clause-② contract review — the rule, its gate label, and the 9k-line checker's gate role #19061 step ② lands. Two self-test cases in this file read .claude/skills/pm-dispatch/references/contract-review.md and assert its 降档保险丝 lines (「额度耗尽豁免只及派发 ⛔ 不及复核」 and 「档位退役 ≠ 耗尽,恒维护者裁决 ⛔ 非席位读数」). Deleting that section per the maintainer's 「降档保险丝 不留」 turns both red. That is Retire the in-seat clause-② contract review — the rule, its gate label, and the 9k-line checker's gate role #19061's to carry — its diff must retire those two pins in the same PR. Content-wise the deleted line stays true of this change; it is only the pins that need moving.
• scripts/pm/check-clause2-carriers.mjs consumes CONTRACT_REVIEW_TIER but is still not derived by dispatch-gates --commands for a diff that changes it — the same watch-hint blind spot PR pm(tooling): move the contract-review tier off the retired ceiling, and give the fuse the case it never had #19573 reported, unchanged. Run by hand here; green.

---

Generated by Claude Code

[huangyiirene]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: c39a60ef49212a3ecc212043b35c27c8f23a5a50

① Derived judgments

Rendered in-seat by the skills seat 1 session at the served tier the maintainer named on this date (the fable tier word at get_session → external_metadata.last_served_model; ruling record 5771798588). Card #19680 is the maintainer's direct-dispatch reversal of #19544 / PR #19573; the contract is the three sentences on the card body, quoted verbatim there and in the diff.

• (a) The two values move back, and only the two values — right. git diff 97f4f8c c39a60e is one file, +50 / −12: CONTRACT_REVIEW_TIER set to the fable id (:12282, was the opus id), RETIRED_TIER_WORDS = Object.freeze([]) (:12542, was ['fable']). TIER_CEILING = tierWordOf(CONTRACT_REVIEW_TIER) (:12523) is untouched and derives the ceiling back to the fable word; tierWordOf, the exits docblock (「a tier EXHAUSTED means the default tier, never lower; a RETIRED tier is a maintainer ruling」), the ladder line and every rendering that reads the constant are kept — deriving the ceiling from the constant is what stops the pair drifting in either direction, and PR pm(tooling): move the contract-review tier off the retired ceiling, and give the fuse the case it never had #19573's structurally sound half is exactly that. A grep for the opus id over the file at this head finds 0 occurrences: it was spelled only at the constant, so no rendering carries a literal.
• (b) The renders — measured by this seat on a clean worktree at this head. --tier .claude/skills/pm-dispatch/SKILL.md prints 「Model tier — MANDATORY:」 followed by the fable id and 「(derived from the file surface, not recalled)」; --tier scripts/pm/dispatch-gates.mjs prints 「no path-derived mandate … (floor sonnet · default opus · ceiling fable)」. Both are what the card's acceptance asks for.
• (c) The retired-spelling guard on an empty list — right, and non-vacuous. The guard now runs through one function both legs call, retiredWordHits (:25513–:25514), so the live reading and its control run the same search. Four cases replace three (:25515–:25520): the live list clears every rendering (「dirty: none」); 「no tier word is RETIRED today — the list is empty and frozen」; the control on a MUTATED copy — a list naming the ladder's own ceiling word must red, printed on every run as the hits it finds; and the invariant the copy stands for — no word still in the ladder (TIER_FLOOR, TIER_DEFAULT, TIER_CEILING) may enter the live list. The old pin 「names at least one word」 (which could not hold on []) is the only case removed. The dev's ablation — the fable word put back into the list on a copy through scripts/ablation-replace.mjs, anchor 1 → 0, blob f04cb35cdb94 → 2d7ada7ab81a on disk — reds exactly the three predicted cases of 1906 and restores byte-identical to HEAD: the guard is proved from the mutated copy, not from the empty list.
• (d) The docblock principle — right, and it quotes rather than restates. :12258–:12281 states the third case as one rule with the three sentences of 2026-09-22 verbatim, untranslated, and the ruling record by comment id: a tier word is RETIRED only by the maintainer's explicit ruling that names a retirement; a 429, an exhausted quota or a missing authorization on one session is ⛔ never a retirement; a seat this tier is not served to renders the review through an isolated at-tier subagent or waits outside the queue — ⛔ never by editing this line. 「What one session is authorized for is a property of that session; this constant is a property of the lane's governance」 is the sentence the reversal needed. The RETIRED_TIER_WORDS docblock (:12525–:12541) states EMPTY as the correct steady state, ⛔ not a disabled guard. SKILL.md:516 (「档位值单源在 dispatch-gates 常量」) makes this file the principle's home; ⛔ no .claude/** line is touched, as the card requires (the reference's 降档保险丝 section is Retire the in-seat clause-② contract review — the rule, its gate label, and the 9k-line checker's gate role #19061 step ②'s deletion).
• (e) Pin disposition across PR pm(tooling): move the contract-review tier off the retired ceiling, and give the fuse the case it never had #19573's six hunks — right. Values inverted (1); the exits docblock kept (2), tier-agnostic; tierWordOf + derived ceiling kept, the list emptied with its docblock rewritten (3); the ladder line reading the derivation kept and printing 「ceiling fable」 again (4); the exits rendering reading TIER_DEFAULT kept (5); every self-test case kept except the one that cannot hold on an empty list (6). No pin in scripts/pm or .claude asserted the opus VALUE or 「the contract-review tier sits at the default-tier constant」 — measured by grep, and this seat's own grep agrees.
• (f) Two pins this PR leaves for Retire the in-seat clause-② contract review — the rule, its gate label, and the 9k-line checker's gate role #19061 step ② — named, not this diff's. :25548–:25549 read references/contract-review.md and assert its two 降档保险丝 lines; the maintainer's 「降档保险丝 不留」 (5772289798) deletes that section under step ②, which reds those two cases. The seat has instructed the step-② dev to retire exactly those two in its PR as a declared surface increment (region-level concurrency with this PR; the later lander merges once). Nothing in this PR is wrong about them: at this head the section still exists and the pins pass.
• (g) Nothing narrowed or widened past the ruling. The card is a value reversal plus its rationale; no ladder step, glob or exit code changes. Three of PR pm(tooling): move the contract-review tier off the retired ceiling, and give the fuse the case it never had #19573's acceptance notes are cleared by the revert with no edit (checklist-test/SKILL.md:103's ladder sentence, check-dispatch-gates.mjs:263's 「fable-mandatory surface」, SKILL.md:538's quota exemption having room again) and are recorded in the PR body so nobody files them.
• (h) Batteries — measured by this seat at this head. check-clause2-carriers.mjs --self-test 1140 cases (it imports the constant and is not derived by --commands for this diff — the same blind spot PR pm(tooling): move the contract-review tier off the retired ceiling, and give the fuse the case it never had #19573 reported; run by hand, green); check:nul-bytes exit 0; eslint over the file 0 / 0; pnpm check:pm-dispatch-gates (1906 cases, ~11 minutes, runs detached) — the dev reports exit 0 with the exit captured to a file; the seat's own run at this head is read before enqueue (③ below).

② Semver level

None — no release. scripts/pm/** is in no package's files[] (the dev enumerated the distinct files[] entries across all 70 published packages: none reaches scripts/); skip-changeset is the correct carrier.

③ Boundary flags

• The derivation ran from the final head, on the tool being edited — 29 families, byte-identical to the first commit's derivation, all exit 0, reconciled through --ran with 0 NOT-MEASURED. Right: a derivation tool's own change is measured with the changed tool.
• The long self-test run detached (its own header instructs this; it re-spawns its CLI and exceeds the foreground cap) with the exit written to a file — accepted; the seat's own detached run at this head is the landing reading.
• Four gates first read exit 3 in a worktree without node_modules — recorded as NOT MEASURED and re-run green after install; only the second reading is reported. Right.
• A Chinese 维护者速读 in the body of a non-governed PR — a judgment call the dev recorded; harmless, and the maintainer will want to read this one.
• Net +38 against the route's +40 — inside.
• CI at this head: Lint & Repo Gates, Test Core (1/6) and Type Check · workspace were in_progress at the seat's read; the rest success / skipped. The seat enqueues only on all green and on check-expected-skips --pr 19684 exit 0.
• The constants on origin/main still name the opus id until this lands — this record is rendered at the served tier the maintainer named, and its Served-tier: line carries the constant NAME; the value the name resolves to is what this PR restores.

Implemented-by: claude/issue-19680-contract-review-tier-is-fable
Reviewed-by: session_01Wnstp2kTth7sGXfr8fXypc

VERDICT: PASS

---

Generated by Claude Code