[PM seat] repo:cloud#1 — ⏳ vacant #6026

本贴是 repo:cloud(整仓)座位的唯一权威登记。 座位贴协议(维护者 2026-08-06 批准):索引 = label:pm:seat,总入口 #4604。单写手规则:只有在任座位 PM 编辑正文;接管/移交 = 改正文 + 审计评论;动手前重拉正文、时间戳先到先得、写后回读。

当前 PM

⏳ vacant. R46 (hotlong, session session_01WVbr5J6u8BHh8EyFtcWciH, seat repo:cloud#1) stood down on the maintainer's word in chat, 「当前任务处理完，合并后就下班」. The stand-down time is the stamp on the brief comment posted right after this edit. The patrol Routine trig_018scXnMQkw7oXsjNZyEMxf9 is deleted. Successor: /pm-dispatch 接手, after reading this post and the brief.

• Stay-behind: none. No os-dev of this seat is running, and no PR of this seat is open. The last tail, PR feat(lint): bidirectional binding-root check for visibility predicates (ADR-0089 D3b) #2931 (cloud#2922, ruled A on cloud#2932), merged as 2ba75341.
• Lane rule at stand-down (the maintainer's, still in force):
  • 「放开」 (2026-10-16): dispatch the cloud p1/p2 queue serially, the 2026-10-16 browser-test cards first by priority, then cloud#2774, chore: version packages #2634 and ADR-0081 (cloud): open org-management basics + retire plugin-org-scoping to enterprise #2699;
  • serial dispatch (「当前任务处理完，改为串行派发」): one os-dev at a time;
  • no database clear on upgrade (「我没有要求清库……」); every stored-data change carries its migration;
  • platform defects are filed on their own repo, ⛔ never routed around in cloud.
• repo:cloud seat 2 is open (objectstack#24145, os-zhuang, session session_01Cbdek8SKSHxddGqTPZXdqX; its pointer on this thread 6229587965): it takes the open pm:queue outside the 「放开」 sequence and leaves cloud#2912–feat(spec): C2-α — explain 契约扩展到 record 粒度 (#2920) #2928 to seat 1 unless released. At stand-down it holds cloud#2957, Update README.md #2958 and feat(plugin-security): A4 — managed_by 三态统一 + listView 露出 (#2920) #2934. A Claim: is the only lock.
• Released at stand-down: cloud#2774 (Release: plus the assignee cleared); the assignee hotlong was cleared from the unclaimed queue cards cloud#2948, fix(plugin-security): #2937 — Layer 0 insert post-image 租户检查 #2940, docs: migrate protocol/objectos → protocol/kernel (URL-level layer-name retirement) #2960 and feat(spec)!: 删除 tenancy.strategy + tenancy.crossTenantAccess — tenancy 块 strict 化 + tombstone(#2763) #2962.
• Not this seat's, read only: the maintainer's local executor holds the v18 tenant/ops work: cloud#2868 (PR 对象列表视图 userFilters 值胶囊丢失字段标签 —— fields[].label 编译/下发被剥离 + console 未回退字段标签 (14.7.0) #2951 merged ba9717eb), feat(spec): unify conditional-visibility predicate under visibleWhen (ADR-0089) #2900 and ADR-0089 D3a: flip .strict() on view/page schemas so mis-layered visibility keys are loud errors #2902 (pm:dispatched, its own claims), and docs: third-party developer onboarding and self-hosted deployment guides #2899 / fix(auth): single-source Console page-URL building; fix SMS + OAuth-callback landing paths #2869 / chore: version packages #2877 / fix(plugin-auth): land OAuth callback errors on the console login page (objectui#2458 item 1) #2888 behind fix(objectql): apply defaultValue on explicit null at insert (#2706) #2868. cloud#2822 is the maintainer's session. The seat closes the v18 cards only after that executor verifies.
• Decision box: cloud#2950 (stranded Copilot drafts; A, no migration, recommended; the director's advisory 6229126653 concurs, and is not a ruling). If A is ruled, the seat owes one runbook/FAQ line naming the two doors (discard drafts, or delete an empty app, then rebuild), plus the publish refusal's text if that is a text-only change. Nothing else waits on the maintainer.
• Ruled 2026-10-17, executed (batch [WIP] Update action step configuration based on job run #358 item 5 and Fix link checker CI by excluding Fumadocs framework patterns #359, the maintainer's 「同意」, recorded by the director seat):
  • cloud#2932 A: PR feat(lint): bidirectional binding-root check for visibility predicates (ADR-0089 D3b) #2931 landed. objectstack#24129 adds the spec keys; cloud#2954 removes the extension at the pin bump.
  • cloud#2939 A: PR feat(core,plugin-security): B2+B4 — posture 阶梯 + capability 派生 (ADR-0095 D2/D3, #2920) #2938 → 5ff29fe7. Follow-ups objectui#12851, objectstack#24142 and cloud#2960.
  • cloud#2942 A/A: cloud#2913 and docs(permissions): 系统管理员操作手册（面向客户管理员的 onboard 任务手册） #2917 are re-scoped in pm:queue. objectui#12852 is filed.
  • cloud#2935 B: cloud#2910 waits on objectstack#24016. The only interim allowed is maxVisible: 0.
  • cloud#2953 A, D meanwhile: cloud#2958 is in pm:queue. Meanwhile, POST /_admin/environments/<env>/evict handles a stray kernel.
• Owed by the next seat (each on its card):
  • cloud#2948 (moved to pm:queue at stand-down; PR feat(lint): bidirectional binding-root check for visibility predicates (ADR-0089 D3b) #2931 freed blueprint-tools.ts). Spec values type: 'app' / scope: 'project' go into ensureNamedBasePackage, ensureAppPackage and create_package.
  • cloud#2962 (the preset-comparand gap). Dispatch after PR feat(lint): bidirectional binding-root check for visibility predicates (ADR-0089 D3b) #2931; it takes over the gap-tracked ack row.
  • The two objectui display halves of ruling cloud#2932 item 4 are the seat's call, not yet filed:
    • the plan card's filter line (plugin-chatbot mapMessages.ts detectProposedPlan);
    • the result card's 「筛选生效 · 命中 N 条」 (detectDraftResult).
  • The AI-builder cards cloud#2923–feat(platform-objects): A3 — 用户页 Permission Sets + Business Units 分配入口 (#2920) #2927 were held only while PR feat(lint): bidirectional binding-root check for visibility predicates (ADR-0089 D3b) #2931 was parked. They are free now.
  • cloud#2930 was unblocked at stand-down: the pin be076dad28a0 carries objectstack#23902. Dispatch its three pins.
• The maintainer's operator item: test1016's stale kernel (cloud#2946 / objectstack#23980). PR feat(docker): publish official runtime image ghcr.io/objectstack-ai/objectstack #2952's in-process lane reaches staging with the next deploy, and a deploy also restarts the kernel.
• Queue snapshot at stand-down (pm:queue, open; cloud#2957, Update README.md #2958 and feat(plugin-security): A4 — managed_by 三态统一 + listView 露出 (#2920) #2934 are seat 2's in-flight claims):
  • p1: feat(security)!: enforce book audience at the REST read layer; finish the ADR-0090 D2/D3 cleanup the P1 wave missed #2774 (released);
  • p2: feat(spec)!: 删除 tenancy.strategy + tenancy.crossTenantAccess — tenancy 块 strict 化 + tombstone(#2763) #2962, security: 服务端 readonly 字段在 UPDATE 时未强制（可被用户上下文覆盖） #2948, feat(plugin-security): 内置行写护栏 — sys_position / sys_capability 平台/应用托管行不可删改 #2930, feat(spec): C2-α — explain 契约扩展到 record 粒度 (#2920) #2928, chore(app-showcase): remove test-evidence artifacts from docs/test #2923, docs(adr): ADR-0095 — authz kernel chain: tenant isolation as Layer 0, posture ladder, capability-derived posture (B0 of #2920) #2924, ci: faster Test Core — affected-only PR tests, single spec suite run #2925, app-showcase 权限模型复测清单(07-15 对照 main 重评):1 项回归级重大缺陷(#2930 锚点写护栏被 A4 词表打穿)+ 2 项部分修复 + 3 项未修 + 1 项建议降级 + 2 项观察 #2926, feat(platform-objects): A3 — 用户页 Permission Sets + Business Units 分配入口 (#2920) #2927, tracking(authz): 双轨赛道下的授权改进开发任务 v2（内核链 ADR 待编号 + 补齐轨 + 地基） #2920, docs(permissions): 系统管理员操作手册（面向客户管理员的 onboard 任务手册） #2917, 导出/导入文件名与多语言优化:显示名+视图名+时间戳命名、模板全中文、导出↔导入选项标签闭环 #2916, test(app-showcase): ADR-0090 configuration-surface test round — positions UI, mapping, developer authoring chain #2915, feat(plugin-security): customized flag on packaged permission sets — Setup badge (ADR-0094) #2913, ci(create-objectstack): scaffold-E2E gate + registry canary + release-time template dep sync #2912, fix(auth): tenancy-mode-aware create-user bind + ADR-0093 integration tests #2887, ADR-0081 (cloud): open org-management basics + retire plugin-org-scoping to enterprise #2699, chore: version packages #2634, docs(adr): ADR-0080 — AI-authored UI pages via JSX source (parse ≠ execute) #2435, feat(ai): flow-authoring agent should emit the ADR-0044 revise-loop shape (revise + type:'back') #2274;
  • p3: docs: migrate protocol/objectos → protocol/kernel (URL-level layer-name retirement) #2960, fix(plugin-security): #2937 — Layer 0 insert post-image 租户检查 #2940, docs(adr): true up ADR-0093 to as-built (descope console banner, ratify migration scope) #2919, feat(auth): tenancy service + membership reconciler + degraded-tenancy fail-fast (ADR-0093 Phases 1–3) #2884, chore(console): refresh vendored objectui SPA to 09e1b261 #2549, feat(approvals): actionable approval links — single-use tokens + session-less confirm page (ADR-0043) #1765.
• Blocked map (pm:blocked, each with its own Blocked-by:):
  • chore: version packages #2954 → objectstack#24129;
  • fix(plugin-security): 堵跨租户 UPDATE 写 + org_admin private 对象越墙（security） #2946 → Update README.md #2958;
  • feat(cli): surface migration guide when specVersion trails the installed platform #2914 → objectui#12808 / fix(devx): stop the test-typecheck ledger regenerating a refuted cause over its own prose #12809, objectstack#24061;
  • fix(plugin-security,plugin-hono-server): ADR-0090 live-test fixes + permission-model test suite #2910 → objectstack#24016;
  • Permission Model v2 — named follow-up ADRs (post-ADR-0090 parking lot) #2776 → objectstack#24066;
  • 文档（开发）：文档中的全新后端启动命令多了一个 -- #2801 → objectui#12197;
  • feat(messaging/auth): 短信基建（SMS provider + messaging sms channel）+ 手机号 OTP 首登/重置 #2780 → 文档（开发）：文档中的全新后端启动命令多了一个 -- #2801;
  • docs: third-party developer onboarding and self-hosted deployment guides #2899 → fix(objectql): apply defaultValue on explicit null at insert (#2706) #2868;
  • fix(auth): single-source Console page-URL building; fix SMS + OAuth-callback landing paths #2869 / chore: version packages #2877 / fix(plugin-auth): land OAuth callback errors on the console login page (objectui#2458 item 1) #2888: the v18 tenant path;
  • fix(platform-objects): sys_sso_provider resultDialog paths address the inner data payload #2842: Studio writability on staging, on the maintainer's browser pass;
  • ADR-0053 Phase 2 · Slice 2: thread context into applyFormulaPlan (read-time formula fields) #1979: the owner's step.
• Filed upstream in R46's widened-lane rounds:
  • objectui#12755, fix(metadata-fs): declare startWatcher()'s chokidar atomic option explicitly #12757, fix(scripts): close the bash 4.0 operator gap in check-bash32-floor's denylist #12764, Artifacts built by released 17.x tooling are REFUSED by the 17.2 runtime: retired-key tombstones fire at artifact parse, and no artifact-ingestion door runs the ADR-0087 conversion that exists for exactly this #12772, fix(objectql): relax registerObject packageId to optional (#12623) #12778, [finding] check-cross-package-test-inputs' docblock states the single-segment hint refusal without its one exception #12808, fix(devx): stop the test-typecheck ledger regenerating a refuted cause over its own prose #12809, fix(sdui-parser): port the inert-expression diagnostic in lockstep with objectui #12811, docs(runtime): declare that cluster: false still registers the authz posture bridge (#12679) #12812, docs(gate): record the measured triage that parks the parameterless-catch read-seam criterion #12851, seed-loader resolveSoleOrganizationId swallows every sys_organization read failure behind a comment naming one benign cause, so a transient outage silently seeds org-less rows #12852;
  • objectstack#23818, cli(migrate organization-ownership --apply): with an existing --out file, the ceremony executes every step and then refuses apply_refused / report-file-unwritable, which under --json reads as if nothing ran #23826, platform-objects: sys_organization declares no invite action, so an organisation record page cannot offer 邀请成员 in its header (page:header ids resolve only against the object's own actions) #24016, spec: ActionSchema declares disabled but no authored reason, so a header action cannot say why it is unavailable (e.g. "You are the only owner; transfer ownership first") #24018, leave_organization: no predicate root carries "the caller is this organisation's only owner", so the platform action cannot be disabled for the last owner before the click (better-auth refuses it only after the confirm) #24020, leave_organization confirm names neither the organisation nor what is lost: confirmText has no declared record scope for interpolation, and a host cannot override the platform bundle #24021, sys_activity reads expand the parent-record read gate to one branch per registered object: a top=20 read for 3 objects becomes a 396 KB SQL statement with 1402 bindings, run twice (rows and count) #24060, every authenticated request pays 11 queries in 7 serial round trips before its handler: in-process getSession runs the jwt after-hook (two sys_jwks reads, a discarded signature), and me/* resolve the grants twice #24061, docs: no page tells a self-hosted operator how to connect their ObjectOS server to ObjectStack Cloud (Setup → Cloud Connection → Connect, then approve in the cloud account) #24066, metadata-protocol installPackage parses only the manifest id, so the primitive stores manifests the public install door refuses (type 'application', scope 'environment' from cloud's AI authoring) #24086, service-settings: the Setup settings pages say 「工作区名称」 and 「此工作区」 for the organisation or environment — use the ruled nouns (ruling cloud#2939 A) #24142.
• The patrol Routine, if a successor wants one: the maintainer creates it in the claude.ai Routines UI (seat-post-protocol.md, 座位 Routine 创建). ⛔ A session create_trigger cannot carry GitHub.
• Linked-user note: this seat's linked user hotlong is in GOVERNED_APPROVERS. Writes went through the relay as objectstack-fleet[bot], and no approving review was ever submitted.

✅ harness 面 —— R41 本会话实测 CURRENT,四个面全中(⛔ R40 那张表已退役)

⚠️ 本会话是全新容器 + 全新检出(/home/user/objectstack,HEAD d8b12fca97)。git fetch origin main 后本检出落后 origin/main(f347c79)一个提交,而该提交不触碰任何 harness 面。check-harness-current.mjs(按事实 52 从 origin/main 取当前版本,连同 scripts/invoked-as.mjs 与整个 scripts/pm/ 落 scratchpad 后跑,⛔ 不是共享检出里那一份)整句读数:

check-harness-current: CURRENT -- every harness-loaded path on origin/main is in /home/user/objectstack HEAD d8b12fca97

⚠️ 本次多读到一条仪器自陈的限定,前三任的表里没有,记下来: 前三面那个「最新触碰 b3e437db2」是浅 clone 的嫁接边界 —— 它的父提交 f9a9e76fe 不在本检出里,git 于是拿它与空树比,于是该提交树里每一个路径都读成「在这里被触碰」。⇒ 那三行的 sha ⛔ 不是「这一提交改了这个文件」的证据(事实 39/46 在 harness 读数上的同一张脸)。作准的是每面第二行的内容比对 = HEAD content is identical to origin/main —— 它按内容判,与嫁接无关,而四面全部为真。⛔ 不要把嫁接边界当触碰读数往外引。

三章程文件的最新触碰 sha(git log -1 origin/main -- <path>,本次取数):SKILL.md 与 references/core-rules.md 同为 6427ee2(2026-09-18T01:15:42Z,同一提交)—— 与 R40 读到的一致;两份均已在本会话读过。

⭐ harness CURRENT 与「我能不能派 dev」是两件事(R40 的实测,原样保留):后者只取决于容器启动那一刻仓在不在盘上,只有一次探针能回答。本会话两件各自量过,都通过。

⛔ references/lanes/cloud.md 仍不存在:git ls-tree origin/main 复核,references/lanes/ 下只有 cli · devx · director · engine · hotcrm · services · skills · spec · triage · ui 十个。⇒ 本席的岗位说明只活在本贴的 范围 与 说明 两节,未按章程版本化到 references/lanes/。⛔ 席内不自行补写(references/** 是 domain:skills 车道的受管面),第四次记录在此供换班报告采信。

范围

cloud 全仓队列 + objectstack 上带 repo:cloud 的缝卡。执行座位 + 单车道机械三务自理;⛔ 不产 domain:*。⛔ 每轮两仓都读。

继承台账

The successor's ledger is in 「当前 PM」 above (R46's stand-down, 2026-10-17). The earlier R37–R41 takeover readings are in this post's body revisions; none of them is a current value.

热文件串行队

None declared —— 2026-09-18T09:36Z 复核后退役。 R39 中途（评论 5722063008）在 packages/service-ai/src/tools/visualize-data.tool.ts 上声明过一条队：1. cloud#2092 → 2. cloud#2093。本次逐张读回：两张都已 closed / completed（#2093 以 6a0ff9e0 落地），队列的两端都没了。⇒ 队退役。

同笔复核了那条评论里的另外两张在飞卡：cloud#2023 已 closed completed；cloud#2179 仍 open，现为 pm:blocked + pm:blocking、无 assignee，⛔ 已不在飞。⇒ 本贴写下这一刻，本车道在飞 dev 为 0。

下一任若发现两张 open 卡共用一个热文件，在此声明：文件 → 有序卡号 → 每张卡认领的区域。

说明

⛔ 本仓平台事实(接管者先读;【R37】为本班实测)

1. enable_pr_auto_merge 才是进队动作,唯一可靠读数 = event: merge_group run。队列按顺序逐个合。
2. closing keyword 会静默不生效 ⇒ 合并后逐卡核 state;反向同真(27)。
3. 读 main 与 pin 一律走 API。
4. sanitizer 吃裸尖括号;反引号代码块内的 <sha>/<path> 存活。
5. RouteDefinition.permissions 零消费。
6. cloud 无 dispatch-gates.mjs、无仓级 lint ⇒ 门禁按 diff 从 check:* + test.yml 推导。
7. blocked 卡的交付常以别的卡号落地 ⇒ 问「交付物在 main 上吗」。
8. 覆写判据 = 因由是否在同一动作里。
9. hotcrm 经 add_repo;objectui 不可写 ⇒ 缝卡。
10. GraphQL 限流时 REST 仍通;/search/issues 403。
11. 跨座位交接落卡不落贴。 12. pin 选择双向审窗(feat(objectql): opt-in sys_metadata hydration for isolated project kernels #1826)。 13. 读数缝卡按家族折叠。 14. ObjectLogger 是类。
12. 提示词棘轮 上限已由 epic 车道抬到 60,250(feat(dogfood): in-process runtime regression gate #2020,定过价的例外,⛔ 不继承)。
13. flow config 开放 record;flow.zod.ts ≠ job.zod.ts id 空间。
14. run 级 updated_at 不是活性信号,读 job steps。
15. list_pull_requests.merged 不可信;认 merged_at+closed。
16. 舰队级 529:单独重派是判别实验;保留认领+note。
17. packages/service-ai-studio/src/skills/ 不是 governed 面。
18. pnpm --filter PKG typecheck test 把 test 当参数 ⇒ 分两条命令。
19. 核验框架/objectui 无需 clone:curl raw.githubusercontent.com/...。
20. JobSchedule 文件头自证事实 16。
21. 测试接缝没人守 ⇒ 静默死掉而依赖它的测试全绿。
22. 门禁首合取项若是「模型自己的行为」,门就是模型可自行关掉的。
23. MCP 断连静默断掉定时器链;醒来先 list_triggers;送达延迟 0–14 分钟常见。【R37 复现:本班 MCP 掉线一次,重连后继续,无状态损失】
24. Part of 不保证不关卡 ⇒ 合并后 close-verify 一律读 state。
25. 剥标/回读类小写动作与触发读数同一批发出。
26. ⛔ 三参旧式 git merge-tree 对 add/add 与内容冲突报 0。 一律 git merge-tree --write-tree --name-only <A> <B>。
27. 解锁扫描读到评论最后一页:先问「有没有裁过没执行的」。
28. 维护者会在同一分钟用两个授权账号连做多件事。
29. createRequire 到 dist/index.cjs、静态 import 到 dist/index.js = 两份模块实例。
30. 框架文件不在 cloud 里:派发令写文件面前对 cloud 树 find 一次。
31. body 编辑不撤回 PR 建立时登记的 auto-close 链接。
32. 另一 PM 车道可能不读线程就认领并开 PR;closed_by_pull_requests 是最早信号。
33. arm 不是终点:队列前面的 PR 落地可让本 PR 静默 dirty。
34. disable_pr_auto_merge 不出队;代理禁 ref 删除。
35. settings 两层门是框架设计:托管内核声明 11 个 namespace。
36. 【R37】容器里的 /home/user/objectstack 是浅 clone(55 commits)。 窗口化 git log / merge-base 在它上面以 exit 0 无警告答错 —— 本班就先拿到过一个假的「未找到」。pin 祖先判定必须先 git fetch --deepen=3000(只加对象,不动 HEAD/工作树,安全)或走 REST compare。⛔ 浅检出上的 merge-base 不是 pin 读数。
37. 【R37】apps/objectos 的 test = preflight && vitest run,而 test:crm-bundle / test:boot-smoke 等是 tsx 脚本,vitest 不收集它们。 CI 只跑 boot-smoke + cloud#1650 提升的三个 tsx 门(production-flow / billing-flow / cloud-app);test:crm-bundle 无人跑。test.yml 自己的注释已记过同类:「it is test:boot-smoke, not test, which is how it sat red for three weeks unnoticed」。⇒ 事实 24 的活体实例,查「这个测试真的在跑吗」。
38. 【R37】cloud 无 priority:p1 标签(只有 priority:p0)。⛔ 不要凭记忆挂,严重度写进评论正文。
39. 【R37】dev 开的 PR 作者是 claude[bot],不是席位账号 ⇒ 对 os-zhuang 请审不会触发 author-identity 422,两个授权账号都能正常请审(本班实测两个都进了 requested_reviewers)。
40. 【R37】MCP update_pull_request 带 reviewers 时显式传 draft: true 能保住草稿位(回读确认 draft 仍为 true)。⛔ 仍要回读,不认 200。
41. 【R37】issue/PR 号不可预测:本班在评论里引用了一个尚未创建的卡号并写错(预测 fix(driver-sql): self-heal numeric type fidelity on legacy SQLite columns + extend dogfood matrix #2028,实际 ci: run ESLint in CI to enforce the @objectstack/spec import guard #2029,而 fix(driver-sql): self-heal numeric type fidelity on legacy SQLite columns + extend dogfood matrix #2028 恰好被同批的 PR 占走)。先创建再引用,写错了就公开更正。

⛔ Platform facts added by R38 (English from here down; 存量中文事实 1–44 above are 不追溯改写)

45. REST is OPEN to BOTH repos from this seat's container, probed 2026-09-15T15:02:53Z: GET /repos/objectstack-ai/cloud/issues → 200, GET /repos/objectstack-ai/objectstack/issues/6026 → 200, /rate_limit → core 15000/h (the App-install bucket, so not the MCP user bucket). ⇒ The vacancy reason this post's title carried for six days — "repo not attached" — was an attribute of that session, not of this lane. ⛔ Never inherit a reachability verdict from another session; probe once per session, and ⛔ 仓不可达 is never "checked and clean".

46. Both container checkouts are shallow, 50 commits each — /home/user/cloud at cb8ee7ff and /home/user/objectstack at 827cacbf, read 2026-09-15T15:08:47Z. Platform fact 39 (shallow clones answer merge-base and windowed git log wrongly at exit 0) therefore applies to both repos now, not just objectstack. Deepen (git fetch --deepen=3000) or go through REST compare before any ancestry claim.

47. create_trigger warns "this trigger stores no MCP connectors" even for a self-bound timer, and for that shape the warning is not a defect: a self-bound firing resumes THIS session, with this session's tools. It is exactly the silent-zero-output failure seat-post-protocol.md names only for a fresh-session Routine. ⛔ Do not read the warning as "the timer is broken", and ⛔ do not read a created id as an armed timer either — read it back.

48. The heartbeat Worker and production deploy on different triggers (R45, cloud#2377): deploy-heartbeat.yml deploys on any push to main under apps/heartbeat/**, while deploy-cloud-prod.yml:34-38 deploys only on a v* tag. So a PR that lands a TARGETS row together with the route change it probes arms the probe against the OLD production build until the next tag. ⛔ Never arm auto-merge on such a PR by reflex: land it right before a tag, or split it.

49. This seat's REST token cannot read objectui issues (R45): GET /repos/objectstack-ai/objectui/issues/N answers "access not enabled for this session", and add_repo grants anonymous git reads only. ⇒ A Blocked-by: line naming an objectui card is unverifiable from here. Read its state through the triage seat's unlock scan, or attach objectui with access: push; ⛔ never write the line from memory (cloud#2172 was blocked on a card closed 11 days earlier).

50. PUT .../pulls/{n}/ccr/auto_merge IGNORES merge_method. Measured both spellings on PR fix(spec): the 21 confirmed cloud citations in the agent/skill/action liveness ledgers carry a read date and a symbol anchor #18313 at 2026-09-15T16:31:00Z: {"merge_method":"SQUASH"} and {"merge_method":"squash"} each return 200 echoing "merge_method":"merge", and the PR's stored auto_merge.merge_method reads back merge. rest-channel.md documents the SQUASH payload; that value does not stick. ⚠️ Harmless here — the merge QUEUE decides the method, allow_merge_commit is false and origin/main's first-parent history is linear — but ⛔ never read that echo as confirmation that a method was set.

51. An aggregator job reports FAILURE when its lanes were CANCELLED by a superseding push. TypeScript Type Check and Test Core run no compiler and no test: each reads the jobs named in OS_AGGREGATOR_MEMBERS and fails if any did not conclude success. Measured three times this wave. ⇒ A red aggregator on a superseded head is a supersede artifact, ⛔ not a gate finding — read the members per shard before diagnosing. On 97b17e9e, Test Core (4/6) succeeded and the other five were cancelled; no shard failed at all, yet two checks read failure.

52. A PR body PATCH re-triggers the PR-metadata gates (Check Changeset, The card this PR closes must claim this branch, Part-of PR must not also close its card, No other open PR may claim the same single-writer path). Budget a body edit like a push, and ⛔ do not spend one late in a run to add a sentence.

53. ⭐ Two pushes to one PR cost two supersede cascades. This seat sent a dev two follow-ups (anchors, then notes) instead of one batch; each push cancelled an in-flight run and produced a red aggregator on the head it superseded. ⇒ Batch every correction from one review pass into ONE follow-up.

⛔ Platform facts added by R39 — every one measured this round

52. ⭐ 全板工具链住 objectstack，而共享检出会悄悄过期 —— 跑它之前先确认它就是 origin/main 的那一份。 R39 实测：/home/user/objectstack 的 HEAD 落后 origin/main 293 个提交。用检出里那份 check-half-states.mjs 扫 cloud 得 20 行；把 origin/main 的同名脚本取出来扫同一块板得 70 行。⇒ 50 行本来看不见，而且旧仪器的一条 H44 还指错了评论。做法：git show origin/main:scripts/pm/<tool>.mjs 连同 scripts/invoked-as.mjs 与整个 scripts/pm/ 落到 scratchpad 再跑（⛔ 不改共享检出；PM 不写仓内文件）。⚠️ 那份副本的 --self-test 会有 1 条 H43 失败并自陈原因（sibling-repo 副本不带 governed 名册），其余 4962 条通过。
53. ⛔ 差一点据一件过期仪器立卡。 旧版 H44 的时间戳正则是 /\b\d{2}:\d{2}(?::\d{2})?Z\b/ —— 它读不到本协议自己规定的分钟粒度写法 …T09:30Z（T 与紧随的数字之间没有 \b），却能读到带秒的写法。origin/main 早已修成 (?:\b|(?<=T))。⇒ 与 cloud#2130 的「对照组是被测物的副本」、cloud#2356 的「假阳性落在对照组上」同族：仪器本身可能是坏的那一个，而它照常 exit 0。
54. dispatch-gates.mjs --repo 是断言，不是开关。 源码原话：「refuse unless this checkout IS that repo」，⛔ 它不会把推导指向另一个检出。⇒ cloud 的门禁名册仍须按 cloud 自己的 package.json + .github/workflows/ 手工推导（本贴事实 6 仍然成立），但现在会响亮拒绝而不是给一个「完整、exit 0、完全错误」的答案。⚠️ 它还 import 同目录兄弟模块（如 scripts/i18n-bundle-surface.mjs），scratchpad 副本要一并取。
55. 所有权标记只认行首 Claim:；## Claim 这种标题形从来没被数进去过。 当前仪器把这类近失逐条列出：本板 4 条 —— chore(client): remove dead projects.* env-member SDK methods (ADR-0024 D9) #2332 5723350272、fix: single-tenant audit follow-ups — member/invitation org optional + headOf org-scope (ADR-0057) #2182 5723363219、chore: version packages #2179 5721976320 皆为 heading-bare，feat(automation): screen-flow runtime — interactive screen nodes (suspend→render→resume) #1452 5356755552 为 separator 形。⇒ 认领评论里 Claim: 与 Branch: 各自独占一行、行首起，⛔ 不要写成 ## Claim。
56. PATCH /repos/{o}/{r}/issues/{n} 经本代理必须显式带 -H "Content-Type: application/json"，否则答 "Request bodies must declare Content-Type"。
57. cloud 的半状态巡查锚 cloud#2293 至今是占位 —— 仓库变量 HALF_STATE_ANCHOR_ISSUE 未设（维护者动作），所以每次定时跑都在 Resolve the anchor 步骤响亮失败，发现物留在 step summary 里没人读。⇒ 本席每轮的「先读巡查锚」只能靠自己跑那支脚本（按事实 52 的做法），⛔ 不能读作「锚是干净的」。同族：cloud#2294（变量）与 cloud#2295（副本落后 + governed 名册缺失导致 H43/H48 在本仓 NOT MEASURED）。
58. 当前仪器在 cloud 上自报两条 RATE PREMISE DRIFTED：MEASURED_MERGES_PER_DAY = 137.5/day（2026-08-23 钉）对实测 ~10.3/day（0.07×），MEASURED_CLOSED_ISSUE_UPDATES_PER_DAY = 139.4 对 16.0（0.12×）。⇒ 它每一处「本窗口覆盖 N 天」的自述在本仓都按同样倍数说错。⛔ 常量住 objectstack，重钉是 domain:skills 车道的事，⛔ 本席不代改；读它的窗口自述时按倍数打折。

⛔ Platform fact added by R40 — measured this round

59. ⭐ 一个没带 source_url 建出来的席位会话,mode:subagent 整期是死的,且会话内修不好。 R40 实测:create_session 未带 source_url ⇒ 容器启动时零仓 ⇒ .claude/agents/os-dev.md 不在盘上 ⇒ agent 名册里没有 os-dev。Agent 答 Agent type os-dev not found. Available agents: claude, claude-code-guide, Explore, general-purpose, Plan, statusline-setup。把定义从 origin/main 逐字装到 ~/.claude/agents/ 与 /home/user/.claude/agents/ 两处之后再探,答案一字不变 ⇒ 名册只在会话启动时建一次,⛔ 不重扫。对照:R39 的 session_01TAUTP6Yky8QWoHUAPDKNJQ 的 session_context.sources 是 objectstack · cloud · objectui(origin: desktop_app),它整轮派得动;R40 的是 [](origin: claude_code_mcp_seed)。⇒ 建继任会话必须带 source_url(objectstack —— 它才是 .claude/agents/ 与全板工具链的住处);cloud 在会话内 add_repo + clone 即可。 ⚠️ 并且:坐席后、认领任何卡之前,先发一次最便宜的 os-dev 探针(要求回一个词就停)。⛔ 不要先认领再发现派不出去 —— R40 就是这么在 cloud#1977 上留下一个半状态的(已按 Release: 干净回滚,评论在卡上)。

⛔ 长期禁令(跨任期)

不得设 OS_MCP_SERVER_ENABLED;⛔ 永不伪造 Origin / 设 OS_TRUSTED_ORIGINS;⛔ 永不放宽 auth 断言;钉缺陷测试 promote never repair;⛔ positions ?? roles 回退禁;⛔ 永不编辑 content/docs/releases/;governed 面 PR ⛔ 永不自行入队;⛔ 永不弱化 cloud#1265 守卫;⛔ 不删 .changeset/*.md。

⛔ Permanent notes(跨任期,判例)

卡面反事实也要实测;零命中必带阳性对照(R37 两次靠它拿到真读数:/api/v1/environments/ 的真零,与浅 clone 的假零);dev 偏离更强则背书,但背书不等于照单全收;本席自己的判断过宽/过错就当场自更正(R37:Blocked-by 前提证伪,已在 #2029 公开更正);hold 只认最近转换条件;停手条款是契约一部分;blocked 解锁 = 交付物在 ref 上,pin 消费的仓再加一问「pin 覆盖了吗」;设计卡 cloud 腿「designed blind」先复核;「enforce」实施前先找接缝;定级时核「spec 里没有」这类前提;门禁类修复的 CI 绿可能什么都不证明;声称「已裁决」缺出处三件即不采信;复核时决定性前提自己再测一遍(R37:ADR-0112 D6 第 99 行逐字核);「正确但靠手抄」是没钉住的缺陷(本仓已开三张同类:#1932 #1949 #1995);收紧前先找反向那一轴;翻 ready 前亲核首行,合并后仍读 state;已裁未执行的裁决,解锁时先执行再谈重判;维护者点名保留的面,⛔ 席内不得代认,哪怕 dev 的论据成立;epic 车道领地内的卡:定级是本席机械义务,派发是它的。

迁移注记:本贴自 #4604 迁移(2026-08-06)。R36 于 09-04T07:5xZ 收尾空席;R37 于 09-07T05:41Z 坐席并在首个 wave 边界重写正文,新增平台事实 39–44。
R38 seated in the same stroke that rewrote §1–§3 under 接管压缩, and added platform facts 45–47.
R38 也补了 48–51。R39 于 2026-09-18T09:36Z 收班：重写「当前 PM」与 harness 两节、退役 R38 的盘点表、新增平台事实 52–58，并把决策箱补成 12/12 带卡面速读与四棱块。⛔ 本次未动「说明」下的既有事实 1–51 与两段禁令。
R40 于 2026-09-18T09:45Z 坐席（全新会话 + 全新检出）：重写「当前 PM」、把 R39 的 harness STALE 表换成本会话实测的 CURRENT 表、建自绑巡查 Routine trig_01EbZZ6xCoceHtcJzx6EZgnK 并记入正文，同笔记下 references/lanes/cloud.md 缺席这一缺口。⛔ 本次未动「范围」「继承台账」「热文件串行队」「说明」四节的任何既有内容。
R40 于 2026-09-18T10:00Z 收班:重写「当前 PM」与 harness 两节、新增平台事实 59、建好带 source_url 的继任会话 session_01WEsBsV9NHgypgTitazMHbe。⛔ 本次未动「范围」「继承台账」「热文件串行队」与事实 1–58、两段禁令。
R41 于 2026-09-18T10:14Z 坐席(带 source_url 的新会话 + 全新检出,os-dev 探针 ALIVE):重写「当前 PM」与 harness 两节、把盘点表与缝卡表换成本席同批的枚举、建自绑巡查 Routine trig_015HUDAoCk6FW9G9SyaK4Wrf 并记入正文。⛔ 本次未动「范围」「热文件串行队」「说明」三节与事实 1–59、两段禁令,也未动「继承台账」里 State-machine 破损表与 Retired inheritance 两块的既有文字。

R41 于 2026-09-20T14:14Z 在任期内刷新读数(不是坐席也不是收班):盘点表、缝卡行、台账合计、PR 节与标题全部换成同一批 REST 实测值 —— 上一版停在 09-18T16:12Z,已落后约 46 小时,继任者照着读会把 42 张已关的卡当成在队。⛔ 本次未动「当前 PM」的坐席依据与判例、harness 表、「范围」「热文件串行队」「说明」三节、事实 1–59、两段禁令,也未动「继承台账」里 State-machine 破损表与 Retired inheritance 两块;09-18T16:12Z 的四段台账明细与决策箱清空那一块保留作历史,只在上面加了退役标注。
R41/R42 于 2026-09-30T06:07Z 收班:重写「当前 PM」为 ⏳ vacant + 接任台账、删巡查 Routine。⛔ 本次未动 harness 表、「范围」「继承台账」「热文件串行队」「说明」与事实 1–59、两段禁令。
R43 坐席 (opening marker 5906435762): rewrote 「当前 PM」 only. ⛔ No other section changed; the harness table is still R41's record, and R43's reading is in the opening marker.
R44 seated (session session_01Wxo1xhh2bU66T73q23jzE4): rewrote 「当前 PM」 only. ⛔ No other section changed.
R44 round-boundary refresh: rewrote 「当前 PM」 only.
R44 standby refresh (2026-10-03 05:23Z patrol): rewrote 「当前 PM」 only.
R45 seated (session session_011jobP72PwN3whNm55GetXQ, opening marker 6050833662): rewrote 「当前 PM」 only. ⛔ No other section changed.
R45 mid-shift refresh: rewrote 「当前 PM」 only.
R46 seated (session session_01WVbr5J6u8BHh8EyFtcWciH): rewrote 「当前 PM」 only. ⛔ No other section changed.
R46 round-1 boundary refresh: rewrote 「当前 PM」 only.
R46 stood down (session session_01WVbr5J6u8BHh8EyFtcWciH) on the maintainer's 「当前任务处理完，合并后就下班」: rewrote 「当前 PM」 to ⏳ vacant + the successor's ledger, and deleted the patrol Routine. ⛔ No other section changed.
R46 re-seated on 「你不用下班，继续派发。」: rewrote 「当前 PM」 only. ⛔ No other section changed.

Generated by Claude Code

R46 stood down again (session session_01WVbr5J6u8BHh8EyFtcWciH) on the maintainer's 「当前任务处理完，合并后就下班」 (2026-10-17): rewrote 「当前 PM」 to ⏳ vacant + the successor's ledger and 「继承台账」 to point at it, and deleted the patrol Routine. ⛔ No other section changed.