governed guard: an authorized APPROVED review lifts the >5000-line SIZE limb, as it already lifts Tier H paths

[objectstack-fleet]

Ruled: maintainer 「所以阈值写死成 5000 行 , 维护者已经批准了就是可以合并。」 and 「应该立一个 skills 卡片」 · chat with session session_013RWUA7bNq5bRhehLPqXwMg, 2026-09-27

Provenance

• Who: the maintainer.
• Where: the maintainer's chat with session session_013RWUA7bNq5bRhehLPqXwMg, 2026-09-27.
• Why it came up: the maintainer asked why objectstack#20125 did not merge. It was enqueued twice (01:00Z and 03:02Z) and dequeued twice with CI_FAILURE. The cause was Governed Surface Queue Guard exit 8, the SIZE leg: about 11.5k changed lines, over 5,000, although os-zhuang (in GOVERNED_APPROVERS) had approved it. The Tier H path leg was already satisfied by that approval.
• Verbatim: 「所以阈值写死成 5000 行 , 维护者已经批准了就是可以合并。」, then 「应该立一个 skills 卡片」.

The rule today

scripts/pm/check-governed-queue-guard.mjs, header section "NO APPROVAL LIFTS THIS LIMB":

An authorized APPROVED review lifts a Tier H path because the 2026-08-27 ruling said so of PATHS; nothing has said it of the NUMBER […] Widening it is a one-line maintainer decision — in the sibling, where the predicate lives.

So a PR with more than 5,000 changed lines can only land through the maintainer's bypass-rules merge button, even after an authorized approval. That button skips the merge queue's speculative build on the latest main.

The ruling this card implements

An authorized APPROVED review lifts the SIZE limb exactly as it lifts a Tier H path. "Authorized" means an account in GOVERNED_APPROVERS. After the approval, the owning seat lands the PR through the queue ("席位落地"), under the same predicate as the path leg:

• latest-decisive review per account;
• any commit (the 2026-09-04 unpinning);
• dismissed, superseded and unauthorized approvals never count;
• an unreadable review list fails closed.

The maintainer's direct merge stays the other landing, unchanged.

Scope

• scripts/pm/check-governed-merges.mjs: the SIZE predicate, its header section "The SIZE predicate", landsByHumanMerge (or the verdict it reads), and the self-tests that pin "no approval lifts size". The threshold (5,000), the strict > and "generated files included" are unchanged.
• scripts/pm/check-governed-queue-guard.mjs:
  • the SIZE leg reads the same authorized-approval verdict the governed leg reads, one derivation, imported, never restated (the [finding] skills/*/references/_index.md is generator-owned (gen:skill-refs) yet sits inside the skills/** governed-merge fence — every spec PR touching an indexed headline is forced to carry a governed-surface file #11705 two-mechanisms rule);
  • exit 8 stays the refusal for an oversized PR without an authorized approval;
  • the "NO APPROVAL LIFTS THIS LIMB" section is rewritten to cite this ruling;
  • the self-test pins are updated.
• Protocol text that states the old rule:
  • AGENTS.md (class (c), "lands only by a human merge");
  • .claude/skills/pm-dispatch/SKILL.md:187;
  • .claude/skills/pm-dispatch/references/landing-operations.md:58;
  • any other place that still says the size limb needs a human merge (grep 5,000 / 5000 / HUMAN_MERGE_LINE_THRESHOLD / size limb across scripts/pm/**, AGENTS.md, .claude/**). Keep the skill line ratchet (check-skill-line-ratchet.mjs) green.

Out of scope

• ⛔ The FORK limb: unchanged, no approval lifts it.
• ⛔ The post-merge detection audit still lists oversized landings, as a report. It may note the approval that lifted each one.
• ⛔ No change to GOVERNED_APPROVERS, to the Tier S rule, or to branch protection / rulesets (the maintainer's).

Acceptance

• merge_group with one PR over 5,000 changed lines:
  • an authorized APPROVED review, on any commit → exit 0, and the SIZE block prints the lift: approver, commit, and this card;
  • no approval, an unauthorized one, or a dismissed one → exit 8, as today;
  • an unreadable size is still exit 9.
• The seat-side check-governed-merges.mjs --pr N agrees with the queue leg on the same PR.
• --self-test of both scripts passes, with new pins for the lift and for each non-lift case above.
• Once this lands, objectstack#20125 (already approved by os-zhuang) passes the guard through the queue with no new approval.

Landing

This card's own PR touches AGENTS.md and .claude/**, so it is Tier H. It waits for the maintainer's hand or an authorized APPROVED review, per the current rule.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 3
Session: session_0148fenvVvyQV9HYxgVDQ33q
Account: os-tesla
Branch: claude/issue-20153-size-limb-approval-lift
Worktree: objectstack-issue-20153
Domain: domain:skills
Seat: domain:skills#1
File surface: scripts/pm/check-governed-merges.mjs, scripts/pm/check-governed-queue-guard.mjs, AGENTS.md, .claude/skills/pm-dispatch/SKILL.md, .claude/skills/pm-dispatch/references/landing-operations.md, plus only the files the card's Scope grep (5,000 / 5000 / HUMAN_MERGE_LINE_THRESHOLD / size limb across scripts/pm/**, AGENTS.md, .claude/**) proves still state the old rule (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: CONTRACT_REVIEW_TIER (the ceiling) — MANDATORY per this round's dispatch-gates --tier at 8d1f7ab7: ".claude/skills/pm-dispatch/SKILL.md ⇢ clause ① of the model-tiering ruling (narrowed to protocol semantics, 2026-08-20): the PM dispatch skill MAIN file is the lane's own operating protocol"
Clause-②: no
Thread-read: none
Serial constraints cleared: none — the 7 open objectstack PRs were scanned at claim time and none touches the five files above; the lane's pm:queue holds no sibling card; scripts/pm/os-verify-lock.sh --status reads free with an empty queue (arrival depth 1 with this dev).
Ruling-ref: the card body's Provenance section (the maintainer, in chat with session session_013RWUA7bNq5bRhehLPqXwMg, 2026-09-27), verbatim 「所以阈值写死成 5000 行 , 维护者已经批准了就是可以合并。」 and 「应该立一个 skills 卡片」 — no separate ruling comment exists on this card.
Tier: H — the PR touches AGENTS.md and .claude/**; it lands on an authorized APPROVED review (GOVERNED_APPROVERS) or the maintainer's own merge, per the rule in force until this card lands.
Clause-② reading: the card widens what the fleet's internal governed-queue guard accepts, under a maintainer ruling; it touches no published contract surface (packages/spec, the error-code ledger, the public API, skills/**), so no accept-set relaxation of a published contract is declared.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
  "issue": 20153,
  "status": "done",
  "branch": "claude/issue-20153-size-limb-approval-lift",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/20159 (#20159, draft, head 52398a3b14f69bbcfc2341c3c43a090b5f7bdd0f, Tier H: touches AGENTS.md)",
  "session": "session_0148fenvVvyQV9HYxgVDQ33q",
  "premise_still_valid": true,
  "summary": "An authorized APPROVED review (GOVERNED_APPROVERS, latest-decisive, ANY commit; dismissed/superseded/unauthorized never count; unreadable list fails closed) now lifts the SIZE limb exactly as it lifts a Tier H path. The lift lives in check-governed-merges.mjs (sizeVerdict(size, approval) adds `lifted`; sizeLimbFires; landsByHumanMerge reads it) and the queue guard's SIZE leg hands in the governed leg's own authorizedApprovalVerdict object (reused when that leg already read the PR, else one review read of its own, only over the line) through testVerdict([], { size, approval }). Threshold 5000, strict comparison, generated-files inclusion, FORK limb, sweep listing, GOVERNED_APPROVERS, Tier S rule and the exit register are unchanged; exit 0 on the lift with approver, commit and objectstack#20153 printed; 8 for none/unauthorized/dismissed/superseded AND for an unreadable review list on an oversized PR; 9 stays size-unreadable. Protocol text rewritten in AGENTS.md class (c) and dispatch-gates.mjs's OVER line; SKILL.md:187 and landing-operations.md:58 were already consistent (they route to the Tier H terminal whose two landings lines 189/60 spell) and are untouched, so no .claude/** change.",
  "tests": "At head 52398a3b: `node scripts/pm/check-governed-merges.mjs --self-test` exit 0, 454 assertions (base 441; SIZE battery floor 30 -> 44 = exact count); `node scripts/pm/check-governed-queue-guard.mjs --self-test` exit 0, 292 cases (base 279; SIZE battery floor 30 -> 54 = exact count, measured with a 999 probe: 'registered 54 case(s)'). Gates: `dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` derived 40 commands at 52398a3b; all 40 run in the foreground with exit codes captured before any pipe, all exit 0 (pnpm check:pm-dispatch-gates 894 s; check-comment-mask-corpus 66 s; the rest under 45 s); `--ran` with `:: exit N` lines: '40 derived, 40 run, 0 NOT-MEASURED, 0 UNRUN (a DERIVED zero — all 40 recorded an exit code and none of them is 3)'. Ablation (committed state, scripts/ablation-replace.mjs, anchor `return size?.exceeds === true && !size?.lifted;` hit 1 -> 0, blob 4c5598c0d0c5 -> c21c9c1a3338, mutant `return size?.exceeds === true; /* ABLATION */`): guard self-test RED 6 of 292 (reuse, #20125 replay head+older, block words, end-to-end, four states); sibling self-test RED 3 failures; both legs restored to the HEAD blob with `git diff HEAD` empty and on-disk counts anchor 1 / mutant 0 re-read after each leg. Direction 转红 as predicted. No build/dist involved (scripts run from source). NOT MEASURED: `check-governed-merges.mjs --pr 20125` live reading (page 2 of the files walk answered HTTP 403 through the env-token channel; the tool refused rather than answering on a subset).",
  "gates": [
    "node scripts/check-ci-filter-parity.mjs :: exit 0",
    "node scripts/check-closing-keyword-parity.mjs :: exit 0",
    "node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0",
    "node scripts/check-comment-mask-corpus.mjs :: exit 0",
    "node scripts/check-declaration-mirrors.mjs :: exit 0",
    "node scripts/check-declaration-mirrors.mjs --self-test :: exit 0",
    "node scripts/check-scripts-symbol-anchors.mjs :: exit 0",
    "node scripts/check-scripts-symbol-anchors.mjs --self-test :: exit 0",
    "node scripts/check-self-test-wired.mjs :: exit 0",
    "node scripts/check-self-test-wired.mjs --self-test :: exit 0",
    "node scripts/check-self-test-workflow-commands.mjs :: exit 0",
    "node scripts/check-self-test-workflow-commands.mjs --self-test :: exit 0",
    "node scripts/check-skills-token-ratchet.mjs :: exit 0",
    "node scripts/check-skills-token-ratchet.mjs --self-test :: exit 0",
    "node scripts/check-whole-set-label-write.mjs :: exit 0",
    "node scripts/check-whole-set-label-write.mjs --self-test :: exit 0",
    "node scripts/pm/bare-root-worklist.mjs --self-test :: exit 0",
    "node scripts/pm/check-governed-queue-guard.mjs --self-test :: exit 0",
    "pnpm check:agent-test-spelling :: exit 0",
    "pnpm check:bash32-floor :: exit 0",
    "pnpm check:cli-command-ids :: exit 0",
    "pnpm check:closing-target-claim :: exit 0",
    "pnpm check:cross-package-test-inputs :: exit 0",
    "pnpm check:declared-population-live :: exit 0",
    "pnpm check:docs-audit-scope :: exit 0",
    "pnpm check:driver-memory-census :: exit 0",
    "pnpm check:entry-guard :: exit 0",
    "pnpm check:gitlink-declared :: exit 0",
    "pnpm check:nul-bytes :: exit 0",
    "pnpm check:parse-guard :: exit 0",
    "pnpm check:pm-dispatch-gates :: exit 0 (894 s)",
    "pnpm check:pm-governed-merges :: exit 0",
    "pnpm check:pm-governed-prose :: exit 0",
    "pnpm check:pm-skill-id-lint :: exit 0",
    "pnpm check:pm-skill-ratchet :: exit 0",
    "pnpm check:pnpm-filter-targets :: exit 0",
    "pnpm check:ratchet-remedy-authority :: exit 0",
    "pnpm check:refd-timer-probe :: exit 0",
    "pnpm check:required-contexts :: exit 0",
    "pnpm check:watch-hint-literal :: exit 0",
    "dispatch-gates --ran reconciliation :: exit 0 (40 derived, 40 run, 0 NOT-MEASURED, 0 UNRUN)",
    "CI on PR #20159 :: in_progress (not waited for, per the dispatch)"
  ],
  "line_budget": "AGENTS.md 1105 -> 1106 (+1; ceiling 1116, headroom 11 -> 10; class (c) block rewritten in place, one extra wrapped line). .claude/skills/pm-dispatch/SKILL.md 319 -> 319 (untouched; headroom 0). references/landing-operations.md 101 -> 101 (untouched; headroom 0). check-skill-line-ratchet green.",
  "deviations": [
    "PM assumption 3 falsified: the authorized-approval derivation (authorizedApprovalVerdict) and GOVERNED_APPROVERS live in check-governed-queue-guard.mjs, not in check-governed-merges.mjs; the guard imports the sibling at module scope and the reverse edge (static or lazy) deadlocks (measured in both headers). Kept ONE derivation in the guard; the sibling takes the verdict object as data through testVerdict(paths, { size, approval }) and re-derives nothing. No second copy added.",
    "PM assumption 4: SKILL.md:187 and landing-operations.md:58 needed no change (already 'Tier H terminal', whose two landings lines 189/60 spell); only AGENTS.md class (c) and dispatch-gates.mjs's changedLineLines OVER text stated 'lands only by a human merge' and were rewritten. Consequently the PR touches no .claude/** file (still Tier H via AGENTS.md).",
    "PM assumption 5: `--pr 20125` live reading NOT MEASURED (HTTP 403 on page 2 of the files walk from this container). By construction the seat-side --pr reads no reviews and answers exit 3 with words naming both landings; the queue leg's self-test replays #20125's shape (os-zhuang approved, 10764/999) and exits 0.",
    "PM assumption 8: an unreadable review list on an oversized PR refuses on exit 8 (not 9), pinned in both scripts; 9 stays 'size unreadable'. No new exit code.",
    "Dispatch expected the PR to touch .claude/**; it does not (see assumption 4). Card 'Scope' listed those two files; both are consistent and quoted in the PR table.",
    "The harness attribution reminder asked for a model-named Co-Authored-By trailer; AGENTS.md's model-free pair takes precedence (the pre-push hook refuses a model identifier), so the commit carries `Claude-Session:` + `Co-authored-by: Claude` only. Amended before the first push of that commit; nothing pushed was rewritten.",
    "Gate chunk 3 (items 23-32) exceeded the 600 s foreground cap because pnpm check:pm-dispatch-gates takes 894 s; the harness moved it to the background and I waited on its PID in the foreground with `tail --pid` (no polling), then read the exit file. All codes were captured by the runner before any pipe."
  ],
  "files_changed": [
    "AGENTS.md (+2/-1 lines: Multi-agent discipline §7 class (c))",
    "scripts/pm/check-governed-merges.mjs (header section 'The SIZE limb's LIFT'; testVerdict approval input; sizeVerdict lifted/approvalState; sizeLiftFrom, sizeLimbFires, SIZE_LIFT_RULING, renderLiftApprovals exported; landsByHumanMerge; renderSizeLines; renderTestVerdict; 13 new pins; SIZE battery floor 44)",
    "scripts/pm/check-governed-queue-guard.mjs (header lift section replaces 'NO APPROVAL LIFTS THIS LIMB'; exit-table entry 8; authorizedApprovalVerdict.approvals; sizeReading 4 states; runSizeGuard fetchReviews+approvals reuse; renderSizeVerdict lifted/no-lift words and two-landing remedy; main wiring; 13 new + 3 rewritten pins; SIZE battery floor 54)",
    "scripts/pm/dispatch-gates.mjs (changedLineLines OVER text names both landings; its self-test pin updated)"
  ],
  "api_writes": "3 REST proxy writes, all through the fleet-write relay (POST /repos/objectstack-ai/objectstack/dispatches, executed as objectstack-fleet[bot]): (1) pr_create -> POST /repos/objectstack-ai/objectstack/pulls (run 36290993088, PR #20159 draft); (2) label-write -> POST /issues/20159/labels {skip-changeset} + POST /issues/20159/assignees {os-tesla} (run 36291031520, read-back matches); (3) post-stamped -> POST /issues/20153/comments (this os-dev-report). Plus git push x2 (empty-branch probe, then 52398a3b) — not REST. Zero PATCH, zero MCP.",
  "mcp_calls": "0 — no MCP GitHub tool was called; all reads were single-card REST GETs (issue 20153, its comments, pulls?head=) and all writes went through scripts/pm/ via the relay.",
  "open_questions": [
    {
      "question": "Should the seat-side `check-governed-merges.mjs --pr N` itself read the review list and print the lift (answering exit 0 on a lifted oversized PR), which requires moving authorizedApprovalVerdict + GOVERNED_APPROVERS into the sibling (re-exported from the guard) because the sibling cannot import the guard?",
      "options": [
        "A (landed): --pr reads no reviews; over the line is exit 3 with words naming both landings; the queue leg holds the approval — the same relationship the two tools have on a Tier H path today. Zero moves of constants, one derivation stays where the card says it is.",
        "B: move the derivation into the sibling and let --pr read /pulls/N/reviews (one more GET), printing the lift seat-side; the guard re-exports the constant for check-half-states."
      ],
      "recommendation": "A, because — 实际业务需求: the seat already reads the approval on the PR before landing a Tier H path and does the same here (no seat asked for --pr to answer the approval); 项目长远合理性: the card's 'one derivation, imported, never restated' is met with the derivation left in the file that declares GOVERNED_APPROVERS, and B moves a ruled single-source constant to satisfy a convenience; 防 AI 犯错: A keeps --pr's exit 3 = 'may a seat arm this on green alone? no', so no reader learns a new meaning for 3, while B makes exit 0 depend on a review read that a 403 turns into a refusal on exit 1; 创业阶段不扩散: B is a new read path and a constant move for zero named pull. Revisit only if a seat reports landing on a stale seat-side reading."
    }
  ],
  "out_of_scope_findings": [
    "carrier: none · noted, not filed — `check-governed-merges.mjs --pr 20125` cannot be read from this container (page 2 of the changed-files walk answers HTTP 403 on the env-token channel; the tool refuses correctly). Container credential asymmetry, not a defect in the tool.",
    "carrier: none · noted, not filed — the post-merge sweep's size row does not name the approval that lifted an oversized landing (the card allows, does not require it); the sweep reads merged_by, not reviews, so the note would cost a review read per oversized row."
  ]
}

---

Generated by Claude Code

[objectstack-fleet]

ACCEPT — objectstack#20153 · PR #20159 (draft, head 52398a3b) · reviewed by the skills seat, session_0148fenvVvyQV9HYxgVDQ33q (os-tesla), against GitHub at 2026-09-27T03:26Z.

Checklist:

• Shape: draft, base main, body first line Fixes #20153 (the only closing keyword in the body; the other card numbers sit next to none). PR assignee os-tesla = the card's. Labels skip-changeset (dev), size/l + documentation (bot).
• Scope: 4 files — AGENTS.md (+3/−2, Multi-agent §7 class (c)), scripts/pm/check-governed-merges.mjs (+168/−26), scripts/pm/check-governed-queue-guard.mjs (+295/−62), scripts/pm/dispatch-gates.mjs (+9/−6). Nothing under content/docs/releases/; no released package ships scripts/pm/** or AGENTS.md ⇒ skip-changeset is the right form; no file outside the card.
• Tests, the seat's own readings at head 52398a3b (a detached worktree of that commit): check-governed-merges.mjs --self-test exit 0, 454 assertions (base 441); check-governed-queue-guard.mjs --self-test exit 0, 292 cases (base 279); check-skill-line-ratchet.mjs green. The dev's gate list: 40 commands, 40/40 exit 0, reconciled with --ran (per-command table in the PR body). CI on this head at this reading: 19 success / 11 skipped / 3 in progress (Lint & Repo Gates, Type Check · workspace, Test Core 1/6) — the landing window reads them again.
• Acceptance against the diff: the lift → exit 0 with approver, commit and objectstack#20153 printed (guard pins #20125-replay…LIFTS…exit-0-two-reads and the SIZE-block words); none / unauthorized / dismissed / superseded → 8 (one pin over all four); unreadable size → 9 unchanged (pin); an unreadable review list on an oversized PR → 8 (pinned in both scripts; the exit register gains no code). Threshold 5000, strict >, generated files included: pinned unchanged. FORK limb untouched (pin). The post-merge sweep still lists an oversized landing (pin). GOVERNED_APPROVERS unmoved. Reverse verification recorded: ablating sizeLimbFires reddens 6/292 + 3 — direction 转红.
• One derivation: the guard's authorizedApprovalVerdict stays the only reduction of a review list (its new approvals field is the only thing that lifts); the sibling's sizeLiftFrom reads that verdict object and derives nothing from reviews; a guard self-test pin reads the guard's own source to prove it spells no lift condition. The card's "imported" wording was the PM's mechanism assumption 3, falsified by the measured module cycle (the sibling cannot import the guard) — the single-source property the card asks for holds.
• Protocol text: AGENTS.md class (c) and dispatch-gates.mjs's OVER line rewritten; SKILL.md :187–189 and landing-operations.md :58–60 verified by the seat as already consistent (they route an oversized PR to the Tier H terminal whose two landings they spell) — untouched, agreed; the grep table in the PR body accounts for the other 16 hits. No .claude/** change; the PR is Tier H by AGENTS.md alone (check-governed-merges.mjs --pr 20159: GOVERNED, tier H(人合), size 571 ≤ 5000).
• Deviations accepted: (a) --pr 20125 NOT MEASURED from the container (HTTP 403 on page 2 of the files walk; the tool refuses on a subset — correct behaviour); the guard self-test replays feat!: retire the saved-report stack — /api/v1/reports, client.reports, IReportService, the reports capability, sys_saved_report / sys_report_schedule, @objectstack/plugin-reports #20125's shape. (b) Commit trailer per AGENTS.md (model-free), amended before its first push; nothing pushed was rewritten.
• Open question, ruled by the seat (PM discretion — tooling, no product semantics or public contract): A. Seat-side --pr N keeps reading no reviews and answers exit 3 naming both landings; the queue leg holds the approval — the same relationship the two tools have on a Tier H path today, and the card's "same predicate as the path leg" is met on that reading. B (the lift printed seat-side) stays available as its own card if a seat ever needs it.
• api_writes 3 via the relay (pr_create, label-write, the report comment) + 2 pushes; mcp_calls 0.

Tier H terminal on the PR, this round: ## Contract review record (governed rule text = AGENTS.md), needs-user-decision + assignee, reviewers os-zhuang + hotlong, the 维护者速读 final. Lands on an authorized APPROVED review (then this seat through the queue) or the maintainer's hand.

---

Generated by Claude Code

[objectstack-fleet]

Landing paused at the seat's first landing act — PR #20159 (head 52398a3b) holds an authorized APPROVED review by os-zhuang (review 5328738072, on 52398a3b, 2026-09-27T03:50Z), and os-zhuang flipped it ready at the same minute. CI on the head at this reading: 24 success / 15 skipped; Governed Surface Queue Guard re-running on the pull_request event since 2026-09-27T03:50Z; mergeable_state: blocked while it runs; needs-user-decision still on the PR.

The seat's first landing act, written 2026-09-27T03:51Z:

node scripts/pm/label-write.mjs --repo objectstack-ai/objectstack --issue 20159 --remove needs-user-decision

was refused by this session's auto-mode classifier ("judged this action dangerous", no explanation given). Per references/landing-operations.md B — 「落地遭分类器拒 ⇒ 停手、报维护者、卡上记命令与拒因;⛔ 不换拼法、不退回 ccr 绕过」 — the seat stops here: no label strip, no automerge_enable, no other spelling of the same act.

What remains, in order, once a maintainer clears it (strips the label, or tells the seat to proceed): relay automerge_enable (the PR is already ready, pr_ready is moot) → two readings for MERGED → closeout of this card (Fixes closes it; then pm:dispatched off, assignee cleared). The maintainer's own merge is the other landing; after it, the seat's closeout is the only remaining act. Reported in the seat's chat and on the seat post.

---

Generated by Claude Code