docs(pm-skill): census reach: in is not ADR-0131 D9 admission; the tenancy ledger decides

[objectstack-fleet]

Fixes #23377

Clause-②: no

What changes

One reading is added to .claude/skills/pm-dispatch/references/platform-readings.md, section 读数陷阱 (reading traps), and one same-file restatement is deleted to pay for it at the file's 460-line ceiling. File surface: that one file. No scripts/**, no packages/**, no other reference.

Before / after

Added (119 bytes; placed after 「⛔ 别处写下的计数值一律先复测再用。」, in the count-is-not-mechanism cluster):

• 租户普查 reach: in 只说有租户列;D9 系统写盖章只认 PLATFORM_OBJECT_TENANCY 的 tenant-scoped。

Deleted (was line 395, in the required-checks cluster):

• in_progress 不是过;advisory 门禁红进 main 是共享损伤,照样止血立单。

Its home: .claude/skills/pm-dispatch/references/reading-discipline.md lines 24–25. That is the reference this file's own line 3 points to (见 reading-discipline.md):

• 放行认门禁 job 的结论(completed: success),⛔ 不认聚合读数。
• advisory 门禁红着进 main 是共享损伤,任何车道发现都立即止血并立单,见 landing-operations B。

The deleted line's first half (in_progress is not a pass) is the negation of line 24's positive criterion: only completed: success releases. AGENTS.md Multi-agent discipline §7 also states it literally ("in_progress is not a pass"). The second half is line 25 nearly word for word. Nothing in the deleted line exists only there.

Line budget: 460 → 460 (ceiling 460, headroom 0). Widest line 120 bytes, unchanged.

Premises, re-read on 4f81f31526 before writing

1. The census predicate. scripts/platform-object-tenancy-census.json has "reach": "in" ×48 and "reach": "out" ×35. The predicate is computed at scripts/platform-object-tenancy-census.mjs:379–384: tenantField = resolveTenantFieldName({ ...def, fields: registeredFields }) and reach: tenantField === null ? 'out' : 'in'. scripts/check-platform-object-tenancy-census.mjs:305 prints the same predicate sentence in the gate's failure text.
2. The ledger. PLATFORM_OBJECT_TENANCY is at packages/objectql/src/tenancy/platform-object-tenancy.ts:124, and the class union tenant-scoped / global / unclassified is at :100–106. It has 9 entries, all tenant-scoped. An unlisted name is unclassified by absence (:244–245).
3. The early return. The method is Engine.resolveSystemInsertOrganization at packages/objectql/src/engine.ts:6699. system-write-organization.ts holds the pure decision and names that method in its header (:164). At :6717, if (isPlatformObjectOutOfTenantAuditScope(object)) return undefined; returns early. That predicate (platform-object-tenancy.ts:261–263) answers true for a platform-namespace object whose class is not tenant-scoped. No organization is derived and nothing is refused.

Cross-reading of the two artefacts: 9 of the 48 reach: in objects are tenant-scoped in the ledger. The other 39 are reach: in and take the early return. That is the size of the trap this line names.

Context, all named without a closing verb: the ledger is the one ruled in #13491. The two misreadings the card cites are #23284 and #23256. PR #23340 admitted sys_notification to the ledger. The lift for unclassified objects belongs to #15212. This PR is a reading for seats, not a runtime change.

Gates (head 0c01a9d561, exit codes captured before any pipe)

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 20 commands. All 20 exited 0:

• node scripts/check-closing-keyword-parity.mjs · --self-test
• node scripts/check-comment-mask-corpus.mjs
• node scripts/pm/check-governed-queue-guard.mjs --self-test
• node scripts/pm/check-harness-current.mjs --self-test
• pnpm --filter @objectstack/lint run check:doc-formula-expressions: the first run exited 3 (PREREQUISITE NOT MET, unbuilt). After turbo run build --filter=@objectstack/formula --filter=@objectstack/lint under os-verify-lock.sh (VERDICT command-exit 0), it exited 0.
• pnpm check:agent-test-spelling · check:cross-package-test-inputs · check:doc-authoring · check:driver-memory-census · check:gitlink-declared · check:nul-bytes · check:pm-governed-merges · check:pm-half-states · check:pm-skill-id-lint · check:pm-skill-ratchet · check:refd-timer-probe · check:required-contexts · check:skill-frame-sync · check:watch-hint-literal

Reconciliation: dispatch-gates --ran printed 「✓ dispatch-gates --ran: 20 derived famil(ies) accounted for — 20 run, 0 NOT-MEASURED」. The ratchet line reads 「platform-readings.md is 460 lines (ceiling 460; headroom 0)」.

Roster families I also ran: pnpm check:pm-governed-prose 0 · pnpm check:pm-settings-deny-roster 0 · node scripts/check-published-list-mirrors.mjs 0 · node scripts/check-skills-token-ratchet.mjs 0. node scripts/check-single-claim-paths.mjs was NOT MEASURED: it exited 2, NOT WIRED, because it needs the PR context only the workflow supplies.

The farm (pnpm lint, pnpm test, builds) and the four type-check lanes belong to CI.

Acceptance notes

• The next line, 「⛔ 聚合命令同样不作判定 …」, now follows the required-set lines and not the deleted one. Its 「同样」 still reads against reading-discipline.md line 24's 「⛔ 不认聚合读数」. It is left untouched because the file surface is one line.
• Landing tier: .claude/** is Tier S in the GOVERNED_SURFACES register. The triage comment's "Tier H" is a misreading of the register. The landing tier is read at landing by check-governed-merges.mjs --pr.

维护者速读(草稿)

改了什么:在 PM 席位用的「平台读数事实表」里加了一条:租户普查里的 reach: in 只说明找到了租户列,不说明系统写入会被自动盖上组织。会不会盖章,只看 PLATFORM_OBJECT_TENANCY 账本里是不是 tenant-scoped。为了不超行数上限,同时删掉一条已经在 reading-discipline.md 里写过的重复规则,文件仍是 460 行。

为什么改:同一个席位在一个班次里两次把普查读成「会盖章」,其中一次写进了裁决记录。实测普查里 48 个 reach: in 对象,只有 9 个在账本里是 tenant-scoped。其余 39 个对象上的裸系统写入,组织列落空,也不会被拒绝。

风险与代价(含回滚):只改给 agent 读的内部参考文件,不进任何发布包,不影响运行时。删掉的那条规则在 reading-discipline.md 里原样保留。回滚就是 revert 这一个提交。

席位意见:

你要做的:无需决策。.claude/** 属 Tier S,由席位做合同档复核,PASS 后入队落地。

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0c01a9d561b06eb7af0cf7bfbf7401bde2480ff7
Local-runs: none

Reviewed in seat by the dispatching skills seat (served tier read from get_session last_served_model this fire, equal to the constant's value), on the PR diff (one file, +1/−1, one commit on 4f81f31526; check-governed-merges --pr 23435: .claude/** ×1, Tier S, 2 changed lines), card #23377 (a platform fact filed by the services seat, graded p3 by triage 6160533717), the dev's report (the newest os-dev-report comment on the card) and the head's check-runs. The governed face is the seats' reading-trap table; the judgment is whether the new reading is true on the tree and whether the deleted line is still said elsewhere the table points to. Written 2026-10-14T08:32Z.

① Derived judgments

• Added, 〈读数陷阱〉: 「租户普查 reach: in 只说有租户列;D9 系统写盖章只认 PLATFORM_OBJECT_TENANCY 的 tenant-scoped。」 (119 bytes) — the card's fact in the file's one-fact-per-bullet style. True on 4f81f31526 by the three premises the dev re-read and the seat spot-checked: the census marks reach: in/out from resolveTenantFieldName (48/35; computed at scripts/platform-object-tenancy-census.mjs:379–384, printed by the gate's failure text at check-platform-object-tenancy-census.mjs:305); PLATFORM_OBJECT_TENANCY and its tenant-scoped | global | unclassified classes live in packages/objectql/src/tenancy/platform-object-tenancy.ts, nine entries all tenant-scoped, an unlisted name unclassified; Engine.resolveSystemInsertOrganization (packages/objectql/src/engine.ts:6699) returns early at :6717 for a platform object outside the tenant audit scope, so a bare system insert stores organization_id NULL with no refusal — 39 of the 48 reach: in objects take that return. The dispatch's two citations were the restating sites, not the computing ones; the dev's refinement is accepted.
• Deleted, old L395: 「in_progress 不是过;advisory 门禁红进 main 是共享损伤,照样止血立单。」 — both halves live in reading-discipline.md:24–25 (「放行认门禁 job 的结论(completed: success),⛔ 不认聚合读数」; 「advisory 门禁红着进 main 是共享损伤,任何车道发现都立即止血并立单,见 landing-operations B」), the reference platform-readings.md:3 names as the table's parent (「见 reading-discipline.md」). A restatement with a home the reader is already sent to; nothing a seat still owes leaves the table.
• Ratchet on the head: platform-readings.md 460/460 (ceiling 460), widest line 120 bytes, the added line 119; Lint & Repo Gates (ratchet, id lint, governed-prose scan) success. Fixes #23377 is the body's only closing keyword (design: isSystem 写入是否在租户审计控制范围内?——#13178 类级装置(A/B/C)的共同前置,从未被裁过 #13491, feat(spec,drivers,objectql,plugin-security): organization_id NOT NULL per cleared table; one predicate for Layer 0 and every driver; both orWhereNull arms, the __global__ sentinel and the #13491 ledger retire (ADR-0131 D1/D8/D9) — protocol 18 #15212, plugin-approvals expandPositionUsers filters organization_id strictly, while plugin-security's holdingTakesEffectIn admits an organization-less position holding in every organization: an upgraded 17.x holder never reaches an approval slate #23256, Notifications emitted from a system-context run (schedule tick, approval node) are stored with organization_id NULL on 18.0.0-next.0: the platform's own WARN says reports and cleanup that filter by organization will not see them #23284, fix(service-automation,service-messaging,plugin-approvals,objectql)!: a notification takes the organization of what it is about, and is refused where no owner is derivable #23340 carry no closing verb); Clause-②: no is correct — internal reference text, no published surface. Base 4f81f31526; main moved to 04a314873c during the run on files disjoint from this one — not merged, correctly (ruling A on [Decision] After a PR is open, merge main only on a conflict, a main-caused CI red or a queue removal, and re-check only the overlap; or keep merging main before every push #23390).

② Semver level

None owed: .claude/** ships in no package; skip-changeset on the PR is correct.

③ Boundary flags

• Dev flag — check:doc-formula-expressions needed a two-package build under the verify lock before exiting 0; 20 derived families run, --ran 20/20. Accepted.
• Observation (dev, no card): the line now following the deletion, 「⛔ 聚合命令同样不作判定:…」, keeps its 「同样」 while its in-file antecedent moved to reading-discipline.md:24; it still reads against that line. A one-word tidy for the file's next edit under a card that owns it; not a debt of this PR.
• Observation (dev): triage's comment calls the file Tier H; the register's .claude/** row is Tier S — the tool's reading governs, as it did for every landing this shift.
• open_questions: none.

Implemented-by: claude/issue-23377-census-reach-is-not-d9-admission
Reviewed-by: session_013zGKMG1cRedVzWtqGGGZW9

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · PR #23435 at 0c01a9d561 (Fixes #23377) — Tier S, landing by the seat

Skills seat 1 (session_013zGKMG1cRedVzWtqGGGZW9, huangyiirene), written 2026-10-14T08:33Z. The first seat record under the one-record-per-PR rule (PR #23422): the ACCEPT lives here, the card keeps a pointer line. Report read; everything below is verified on GitHub and the tree, not on the report.

1. 形态: draft PR against main; line 1 Fixes #23377 is the body's only closing keyword; Clause-②: no at line start; one file, +1/−1, one commit on 4f81f31526; skip-changeset (nothing published); check-governed-merges --pr 23435 → .claude/** ×1, Tier S, 2 changed lines; assignee huangyiirene.
2. 前提实测: the three tree facts behind the new reading hold on 4f81f31526 and 04a314873c — the census predicate (platform-object-tenancy-census.mjs:379–384, 48 in / 35 out), the ledger and its classes (platform-object-tenancy.ts:100–124), the early return (engine.ts:6717); the deleted line's two halves are at reading-discipline.md:24–25, the file the table's own line 3 points to. Judged line by line in the ## Contract review PASS record above for this head.
3. 门禁 check-runs: 38 runs on 0c01a9d561, read 2026-10-14T08:31Z — by newest run per name 23 success, 11 skipped, none failing or in progress; Lint & Repo Gates and TypeScript Type Check success; every skipped name (Auto Label, Build Core, Build Docs, Check Changeset, Check PR Size, Console Pin Gate, the dogfood lanes, the packed-tarball opt-in, Temporal Conformance, the Test Core matrix placeholder) is on the expected-skips roster (scripts/pm/check-expected-skips.mjs, read from source on main). The dev's local subset (20 derived families, exit 0, --ran 20/20) is its own evidence; the farm's is these check-runs.
4. 接受的偏差: the dispatch's two premise citations pointed at restating sites (check-platform-object-tenancy-census.mjs:305, system-write-organization.ts) — the dev named the computing sites instead; one prerequisite two-package build under the verify lock; main not merged after it moved on disjoint files.
5. 范围外去向: 「⛔ 聚合命令同样不作判定」's dangling 「同样」 — observation for the file's next owning card, no debt here; triage's "Tier H" wording vs the register's Tier S — the tool decides, noted.
6. 落地条款: Tier S — PASS record on this head, every check green, roster-expected skips ⇒ the seat flips pr_ready, reads mergeable_state until it settles, then arms automerge_enable as a second relay stroke; MERGED is confirmed from the queue ref and origin/main, then pm:dispatched leaves the card with a probe-table landing comment.

---

Generated by Claude Code