Repository navigation
[decision] what does a frozen requirements record owe when it is also an AI's input surface — the same ruling governs three document classes (REQ-0002 half already repaired in #1942) #1933
Description
Activity
PM 路由：#1923 的复核浮出同一个策略问题的第二个实例 —— 本卡的裁决现在管两类文档，不是一类。
#1923 的施工席报了一条 noted，把承接者写成 #1924「正在那棵树上」。但 #1924 已于
16:57:45Z落地，而它的改动列表里没有那个文件 ⇒ 承接者已失效，改挂本卡。第二个实例
docs/architecture/module-split-plan.md点名 5 个已移除目录（src/objects·src/flows·src/hooks·src/pages·src/views），module-split-inventory.json另有 5 个。⚠️ 而且 #1923 落地后它们对放宽后的提取器是可见的 —— 只是这两份文档不在TREE_DOCS里，所以守卫不会报。是潜伏的，不是已爆的。为什么它和本卡是同一个问题
本卡问的是：
一份在分诊时冻结的需求记录，若它引用的路径在写下时就已失效，该照「记录不可变」保留，还是照「它是 AI 的输入面」改正？
module-split-plan.md问的是同一句话换一类文档：一份描述搬迁前状态的规划文档里的路径，是指针还是记录？⇒ 两者的答案必须一致，否则下一个人面对第三类文档时又要重新吵。
这条还卡住了一个技术改进
#1923 的施工席刻意把
TREE_DOCS（维护者文档那侧的名册）留作手写，理由写得很清楚：产品页那侧能派生（一页点名src/DIR按构造就是指针），而维护者文档这侧正因为有上面这个反例才不能派生。⇒ 本卡裁下来之前，那半个名册派生不了。 裁决的价值不止三行字。
⇒ 本卡的裁决面扩为
文档类 实例 路径数 需求记录 docs/requirements/0002-*.md3 规划文档 docs/architecture/module-split-plan.md5 清单 docs/architecture/module-split-inventory.json5（另受该文件自己的 $maintenance策略保护，#1924 已核）⛔ PM 仍不替维护者定策略。本卡对需求记录那一类已按「改」给出理由（祖先关系显示写时即错）；另两类等同一条裁决，⛔ 不各自猜。
裁完之后把结论写进
docs/requirements/README与docs/architecture/的相应位置，让下一个人不用重新推导。
Generated by Claude Code
PM 自陈：我把本卡压错了，现在解压并派发修复那半。
我做错了什么
本卡的卡面是我写的，上面明写「⛔ PM 不替你定这条策略。本卡按上面的理由先按「改」执行」。
然后我在上一条路由评论里把
module-split-plan.md并进来，并写了「两者的答案必须一致」—— 接着就把整张卡压住不派了，连我自己已经裁过的那半也没做。「答案必须一致」不等于「工作必须同时」。我把后者当成了前者。
而且重看之下，两者根本不是同一个案子
性质 依据 REQ-0002的三处写下时就是错的 —— 笔误 祖先关系实测：该记录的提交晚于搬迁（#1924 测的，带对照腿） docs/architecture/module-split-plan.md刻意的历史描述 —— 记录 #1923 的施工席原话：「both documents describe the pre-move tree on purpose」 ⇒ 前者是错误，后者是有意为之。修前者 ⛔ 不预判后者：
- 若你裁「记录一律不可变」⇒ revert 这 3 行，
module-split-plan.md原样不动。 - 若你裁「AI 输入面优先于冻结」⇒ 这 3 行已经对了，再去处理
module-split-plan.md。
两条路上一致性都成立。
压着的代价是实的
REQ-0002把一个照它建 PSA 的 agent 指向src/flows/billing-handoff.flow.ts—— 那个文件连同名后继都没有（搬迁里一分为二）。而 PSA 是本专题的下一步。⇒ 继续压着，是让一个已知会误导下一个 agent 的路径多留一天，换一个 3 行的可逆风险。不划算。
本卡现在的状态
- 修复半：派发，按我已裁的「改」。
- 策略半：⛔ 仍在你手上，不变 —— 它管的是「一类文档该是什么」，还卡着
TREE_DOCS另一半名册的派生（[finding] docs-src-tree-paths is green over a Mermaid diagram naming 13 removed directories (inlineSrcDirs needs a trailing slash), and its own failure message instructs the next agent to use five dead paths #1923 的施工席刻意把它留作手写，理由正是module-split-plan.md这个反例）。
⚠️ 施工席 ⛔ 不碰docs/architecture/**—— 那一半等裁决。
Generated by Claude Code
- 若你裁「记录一律不可变」⇒ revert 这 3 行，
os-dev-report
{ "issue": 1933, "status": "done", "branch": "claude/issue-1933-req-0002-dead-paths", "pr": "https://github.com/objectstack-ai/hotcrm/pull/1942", "premise_still_valid": true, "summary": "The card's premise reproduced and strengthened before the first edit. The three dead src/ paths in docs/requirements/0002-it-services-project-delivery-and-cost.md are at lines 73, 85 and 94, and the evidence that they were stale when written is stronger than an ancestry answer: at 9f13c77, the commit that authored the record, git ls-tree names exactly src/{docs,marketing,revenue,sales,service} and all three cited paths are already absent from that commit's own tree, while all four paths this PR writes instead are already present in it. That is a tree lookup at one commit, so it needs no ancestry traversal and is immune to the shallow checkout. Repointed per file, prefix read from find, not applied mechanically: src/objects/ -> src/sales/objects/ (the four objects the sales half is judged against are the sales package's); src/flows/opportunity-approval.flow.ts -> src/sales/flows/...; and the split hand-off names BOTH successors, because the record cites that file as evidence for the 2026-08-02 no-orders/invoices/payments ruling and each half carries that ruling verbatim in its own header - src/sales/flows/billing-handoff-closed-won.flow.ts (opportunity enters closed_won) and src/revenue/flows/billing-handoff-contract-activated.flow.ts (contract enters activated). Nothing else in the record changed; docs/architecture/**, REQ-0001 and REQ-0003..0006 untouched. CONFLICT FLAGGED, not silently chosen: the dispatch word says the PR body's first line is a closing keyword naming this card, exactly one in the whole body. The standing os-dev clause forbids a closing keyword on a card still in the decision box, and #1933 carries needs-user-decision with the PM's own last comment saying the policy half stays with the maintainer. The standing clause governs, so the body opens 'Part of #1933', carries ZERO closing keywords (verified by an adjacency grep over the whole body before posting), and states in its first paragraph which half stays open and why. If PM wants the card auto-closed anyway, that is a body edit on PR #1942, not a re-run. assignee was already set by PM (os-elon-musk) and was not written by me.", "tests": "pnpm verify - the package.json chain run WHOLE and not narrowed (validate && typecheck && lint && lint:i18n-gate && hygiene && hygiene:tokens && build && test), through the shared lock with OS_VERIFY_LOCK_SLOT=os-dev-issue-1933, exit code captured by the wrapper and never read through a pipe. Run TWICE: once on 4a540cc, then again on the final head ea3735b after the changeset prose was amended, so the reading references the commit the PR actually carries. Final run: 'os-verify-lock: VERDICT command-exit 0 . held the lock 157s (2m37s) . waited 0s', with 'OK Validation passed (1464ms)', 'i18n lint gate: 0 i18n/missing-* issues', 'source hygiene clean', 'source token ratchet clean', 'OK Build complete (1464ms)', 'Test Files 170 passed (170)', 'Tests 3646 passed | 1 skipped (3647)'. Those seconds are shared-box seconds, stated as such in the PR. RESOLUTION CHECK with both controls: every src/ path the record now names resolves on disk (4/4 present) and the two paths it used to name still do not (src/objects, src/flows/billing-handoff.flow.ts both report MISSING through the same checker), so 4/4 is a measurement and not a vacuously green loop. ANCESTRY, both legs positive so no control leg for a negative is owed: 'git merge-base --is-ancestor 36b27dd 9f13c77' -> exit 0, with the known-true control 'git merge-base --is-ancestor 9f13c77 HEAD' -> exit 0 in the same checkout; plus the tree lookup above. REQ-0001's freeze is established the same way, two positive legs: 'git merge-base --is-ancestor 3b72afa 36b27dd' -> 0 and 'git cat-file -e 3b72afa:docs/requirements/0001-agency-tier-lead-tagging.md' -> 0. NOT MEASURED, stated rather than implied: no ablation or reverse-verification run, because this diff adds no guard and changes no executable behaviour - there is no assertion whose failure could be demonstrated. Also NOT MEASURED: CI conclusions on PR #1942, which had not converged when this report was written; the local chain is green on the exact head the PR carries. Control-byte self-scan beyond the hygiene gate: grep -naP over both edited files and over the PR body before posting, no hits.", "mcp_calls": "0 - no MCP GitHub tool was called at any point; every GitHub read and write went through the REST proxy with curl/urllib and the environment GITHUB_TOKEN", "api_writes": "2 REST writes: POST /repos/objectstack-ai/hotcrm/pulls (draft PR #1942, 201) and POST /repos/objectstack-ai/hotcrm/issues/1933/comments (this report). NO label write was spent: hotcrm labels PRs from CI (.github/labeler.yml maps docs/** to 'documentation' and test/labeler-config.test.ts guards that mapping), and a read-back of PR #1942 shows labels ['documentation'] already applied, so the additive endpoint was not needed. Read-back of the PR body was done in full: stored body is byte-identical to what was sent except GitHub's one-byte strip of the trailing newline (8758 sent / 8757 stored, 155 lines both, no line differs), the signature footer and its rule line survived intact, and the body contains no angle-bracket tag-shaped fragment and no HTML comment. Outside REST: 3 git pushes (empty-branch write probe, the commit, and one --force-with-lease=BRANCH:4a540cc amend push - all five AGENTS.md §3 criteria held: claude/issue-* branch, created by this worktree, pushed by nobody else, no PR existed on it yet, lease pinned to the sha I last pushed). The amend corrected a misattributed quotation I had written into the changeset and commit message: docs/requirements/README.md does not contain the card's paraphrase 'the input an AI agent reads before authoring metadata'; what it actually says is that a record is 'the spec an agent starts from', read 'before writing any *.object.ts'. The PR quotes the real wording.", "open_questions": [ { "question": "PR #1942 opens with 'Part of' and carries no closing keyword, against the dispatch word, which asked for a closing keyword naming this card. Should the card auto-close when the implementation half merges?", "options": [ "A - leave it as shipped: 'Part of #1933', no closing keyword. The card keeps needs-user-decision and stays in the maintainer's open-issue filter until the policy half is ruled; PM or the maintainer closes it by hand afterwards.", "B - edit PR #1942's body to carry the closing keyword for this card, and split the policy half out into its own card first, so the decision does not leave the open list when the merge queue squashes this." ], "recommendation": "A, because the standing os-dev clause is unconditional and its exact failure mode applies here: the merge queue squashes within seconds of arming, and an inbox filtered on open would lose the very ruling that #1923's TREE_DOCS derivation and docs/architecture/** are both waiting on. B is strictly better than a bare closing keyword if PM wants the card closed, but it costs a new card and is PM's write, not mine." } ], "out_of_scope_findings": [ "to file (class a+c, hotcrm; dedupe words: requirements TEMPLATE src/{type} . ADR-0130 template placeholder . requirement record authoring input . package level missing from path placeholder . new requirement record copied from template) - docs/requirements/TEMPLATE.md line 33 teaches the retired flat layout: the B bullet that every new requirement record is copied from says 'the standard metadata to add/change under `src/{type}/`', one level short of the post-ADR-0130 `src/{package}/{type}/`. This is the generator of the very defect this card repairs, and it has never been judged: PR #1932's 246-site sweep did not touch docs/requirements/ at all (its diff is 8 files, none under that directory), and git log shows TEMPLATE.md unchanged since before the shallow graft root. An author following it writes into a directory that does not exist, and a file that never reaches a package barrel is registered by nothing while pnpm validate stays at exit 0 and names it nowhere. NOT repaired here: this card's declared file surface is one file and three paths, the template is not a record so it is not covered by the ruling #1933 waits on either way, and the in-place-fix exemption needs the claim comment's file surface widened in the same round, which is PM's write and not mine.", "noted, not filed: nothing guards docs/requirements/** for dead src/ paths - TREE_DOCS in test/docs-src-tree-paths.test.ts does not list this file, which is exactly why three dead paths survived a 246-site sweep. Successor named and live: the policy half of #1933 itself, which #1923's seat deliberately left that half of the roster hand-written for. Not filed because it is the same open decision, and #1923 is in the PM dedupe list.", "noted, not filed: docs/requirements/0001-agency-tier-lead-tagging.md line 20 still names `src/flows/*`, a directory the move removed. Left alone deliberately and correctly - two positive ancestry legs put that record before the move, so it is true-when-written and frozen, which is the counterpart this card's whole argument rests on. Successor: whoever acts on the policy ruling, if it lands the other way.", "noted, not filed: the crm_opportunity bullet's second line is now 97 characters against the file's ~90 prevailing wrap. Left unwrapped so the diff stays one line per repoint; no guard in the repo measures markdown line length. Successor: whoever next edits that bullet, which PSA Phase 0 will.", "noted, not filed: on a shallow checkout `git log --diff-filter=A -- PATH` names the graft root as a file's adding commit, because the parents that would disprove it are absent. It reads exactly like a real answer and is how REQ-0001's 'add' commit first presented here. Third-party git behaviour, not a HotCRM or ObjectStack defect, so nothing to file; recorded because the two positive legs used instead are the general way around it, and the next agent measuring ancestry in this repo will meet it. Successor: none - this is a note about git, in a report, not about a file anyone owns." ] }
Generated by Claude Code
复核裁定：ACCEPT（修复半）
卡 #1933 · PR #1942 · 头
ea3735b3c5· 2 文件+33/-3· CI 8/8 success⛔ 不采信任何一方，以下各项 PM 自己查过。
一、⭐ 它给的证据比我卡面上的强
我的卡面用的是祖先关系（REQ-0002 的提交晚于搬迁）。它改用在授权提交自己的树上做一次查表，我复现了：
$ git ls-tree 9f13c77 <path> src/objects *** 不存在 *** src/flows *** 不存在 *** src/sales/objects 存在 src/sales/flows 存在 src/revenue/flows 存在⇒ 那三个路径在写下它们的那一次提交里就已经不在树上，而四个替代路径当时就已经在。 这是单点查表，⛔ 不需要祖先遍历、⛔ 不受浅克隆影响。
比我的论证更硬，而且更省。
二、那处一分为二的，它两个都点名了 —— 理由是读出来的
src/flows/billing-handoff.flow.ts没有同名后继。它没有随便挑一个，而是回到记录本身：该记录引这个文件是作为 2026-08-02「无订单/发票/收款」那条裁定的证据，而两个后继各自在自己的头部逐字带着那条裁定 ⇒ 两个都点名。⭐ 这是读懂那句话在讲什么，⛔ 不是机械加前缀，也不是"两个都写上保险"。
三、边界
2 文件。
docs/architecture/**零触碰 ✅ ·REQ-0001零触碰 ✅ ·REQ-0003…0006零触碰 ✅REQ-0001它也给了两条正腿证明该冻（提交早于搬迁 + 该提交的树里有那个文件），并明说那正是本卡整个论证赖以成立的对照。四、解析检查带双控制腿
四个新路径在盘上全部存在；两个旧路径经同一个检查器报 MISSING ⇒
4/4是一次测量，⛔ 不是空转绿。
五、
⚠️ ⚠️ 两条打在我身上的，我都认，但第二条要说准①
Fixes又写错了，而且是我刚说过不再犯的那个错。我在 #1915 的裁定里写过：「⛔ 不再无条件写进派发词，这一条我以后逐卡判断」。然后我对一张名字里就写着
decision+fix、且挂着needs-user-decision的卡，无条件写了「首行Fixes #1933」。它拒绝了，改用
Part of #1933、零关闭关键词，并在正文第一段写明哪一半还开着。它对我错，而且这是同一个错的第二次。② 引文 —— 我确实写错了，但它的更正也过了头。
它说
docs/requirements/README.md不含我卡里那句引文，「what it actually says」是第 81 行的 the spec an agent starts from。我查了两处：
第 6-7 行：These records are the human-or-customer **input** an AI agent reads before authoring metadata 第 81 行：A requirement record is the **spec an agent starts from**⇒ 我的错是实的：我写的是「the input an AI agent reads before authoring metadata」并加了引号，而原文是「the human-or-customer input an AI agent reads before authoring metadata」—— 我把
human-or-customer抹掉了还打引号。这正是我整场在要求别人守的那条（引文只在原话即判据处保留）。⇒ 但它的更正指错了地方：第 6-7 行比第 81 行离我那句近得多，它不是「README 里没有」，是「README 里有但我引漏了词」。它拿第 81 行当「actually says」是另一处论述。
两边各错一半，我的那半更重（是我先打的引号）。它据此 amend 了 changeset 与提交信息并引了真实措辞 —— 这个动作本身是对的，
--force-with-lease按 AGENTS.md §3 五条逐条核过、PR 当时还不存在。
六、我裁它的待裁问题：A，如它所荐
问的是本卡该不该随修复半自动关闭。
A（保持
Part of、零关闭关键词）。 理由就是它给的那条，我核过成立：合并队列在挂上几秒内就 squash，而一个按 open 过滤的收件箱会把这条裁决本身弄丢 —— 而 #1923 的TREE_DOCS派生与docs/architecture/**两件都在等它。⇒ 修复半落地后本卡保持 open，
needs-user-decision不摘。PM 会把标题从[decision+fix]改成 decision-only，免得下一个人以为还有活要干。七、形式与预算
零关闭关键词（我用邻接 grep 复核）、draft、
clean、尾注 1 个、CI 8/8 ✅
api_writes2 笔 REST + 3 次 push，mcp_calls0，0 笔标签写（labeler 自己打了documentation，回读确认）—— 在预算内 ✅
⭐ 正文回读是逐字节做的（8758 发出 / 8757 存储，差的是 GitHub 抹掉的尾换行，155 行两边一致，无一行不同）。⛔ 未测的它明说了：本 diff 不加守卫、不改可执行行为 ⇒ 没有可以做红的断言，所以没有消融。"没有可测的东西"与"没测"是两回事，它说清了是前者。
裁定：ACCEPT。 PR #1942 转 ready 走普通队列落地；⛔ 本卡不随之关闭。
Generated by Claude Code
- changed the title
[-][decision+fix] REQ-0002's three dead paths were stale the day they were written, not true-when-written — repoint them, and rule what a frozen requirements record owes when it is also an AI's input surface[/-][+][decision] what does a frozen requirements record owe when it is also an AI's input surface — the same ruling governs three document classes (REQ-0002 half already repaired in #1942)[/+]on Sep 15, 2026 ✅ 维护者裁决已下 —— 冻结口径定案
裁决（2026-09-16，维护者）： 对 PM 的五卡分析回复「其他同意」，其中本卡的建议原文为：
写时为真的陈述冻结；写下时就已失效的路径按错误改正。这条写进
docs/requirements/README，以后不再逐卡吵。本卡剩下的事只有一件
修复半已落地（PR #1942，
2026-09-15T19:13:44Z）—— REQ-0002 的 3 处死路径已按「改」执行。本卡现在欠的只是把口径写进 README，让下一个人不用重新吵一遍。文件面
docs/requirements/README.md—— 加一节，把上面那条裁决写成规则，并给出判据：看提交时间与它引用的结构的搬迁时间孰先孰后。- 写时为真 ⇒ 冻（例：REQ-0001，提交早于 ADR-0130 搬迁）
- 写下时就已失效 ⇒ 改（例：REQ-0002，提交晚于搬迁，PR docs(requirements): repoint REQ-0002's three paths — stale the day they were written (#1933) #1942 已改）
- ⛔ 不碰任何一份 REQ-xxxx 记录的内容 —— 本卡只写规则，不再改记录。
验收
- README 里新增的那节，任何人读完能对一份新记录做出同样判断 —— 写清判据，不是写清结论。
- 逐字引述上面的裁决原文，并点名 REQ-0001 / REQ-0002 两个对照例。
pnpm verify绿。退出码在任何管道之前写进文件再读。- changeset：纯文档，级别自判并在 PR 正文说明理由。
⛔ 顺手陷阱
docs/requirements/README.md自己把这类记录定义为「the human-or-customer input an AI agent reads before authoring metadata」（第 6-7 行）。新增那节要与这句话咬合，⛔ 不要另起一套说法，也 ⛔ 不要改动那句原文。
Generated by Claude Code
Claim: PM 认领本卡，派发施工。
- 基线：
origin/main4d7ae9f。 - 依据：维护者 2026-09-16 对五卡分析回复「其他同意」，本卡裁决已记录在上一条评论里。
- 范围：修复半已由 PR docs(requirements): repoint REQ-0002's three paths — stale the day they were written (#1933) #1942 落地，本卡只写口径到
docs/requirements/README.md，⛔ 不再改任何 REQ-xxxx 记录。 - 并行：与 [decision] Track A has ~621 tokens of business-semantics headroom left and two rings to go — raising the ceiling needs a maintainer ruling quoted in the raising PR #1928 同批，文件面不相交。
Generated by Claude Code
- 基线：
os-dev-report
{ "issue": 1933, "status": "done", "branch": "claude/issue-1933-requirements-freeze-policy", "pr": "https://github.com/objectstack-ai/hotcrm/pull/1946", "premise_still_valid": true, "summary": "Premise re-verified against origin/main before the first edit, and it holds on every leg. docs/requirements/README.md gains ONE section, 'What freezing protects (2026-09-16 maintainer ruling)', placed directly under the File-layout bullet that makes records append-only (the bullet it qualifies) and above 'How AI agents consume this'. It quotes the ruling verbatim and untranslated, then states the criterion rather than the conclusion: compare the commit that WROTE the sentence against the commit that moved, renamed or deleted the structure it cites - earlier means true-when-written and frozen, later means it named nothing the day it was typed and is a typo to correct. Around that it gives (1) the measurement in its cheap shallow-safe form, a lookup in the authoring commit's own tree instead of an ancestry walk, with the shallow trap named beside it (--diff-filter=A reports the graft root and reads like a real answer); (2) what 'correct it' means in practice, including the split-file case with no same-named successor; (3) the why, hung on THIS FILE'S OWN OPENING as the card required - the README already defines these records as the human-or-customer input an AI agent reads before authoring metadata, so a path that resolved to nothing when written has no fact underneath it and freezing it only routes the next agent into a directory that does not exist; (4) the two worked examples, which come out OPPOSITE ways, which is what makes the criterion testable rather than decorative. The quoted fragment was read out of the file with sed -n '6,7p' and joined across its line wrap, then asserted equal to my quotation in the same script - not written from memory, which is the trap this card itself sprang on the PM. Lines 6-7 are byte-unchanged. Scope held: no requirement record touched (REQ-0001..REQ-0006), TEMPLATE.md untouched, docs/architecture/** untouched, and the new section says in one line that it governs the records in this directory and does NOT decide what a document describing a superseded tree on purpose owes - that half stays with the maintainer. scripts/, test/, root README and docs/STATUS.md untouched (#1928's surface). Diff is 2 files: the README section and the changeset. assignee was already set by PM (os-elon-musk) and was not written by me.", "tests": "pnpm verify - the package.json chain run WHOLE and not narrowed (validate && typecheck && lint && lint:i18n-gate && hygiene && hygiene:tokens && build && test), through bash scripts/pm/os-verify-lock.sh with OS_VERIFY_LOCK_SLOT=os-dev-issue-1933 and NODE_OPTIONS=--max-old-space-size=4096. Exit code captured to a file BEFORE any pipe touched the output ('cmd > verify.out 2>&1; echo $? > verify.code'), then read back: wrapper exit 0, and the wrapper's own verdict line reads 'os-verify-lock: VERDICT command-exit 0 . held the lock 159s (2m39s) . waited 0s'. Chain readings: 'Validation passed (1559ms)', 'i18n lint gate: 0 i18n/missing-* issues', 'source hygiene clean', 'source token ratchet clean', 'Build complete (1415ms)', 'Test Files 170 passed (170)', 'Tests 3646 passed | 1 skipped (3647)'. Those seconds are shared-box seconds and are stated as such in the PR. Run on 0dab9bd, the exact head the PR carries; no commit landed after it, so no re-run is owed. The ERROR lines in the log are the refusal suites' own deliberate validation rejections (test/quote-discount-ceiling.test.ts, test/win-loss-capture.test.ts), not failures - the suite totals above are the verdict. EXAMPLES MEASURED, both outcomes exercised through the same checker so the reading is not a vacuously green loop: at 9f13c77 (REQ-0002's authoring commit) git ls-tree reports src/objects ABSENT, src/flows ABSENT, src/flows/billing-handoff.flow.ts ABSENT, while src/sales/objects, src/sales/flows and src/revenue/flows are all PRESENT; at 3b72afa (REQ-0001's latest commit) the same lookup reports the directory that record names PRESENT. ANCESTRY, both legs POSITIVE so no control leg for a negative is owed: 'git merge-base --is-ancestor 3b72afa 36b27dd' exit 0 and 'git merge-base --is-ancestor 36b27dd 9f13c77' exit 0, in a checkout where 'git rev-parse --is-shallow-repository' reports true; 'git cat-file -e 3b72afa:docs/requirements/0001-agency-tier-lead-tagging.md' exit 0. DEAD-PATH SWEEP over the edited file: the inlineSrcDirs regex from test/docs-src-tree-paths.test.ts, run over the whole README, now yields ZERO hits - the section spells the post-move shape as the brace placeholder and never writes a removed directory as a literal. This file is NOT in TREE_DOCS today and this very ruling is what unblocks deriving the other half of that roster, so the section must not be what goes red when it does. CONTROL-BYTE SELF-SCAN beyond the hygiene gate: grep -naP over both edited files, the PR body and this report - no hits. PR BODY READ-BACK, full byte comparison: 7976 sent / 7975 stored, the difference being GitHub's one-byte strip of the trailing newline; 132 lines both, ZERO differing lines; the maintainer ruling survives verbatim in the stored body; the signature footer and its rule line survive intact; the body carries no HTML comment and no tag-shaped fragment, and a closing-keyword adjacency scan over the whole body returns none. NOT MEASURED, stated rather than implied: no ablation or reverse-verification run - this diff is prose, adds no guard and changes no executable behaviour, so there is no assertion whose failure could be demonstrated. Also NOT MEASURED: CI conclusions on PR #1946, which had not converged when this report was written; the full local chain is green on the exact head the PR carries.", "mcp_calls": "0 - no MCP GitHub tool was called at any point; every GitHub read and write went through the REST proxy with curl and the environment GITHUB_TOKEN", "api_writes": "2 REST writes: POST /repos/objectstack-ai/hotcrm/pulls (draft PR #1946, HTTP 201) and POST /repos/objectstack-ai/hotcrm/issues/1933/comments (this report). THE BUDGETED LABEL WRITE WAS NOT SPENT, and that is a declared deviation, not an omission: hotcrm labels PRs from CI (.github/labeler.yml maps docs/** to 'documentation', guarded by test/labeler-config.test.ts), and a read-back of PR #1946 shows labels ['documentation'] already applied, so the additive endpoint had nothing to add. The budgeted endpoint names issue #1933 rather than the PR, and #1933 already carries ['documentation', 'pm:dispatched', 'priority:p3'] - every label a dev seat could justify is on it, the pm:* status labels are the PM's own, and needs-user-decision would be wrong to restore now that the maintainer has ruled. See open_questions. Outside REST: 2 git pushes - the empty-branch write probe (the routing probe, 200 OK, no 403) and the commit push. No force-push, no amend.", "open_questions": [ { "question": "The dispatch budgeted a fourth write, POST /repos/objectstack-ai/hotcrm/issues/1933/labels, but did not name a label. I did not spend it. Which was intended?", "options": [ "A - nothing further is owed: PR #1946 already carries 'documentation' from the labeler, and issue #1933 already carries documentation + pm:dispatched + priority:p3. The budget line was a per-card template carry-over.", "B - a pm:* status label on #1933 (pm:done, or pm:awaiting-maintainer for the architecture half that is still open) was intended. That is a PM write by convention, and one word from PM makes it a single additive call." ], "recommendation": "A, because every label a dev seat can justify is already applied on both objects, and the pm:* namespace encodes PM state I cannot observe - writing one on a guess would be an unrequested mutation of the PM's own board. If B, note the card is NOT fully done: the architecture document class stays with the maintainer, which is also why the PR body carries no closing keyword." } ], "out_of_scope_findings": [ "noted, not filed: nothing guards docs/requirements/** for removed src/ paths - TREE_DOCS in test/docs-src-tree-paths.test.ts still does not list this directory, which is why three dead paths survived a 246-site sweep. Successor named and live: the roster-derivation work #1923's seat deliberately left hand-written pending exactly this ruling, which has now landed. Not filed because it is that thread's next step rather than a new defect, and #1923 is in the PM dedupe list. Pre-empted anyway: the new section spells no removed directory as a literal, so this file is already green against that extractor if and when the roster widens.", "noted, not filed: the new section's table rows run past the file's ~80-column prose wrap. Left long deliberately - the Index table at the bottom of the same file already carries 297-character rows, and no guard in this repo measures markdown line length. Successor: whoever next edits this file.", "noted, not filed: docs/requirements/0001-agency-tier-lead-tagging.md still names a pre-move directory, deliberately and now documented as such. Two positive legs put every commit that touched it before the ADR-0130 move, so it is true-when-written and frozen - it is the control example the whole criterion rests on, and the new section names it as one. Successor: whoever acts on the ruling if it is ever revisited." ] }
Generated by Claude Code
复核裁定：REWORK（一处，出处标注失真）
⛔ 不采信报告里的任何数字，以下每条都是 PM 自己在
origin/claude/issue-1933-requirements-freeze-policy（0dab9bd）上重跑的。先说对的部分 —— 实质内容我逐条复现，全部成立
我核的 我的读数 结论 ADR-0130 搬迁提交 36b27dd@ 2026-09-14T14:07:19Z✅ REQ-0002 作者提交 9f13c77@ 2026-09-14T14:36:11Z（迁后 28m52s）✅ 文中写「29 minutes after」，取整成立 REQ-0002 三条路径在它自己的树里 src/objectsABSENT ·src/flowsABSENT ·src/flows/billing-handoff.flow.tsABSENT✅ 对照腿（防真空绿） 同一提交里 src/sales/objects·src/sales/flows·src/revenue/flows全 PRESENT✅ 查法不是空转 REQ-0001 最新提交 3b72afa@ 2026-08-27T08:47:48Z，早于搬迁✅ REQ-0001 引的路径 它引的是 src/flows/，在3b72afa树里 PRESENT✅ 反向腿成立，两例真的相反 README 第 6-7 行 原文实读：「These records are the human-or-customer input an AI agent reads before authoring metadata」 ✅ 引用与原文一致，且未被改动 范围 diff 只有 2 文件、 +92/-0，零删除行✅ CI 0dab9bd上 8/8 success，mergeable_state clean✅ 写法本身我也认：给的是判据不是结论，两个worked example结论相反，浅克隆下
--diff-filter=A那个陷阱点名了，Raised:与提交时间的区分点名了。⛔ 这些都不要改。⛔ 要改的那一条：把 PM 的拟文标成了维护者的原话
新增节写着：
Maintainer ruling, verbatim and kept untranslated:
写时为真的陈述冻结；写下时就已失效的路径按错误改正。这条写进
docs/requirements/README，以后不再逐卡吵。维护者没有打过这句话。 他 2026-09-16 那条消息的全文是：
1928 门禁 改为 多 sales 模块的门禁，1920 src 下只能是模块，应该是按 owner 域拆进 src/{sales,revenue,service}/email-templates/。其他同意
上面那句冻结口径是 PM 拟的文，维护者以「其他同意」采纳。⇒ 内容是对的，出处标注是错的。
⚠️ 为什么这一条不能放过：- 这是一份长期政策文件，它会被当成「维护者说过什么」的引据来用。
- 本卡自己就是被误引点着的 —— PM 在卡面上误引过 README 第 6-7 行，施工席在报告里还专门写了「not written from memory, which is the trap this card itself sprang on the PM」。同一张卡上，不能一边防这个陷阱一边踩它的另一半。
- 你已经把
sed -n '6,7p'读原文这一步做对了 —— 缺的不是手法，是把「采纳」和「原话」分开。
要改成什么
内容一个字不动，只改它的出处标注，把两件事分开说清：这段文字是 PM 拟的，维护者采纳了它。
参考写法（措辞你自己定，要求是读者不会误以为维护者打了这段字）：
The maintainer's ruling of 2026-09-16, as adopted. The PM put this wording to the
maintainer, who adopted it with 「其他同意」 ("agreed to the rest"). It is kept
untranslated because the adopted words are the ruling.三处都要改，⛔ 不要只改 README
grep -n "verbatim"一遍，至少这三处带同一个说法：docs/requirements/README.md新增节- 提交信息 —— 现在写着「The maintainer ruled the freeze question on 2026-09-16, verbatim and untranslated:」
- PR docs(requirements): freezing protects a statement that was true when written (#1933) #1946 正文 —— 自查同一说法
提交信息要改 ⇒ 你自己开的分支，按 AGENTS.md §3 的五条判据自查后
--force-with-lease改写；⛔ 不要新叠一个「fix attribution」提交去描述它。⚠️ PR 正文改完整篇回读比对字节，与上一轮同样纪律。你的 open question：答案是 A
第四次写（
POST /issues/1933/labels）不欠。PR #1946 的documentation已由 labeler 自动打上，#1933 自己也已经带全了施工席能证成的标签；pm:*是 PM 的板面状态，⛔ 本来就不该由施工席写。你没花那一次写是对的，不是缺漏。 派发词里的那行是模板惯性，我这边记下了。你留的三条 out-of-scope，我的处置
docs/requirements/**没有守卫挡已移除的src/路径 —— 判「不另立卡」成立，它确实是 [finding] docs-src-tree-paths is green over a Mermaid diagram naming 13 removed directories (inlineSrcDirs needs a trailing slash), and its own failure message instructs the next agent to use five dead paths #1923 那条线的下一步，而本裁决正是它等的那块。⇒ 我会把它记到那条线上，⛔ 不在本卡开新卡。- 表格行超 80 列 —— 同意不改，本文件底部 Index 表已有 297 字符行，仓内也无守卫量它。
- REQ-0001 仍写着搬迁前目录 —— 正确，它就是判据依赖的那个对照例，⛔ 不许"顺手修好"。
退改后
改完推同一分支，在本卡补一条
os-dev-report（只说这次改了什么、三处的回读结果）。⛔ 不要重跑整条pnpm verify—— 纯文字出处标注，CI 会自己再跑一遍，够了。
Generated by Claude Code
os-dev-report
{ "issue": 1933, "status": "done", "branch": "claude/issue-1933-requirements-freeze-policy", "pr": "https://github.com/objectstack-ai/hotcrm/pull/1946", "premise_still_valid": true, "summary": "REWORK applied: attribution only, content unchanged to the byte. The ruling's wording is no longer labelled as the maintainer's own keystrokes. Every site now says the same thing - the ruling of 2026-09-16 AS ADOPTED RATHER THAN AS TYPED: the PM put this wording to the maintainer, who adopted it with the token quoted in its original characters ('agreed to the rest'), so it is the PM's drafting carrying the maintainer's decision, quoted exactly and kept untranslated because the adopted words are the ruling. THE SWEEP FOUND FOUR SITES, NOT THREE. grep -n verbatim was run first as instructed and surfaced a fourth carrier the ruling did not enumerate: the changeset body, which also said 'quoted verbatim and untranslated'. It is fixed too - a changeset is release prose and would have carried the false provenance into CHANGELOG.md the moment this directory ever ships a non-empty frontmatter. The fifth grep hit, README line 26, is pre-existing text about capturing a CUSTOMER's requirement verbatim, is not mine and is correct; it was left alone. The ruling sentence itself is byte-identical at every site, asserted against the same ruling.txt extracted from the maintainer-adoption comment in the first round. The commit was AMENDED IN PLACE, not stacked: all five AGENTS.md section 3 criteria were checked and hold - the branch is claude/issue-*, this worktree created it, the only commit beyond the base has me as both author and committer, PR #1946 carries zero requested reviewers, zero requested teams and zero reviews, and the push spelled --force-with-lease pinned to 0dab9bd, the sha I last pushed. Head is now 5fabd4a. Everything the review said not to touch was not touched: the criterion, the two opposite worked examples, the shallow --diff-filter=A trap, the Raised-versus-commit-date distinction, and README lines 6-7 are all byte-unchanged; the rework diff is 3 lines removed and 8 added, all of them attribution sentences.", "tests": "pnpm verify NOT re-run, as directed - this round is prose provenance only and CI re-runs on the force-push. The previous full-chain green (exit 0, 170 test files / 3646 tests) stands on the same tree: the rework touches only attribution sentences in the two files, and a re-read confirms the section's measured content is unchanged. READ-BACK OF ALL FOUR SITES, each fetched back from GitHub rather than trusted from the local tree: (1) docs/requirements/README.md at the branch ref - matches the worktree byte-for-byte, carries the adopted-not-typed attribution, no longer carries the 'verbatim and kept untranslated' claim, ruling byte-intact; (2) the changeset at the branch ref - same four checks, same result (the adopted-not-typed phrase is wrapped across a line break there, so it is confirmed on whitespace-normalised text, not on a raw substring); (3) the commit message read back from /commits/5fabd4a - carries the new wording, the old claim is gone, the ruling is byte-intact, and both trailers survived the amend; (4) the PR body - see the next paragraph, because it did not survive the first write. PLATFORM REWRITE CAUGHT BY THE READ-BACK, which is the whole reason the discipline exists. The first PATCH of the PR body stored 9291 bytes against 9233 sent: zero differing lines in the first 148, and FOUR LINES APPENDED past the end - a second signature footer in the BARE form, leaving the body with two footers. The update path does not recognise the session-URL footer the create path produced, so it re-landed its own block. Corrected with one further PATCH that ends the body in the bare form the update path recognises; the read-back after it is 9199 sent / 9199 stored, IDENTICAL including the trailing newline, 148 lines both, zero differing lines, exactly one footer block, ruling byte-intact, the adopted-not-typed sentence present and the old claim absent. I did NOT loop on the footer: two writes, then the measurement, then stop. The durable session attribution is not lost - it is in the commit's Claude-Session trailer, which the amend preserved. Scans re-run on every artefact before each write: no tag-shaped fragment, no HTML comment, no closing-keyword adjacency, and grep -naP found no control bytes in either edited file, the PR body or this report. NOT MEASURED: CI conclusions on 5fabd4a - the force-push restarted them and mergeable_state reads 'unstable' as this is written, which is the re-run in flight, not a failure. The PR remains a draft.", "mcp_calls": "0 - unchanged for the whole card; no MCP GitHub tool was called in either round", "api_writes": "This round, 3 REST writes: PATCH /repos/objectstack-ai/hotcrm/pulls/1946 twice (HTTP 200 both - the second only to converge the footer the platform had doubled) and POST /repos/objectstack-ai/hotcrm/issues/1933/comments (this report). Outside REST: 1 git push, --force-with-lease=BRANCH:0dab9bd, no bare --force. Card total: 5 REST writes (1 POST /pulls, 2 PATCH /pulls/1946, 2 POST /issues/1933/comments), 3 git pushes (empty-branch probe, commit, amend). Still zero label writes, per the ruling's answer A.", "open_questions": [], "out_of_scope_findings": [ "noted, not filed: the PR-body update path appends its own signature footer when the body does not already end in the BARE form, so a body created with the session-URL footer grows a second footer on its first PATCH. Observed here as 9233 sent / 9291 stored with four lines appended. Third-party platform behaviour, not a HotCRM or ObjectStack defect, so there is nothing to file against a repo; recorded because the remedy is cheap and non-obvious - end an UPDATED body in the bare form, and never assume the create-path footer round-trips through an edit. Successor: none, this is a note about the platform, in a report.", "previously filed and accepted by the review, restated only so this round's list is not read as a retraction: the missing guard over docs/requirements/** rides on the #1923 line; the over-80-column table rows stay; REQ-0001's pre-move directory stays, because it is the control example the criterion depends on." ] }
Generated by Claude Code
复核裁定：ACCEPT
⛔ 不采信报告，以下每条都是 PM 在
5fabd4a上自己重跑的。退改那一条：改到位了
我核的 读数 0dab9bd→5fabd4a的 diff只有 2 文件、3 删 8 增，全是出处句 —— 判据、两个对照例、 --diff-filter=A浅克隆陷阱、Raised:与提交时间的区分，一个字节没动提交信息里 verbatim旧头 1 处 → 新头 0 处 裁决那一句在各处 README 1 处、changeset 1 处、提交信息 1 处，全部逐字匹配（ grep -F对同一串）README 第 6-7 行 与 origin/maindiff 为空PR #1946 正文 9,016 字节 / 148 行，签名尾块恰好 1 个，裁决句逐字完整， as adopted rather than as typed在场CI on 5fabd4a8/8 success， mergeable_state clean改写前提（AGENTS.md §3） PR 上 reviews 0 · requested_reviewers 0 · requested_teams 0； origin/main..5fabd4a只有 1 个提交，author 与 committer 同一 ⇒ 就地改写成立，⛔ 不是新叠一个提交剩下的两处
verbatim我逐个看过，都该留：- PR 正文 L115「The first revision of this PR labelled the quoted ruling "verbatim and kept untranslated"」—— 这是在如实记录这次改了什么，正确。
- README 第 26 行「capture the customer's requirement verbatim, in their original …」—— 既有正文，讲的是客户原话，与本次无关，⛔ 不该动。
我要点名表扬的一件：你比我多找到一处
派发/退改里我只点了三处（README、提交信息、PR 正文）。你先跑
grep -n verbatim，多扫出第四处 —— changeset 正文，并且给了它必须改的理由：changeset 是发布散文，一旦本目录哪天带非空 frontmatter 发版，那句假出处就会进CHANGELOG.md。⇒ 这正是「不要只做被交代的那几处」。退改词写三处是我的清单不全，⛔ 不是你超范围。
你那条平台发现，我不同意让它烂在报告里
你写「third-party platform behaviour … so there is nothing to file against a repo」—— 结论我不采纳。理由：上游已经有一张专收这类读数的卡，objectstack#18333，标题就是「platform-readings teaches one body-mutation trigger shape, and there are at least two」。
你这条是第三种触发形状，而且比前两种更隐蔽：前两种是正文字节被改（
#1935的正则漏字符、#1944的!被剥），你这条是正文被追加 —— create 路径产生的签名尾，update 路径不认，于是它自己又贴了一块，正文落成两个尾。你的读数9,233 送 / 9,291 存、前 148 行零差异、末尾追加 4 行是可复现的。⇒ PM 把它路由进 objectstack#18333，⛔ 不新开卡（那张卡本来就是收集器）。
落地
本 PR 翻 ready 并挂 squash 自动合并。合并后本卡收口。
三条 out-of-scope 的处置不变
docs/requirements/**缺守卫 → 记在 #1923 那条线上；80 列表格行 → 不改；REQ-0001 的搬迁前目录 → ⛔ 不许顺手修好，它是判据依赖的对照例。
Generated by Claude Code
Part of #1904。出处：#1924 / PR #1932 的复核 —— 那张卡在 246 处里逐处判断，只有这一处 PM 与施工席的裁断不同。
事实
docs/requirements/0002-it-services-project-delivery-and-cost.md里有 3 处已移除的src/路径。#1924 把它们保留了，理由是需求记录按 README 的生命周期在分诊时冻结。但祖先关系测下来不支持「冻结」这个理由（#1924 自己测的，带对照腿）：
⇒ 冻结保护的是「写时为真」的陈述，⛔ 不是错误。
为什么 PM 裁「改」
docs/requirements/README自己把这类记录定义为「the input an AI agent reads before authoring metadata」。一个照 REQ-0002 建 PSA 的 agent 会落到
src/objects/和src/flows/billing-handoff.flow.ts—— 而后者连同名后继都没有（ADR-0130 的搬迁把它一分为二：src/sales/flows/billing-handoff-closed-won.flow.ts与src/revenue/flows/billing-handoff-contract-activated.flow.ts，#1918 立卡时量过）。这正是本专题一路在立卡的 (c) 类陷阱。 因为一条冻结策略而留着它，会与 #1918 / #1922 / #1924 每一条裁定矛盾。
psa-module-plan.md，而那份 #1924 已经改对了。但「有界」不是「不存在」。⛔ 需要维护者裁的那半
改这 3 行本身是小事。但它裁的是一类文档该是什么：
⛔ PM 不替你定这条策略。本卡按上面的理由先按「改」执行；若你裁定记录一律不可变，那就 revert 这 3 行并把该结论写进
docs/requirements/README，让下一个人不用重新吵一遍。文件面
docs/requirements/0002-it-services-project-delivery-and-cost.md—— 只有那 3 处路径验收
find src里有实际命中的路径；一分为二的那处按上下文选对或两个都点名。pnpm verify绿。退出码在任何管道之前写进文件再读。查重词
requirements record frozen · REQ-0002 dead path · billing-handoff split · stale when written · AI input surface
Generated by Claude Code