Repository navigation
Commit 1a02ef1
pm-dispatch: reconcile the quota rows with the identity-bound rate limit; merged-write rule; account-suspension recovery readings (#18242)
Fixes #17374
Second half of the shared-identity rate-limit card. The first half (PR
#17860, landed as `ed8dea17b`) placed expectations 1 and 4 — the
identity-bound rate-limit rows in `references/rest-channel.md` and the
destroyed-evidence NOT MEASURED line in `.claude/agents/os-dev.md`;
expectation 5 is met by the half-state patrol's H40 row. This PR lands
what was deferred behind same-file serial: expectation 2 (merged
writes), expectation 3 (the account-suspension recovery steps as
readings), the reconciliation of the two quota rows that still
prescribed the same-identity channel switch, and the reviewing seat's
NOT MEASURED line. With this the card's five expectations are all
placed. F5 (GitHub App / machine users) is the maintainer's
infrastructure decision and not this card's; the disciplines here hold
independently of it.
Clause-②: no — no published `skills/**` file moves; no operator or
contract semantics.
skip-changeset — nothing published moves (`.claude/**` and
`scripts/pm/**` sit outside every package's `files[]`).
## What changed — 4 files, +60 / −7, head `694b1d2` on base `b3b43b6`
### `references/platform-readings.md` — 454 → 459 (+5 under the standing
one-file exception)
Two quota-block rows re-conditioned in place (line-neutral; they pay
nothing and buy nothing):
- 「限流、403、传输失败都要试过另一侧才说得出我没手段。」 → 「403 与传输失败要试过另一侧才说得出我没手段;限流先比身份,同 ID
的他侧不是手段。」 (114 B)
- 「⇒ MCP 限流先探 REST 再定退避,⛔ 不据一侧限流把整个平台的写都停掉。」 → 「⇒ MCP 限流先 `GET /user` 比
ID:同 ID 的 REST 满额不是退路,写排队到重置;异 ID 才是。」 (109 B)
Until this PR both rows told a seat to do the exact same-identity
channel switch that `rest-channel.md`'s identity-bound rows (landed by
the first half) forbid. The 403 and transport halves stay as they were:
those are per-side readings, and the row above them (「任一侧的拒绝只是那一侧的读数」)
is untouched. Reads are untouched too — the row below (「MCP
的读限流与写限流彼此独立」) still governs them, and the identity test is itself a
read on the other side. 「写排队到重置」 points at the standing
queue-into-the-patrol-word row (:159) rather than restating it.
Five new rows after the retry-alignment row (the end of the
quota-exhaustion prescriptions), one measured event per row, each under
120 B:
1. 「停用报文 account was suspended 遍及 /rate_limit 与 git,不给理由;非会话门 403、非限流。」
(108 B) — the recognition reading: the third 403 shape beside the
session gate and the rate limit, which is what tells a seat the four
steps below now apply.
2. 「账号停用销毁其名下 PR、卡与评论;分支与 commit 属仓库照留远端 ⇒ 代码从未真丢。」 (112 B) — F3 step 1.
3. 「被销毁的 PR 仍占分支名:API 答 404,同名开新 PR 仍被拒 ⇒ 同批 commit 推新分支名再开。」 (114 B) —
F3 step 2.
4. 「本地对象库是最后备份:复核时 fetch 过的每条分支,其 head 在停用后仍在本地可推。」 (110 B) — F3 step 3.
5. 「重建 PR 正文自报四件:head 逐字节同、无 rebase/amend/squash、数字出自旧基底、CI 为准。」 (113 B)
— F3 step 4.
Dedup table for the exception (候选/落地/已有/拒收): candidates 5 / landed 5 /
already present 0 / refused 0. The family grep `suspended`, `停用`, `销毁`,
`幽灵`, `重推`, `重建`, `对象库`, `分支名` on `origin/main` at `b3b43b6` hits only
the Routine-rebuild rows (:445–:446, :453), the issue-transfer rebuild
row (:144) and the landing criterion (:366); none carries any of the
five, and the later suspension-row family the dispatch word anticipated
does not exist on `origin/main`.
Ratchet: ceiling 454 → 459 in `scripts/pm/check-skill-line-ratchet.mjs`,
with a FIFTEENTH `ruledRaises` record citing the standing exception
verbatim — 「唯一例外:`platform-readings.md` 增量抬上限到落地行数,免决策卡,记 `ruledRaises`
引常设裁决。条件:席位验收评论逐条核实、去重计数(候选/落地/已有/拒收)、一事一行、不计重排」 — and the increment
accounted for line by line beside the ceiling. The cross-file-move
arithmetic re-derives unchanged (`+11 against a net source decrease of
20`).
### `SKILL.md` 〈平台读数纪律〉 — 812 → 812 (equal-line, paid by density)
Added as the section's last line, beside the pre-dispatch `rate_limit`
read:
- 「写少而大:同卡同轮结论合成一条评论,⛔ 不放慢单笔、不攒着一次性发;写量按身份计。」 (117 B)
Paid by folding the two maintainer-abort lines into one:
「维护者中止只在有显式信号时成立:原话,或宿主回报 stopped by the user。」 + 「⛔
不据推断立一道没有重启条件的门;判据是信号不是症状。」 → 「维护者中止只认原话或宿主回报 stopped by the user,⛔
不据推断立无重启条件的门。」 (108 B). Every operative clause survives (explicit signal
only; no inference-built gate without a restart condition); 「判据是信号不是症状」
is the first clause said twice. `references/core-rules.md` :46 already
digests this pair in one line, so the mirror is unchanged (151 / 151).
A2 measured on `b3b43b6`: `grep -c '合并\|少而大\|节流' SKILL.md` counts 0
lines in the write-merging sense — every 合并 hit is merge-queue /
merged-PR vocabulary — against control `限流` 3 lines. The quota rows in
`platform-readings.md` (:103–:105: the per-minute secondary limit, the
~1 s spacing between mutations, the same-second burst that hits the
minute wall) answer the BURST half of the card's shape and not the MERGE
half: nothing on the seat surface said fewer-and-larger, and nothing
said not-slower. The dev side already carries a merged budget
(`os-dev.md` 写预算四笔); the seat side now carries this line.
### `references/review-checklist.md` 〈测试与门禁证据〉 — 77 → 77 (equal-line,
paid by density)
- 「复核项证据已销毁(评论、卡或 PR 答 404)⇒ 记 NOT MEASURED 并写因,⛔ 不记通过或无旗。」 (113 B) —
directly under the INCONCLUSIVE row, so the reviewer's verdict
vocabulary now has all three: INCONCLUSIVE (the positive control
failed), NOT MEASURED (the evidence is destroyed), 不入账 (a dead-tree
reading).
A5 measured: `grep -c 'NOT MEASURED\|销毁\|404'` on `review-checklist.md`
and on `contract-review.md` at `b3b43b6` = 0 and 0 (control
`INCONCLUSIVE` = 2 in review-checklist), so the reviewer had no line to
read; the first half's line lives in the dev's file. Paid by folding the
dead-code deletion pair (:75–:76) into 「以死代码或不可达为由的删除,PM 先在
`origin/main` 用带引号精确名核引用面,再 ACCEPT。」 (113 B): the rule survives whole
and the deleted half (「这是断言不是 diff 里的事实,而这一查只花十秒」) is rationale.
Face note: the claim comment's file surface names
`platform-readings.md`, `SKILL.md` and `core-rules.md`; the dispatch
word's A5 asks for exactly this one reviewer line in
`review-checklist.md` or `contract-review.md`, inside the ratchets, and
this is the one deviation from the claim's list. All 11 open PRs' file
lists were read at 2026-09-15T02:46Z, immediately before this PR was
opened; none touches any file in this diff.
## Acceptance against the card
1. **Positive** (client A refused, client B has quota): the quota
section itself now answers 停 for the same user ID — 「限流先比身份,同 ID
的他侧不是手段」 and 「同 ID 的 REST 满额不是退路,写排队到重置」 — and 「异 ID 才是」 only when `GET
/user` answers a different id. Measured on this container: `GET /user`
on the REST credential answers `os-zhuang` id 277994282, the same login
as the card's assignee, so PM and dev are one identity in this seat —
exactly the case the rule is for.
2. **Negative control** (normal-quota writes unaffected): every changed
rule fires only on a refusal, a suspension or a destroyed record; the
new SKILL.md line says 「⛔ 不放慢单笔、不攒着一次性发」 in so many words, so it can
neither slow a write nor push a seat toward the burst shape. No
transport is banned, no 「下次注意」 is written, no green-widening exemption
is introduced — the card's three 「不要走的路」 hold.
3. **Rehearsed recovery**: on record rather than staged. The incident's
own recovery is the rehearsal — PRs #17332, #17334, #17336 and #17339
were rebuilt on new branch names from the same commits with
byte-identical heads, each self-reporting the four items row 5 now
spells. A staged suspension is not something this PR can or should
perform; the five rows are the steps that recovery took, written so the
next seat does not rediscover them.
4. **Ablation** (grep line counts, `origin/main` at `b3b43b6` versus
head `694b1d2`, with a lit control in the same file):
- `platform-readings.md`, pattern 停用 / 销毁 / 新分支名 / 对象库: 0 → 4 (row 5's
term 自报 is excluded because :220 already carries it in another sense;
`自报四件` alone reads 0 → 1); control `限流` 10 → 11.
- `platform-readings.md`, pattern 比 ID / 比身份: 0 → 2; the deleted
instruction 先探 REST / 整个平台的写: 1 → 0.
- `SKILL.md`, pattern 少而大 / 攒着 / 按身份计: 0 → 1; control `限流` 3 → 3.
- `review-checklist.md`, pattern NOT MEASURED / 销毁: 0 → 1; control
`INCONCLUSIVE` 2 → 2.
Remove the new text and the positive case is again answered only by
`rest-channel.md`, with the quota section arguing the other way.
## Mechanism assumptions from the dispatch word, measured
- A1 — confirmed: :123 and :126 on `b3b43b6` prescribed the switch; both
re-conditioned in place as above.
- A2 — measured as above; a rule line was owed, and it lands in
〈平台读数纪律〉.
- A3 — the family grep found no suspension rows on `origin/main`; all
four F3 steps plus the recognition reading were absent and land.
- A4 — recorded under acceptance 3.
- A5 — measured as above; the reviewer line lands in
`review-checklist.md`.
## Gates — head `694b1d2`
`node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack` (no paths; change set taken from git off
merge base `b3b43b6ea`, 4 committed paths) derived 40 commands. 39 of
the 40 ran in the foreground with the exit captured by redirect before
any pipe, and every one exits 0; the 40th is the tool's own self-test,
run detached (below). `--ran` on the exit-carrying record reconciles 40
derived / 40 run / 0 unrun.
- `check:pm-skill-ratchet` (self-test + gate): `cross-file move into
platform-readings.md: +11 (314→459, less 134 lines of ordinary ruled
raise) against a net source decrease of 20` · `declared cross-file
moves: 1, total ceilings down 9 lines`.
- `check:pm-dispatch-gates` (the tool's own self-test, 1723 cases):
detached per its header's foreground-cap warning, waited on in the
foreground with `tail --pid`; verdict line `✓ dispatch-gates self-test:
1723 cases pass.`
- The three lint-package families ran after `pnpm --filter
"@objectstack/lint..." build` under `os-verify-lock.sh` (VERDICT
command-exit 0, held 220 s, waited 0 s).
- `check:pm-skill-id-lint`, `check:skill-frame-sync`, `check:nul-bytes`,
`check:ratchet-remedy-authority`, `check:pm-governed-prose`,
`check:required-contexts`: exit 0.
- Three roster families the derivation marked as sitting under
`scripts/` beside this diff were run in addition:
`check-published-list-mirrors`, `check:pm-label-desc-cap`,
`check-skills-token-ratchet` — all three exit 0.
- Not measured locally, CI's: the 3 workflow-value families, the Test
Core job, the 11 wide-population families, the 14 changeset-pending
families (skip-changeset), the remaining artifact rosters; repo-wide
`pnpm lint` not run.
- Control-byte scan on the four files: 0 hits. No changed line over 120
B in the three markdown files. No card number in any added operative
line.
## Acceptance notes
- noted, not filed (承接者: the skills seat, holder of the same-batch
tension ruling): `platform-readings.md` :97 「⛔ 不据限流报文里的 user ID 推池子跨席共用」
and :143 「报文里的 user ID 只是报文」 stay as written — the ratchet's own record
says both hold pending a discriminating read, and the first half's `GET
/user` comparison is that read (the id in the refusal text names the
identity and says nothing about cross-seat pools), so :143's 「只是报文」
could become 「只标身份」 at equal bytes in a later density pass. Not edited
here because the ruling says neither is.
- noted, not filed (承接者: none): `core-rules.md` 〈平台读数纪律〉 carries no
digest of the new write-merging line; the mirror's own header says it
adds no rules, and the claim conditions a mirror edit on a core clause
moving, which none did.
## 维护者速读(草稿)
**改了什么**:三份 PM 席位的规则/事实文件加一份门禁台账。① 事实表 `platform-readings.md`
配额段:把两条还在教席位「限流了就换另一条通道继续写」的行改成「先比身份,同一身份就停写排队」,并新增五行记下账号被停用时的识别信号与恢复步骤(分支和提交不丢、被销毁的
PR 仍占着分支名要换名重推、本地对象库是备份、重建的 PR 要自报)。② 席位规则 `SKILL.md`:加一行「写少而大」——
同一张卡同一轮的结论合成一条评论,既不放慢单笔也不攒着突发,写入量按身份合计;用合并两行既有规则付账。③ 复核清单:复核项的证据被销毁时记
NOT MEASURED,不记通过;同样以合并两行付账。④ 棘轮台账:`platform-readings.md` 上限 454 →
459,按常设例外记录。
**为什么改**:这是 2026-09-10 整个 fleet
被停用的事故复盘卡的后半。前半已把「限流绑定身份」写进通道表;但事实表里还留着相反的指引,席位照读就会重演事故里的那个动作。恢复流程当时是现场摸索出来的,没写下来下次还要摸一遍。写入合并的口径此前完全空白。
**风险与代价(含回滚)**:纯文本规则与事实,不碰任何发布包,不改 CI 行为。代价是 `platform-readings.md` 多 5
行(每行 ≤120 字节,一事一行),其余三份文件行数不变。回滚 = revert 本 PR 的一个
commit,无迁移。误读风险:「写排队到重置」不是「所有写变慢」,新行已明写不放慢单笔。
**席位意见**:
**你要做的**:审批本 PR(受管面,需要你的 approve
后由席位入队);若认为「写量按身份计」或恢复五行的措辞有误,直接改文字或留言,席位按你的话修。
---
_Generated by [Claude
Code](https://claude.ai/code/session_01HZfg2AwVX191qCizp88gQr)_
Co-authored-by: Claude <noreply@anthropic.com>1 parent 48a93fb commit 1a02ef1
4 files changed
Lines changed: 60 additions & 7 deletions
File tree
- .claude/skills/pm-dispatch
- references
- scripts/pm
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
172 | 172 | | |
173 | 173 | | |
174 | 174 | | |
175 | | - | |
176 | | - | |
| 175 | + | |
177 | 176 | | |
178 | 177 | | |
179 | 178 | | |
| |||
183 | 182 | | |
184 | 183 | | |
185 | 184 | | |
| 185 | + | |
186 | 186 | | |
187 | 187 | | |
188 | 188 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
120 | 120 | | |
121 | 121 | | |
122 | 122 | | |
123 | | - | |
| 123 | + | |
124 | 124 | | |
125 | 125 | | |
126 | | - | |
| 126 | + | |
127 | 127 | | |
128 | 128 | | |
129 | 129 | | |
| |||
158 | 158 | | |
159 | 159 | | |
160 | 160 | | |
| 161 | + | |
| 162 | + | |
| 163 | + | |
| 164 | + | |
| 165 | + | |
161 | 166 | | |
162 | 167 | | |
163 | 168 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
32 | 32 | | |
33 | 33 | | |
34 | 34 | | |
| 35 | + | |
35 | 36 | | |
36 | 37 | | |
37 | 38 | | |
| |||
72 | 73 | | |
73 | 74 | | |
74 | 75 | | |
75 | | - | |
76 | | - | |
| 76 | + | |
77 | 77 | | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
905 | 905 | | |
906 | 906 | | |
907 | 907 | | |
908 | | - | |
| 908 | + | |
| 909 | + | |
| 910 | + | |
| 911 | + | |
| 912 | + | |
| 913 | + | |
| 914 | + | |
| 915 | + | |
| 916 | + | |
| 917 | + | |
| 918 | + | |
| 919 | + | |
| 920 | + | |
| 921 | + | |
| 922 | + | |
| 923 | + | |
| 924 | + | |
| 925 | + | |
| 926 | + | |
| 927 | + | |
| 928 | + | |
| 929 | + | |
| 930 | + | |
| 931 | + | |
| 932 | + | |
| 933 | + | |
| 934 | + | |
| 935 | + | |
| 936 | + | |
| 937 | + | |
| 938 | + | |
| 939 | + | |
909 | 940 | | |
910 | 941 | | |
911 | 942 | | |
| |||
1560 | 1591 | | |
1561 | 1592 | | |
1562 | 1593 | | |
| 1594 | + | |
| 1595 | + | |
| 1596 | + | |
| 1597 | + | |
| 1598 | + | |
| 1599 | + | |
| 1600 | + | |
| 1601 | + | |
| 1602 | + | |
| 1603 | + | |
| 1604 | + | |
| 1605 | + | |
| 1606 | + | |
| 1607 | + | |
| 1608 | + | |
| 1609 | + | |
| 1610 | + | |
1563 | 1611 | | |
1564 | 1612 | | |
1565 | 1613 | | |
| |||
0 commit comments