[PM seat] domain:engine — 🟢 os-musk

[hotlong]

⚠️ This post is the RECORD of state, not the state. Every round, re-read the labels. Never read the counts here as current.

📌 Job description is versioned at .claude/skills/pm-dispatch/references/lanes/engine.md. ⛔ Not hand-copied per term.

1. Current PM — 🟢 os-musk

session session_01ADLdAs2pVcH17h9tZKWMBg · GitHub login os-musk · seated 2026-09-07T09:20Z via /pm-dispatch engine, an explicit maintainer summons · round R18 (marker 5568381001).

⚠️ Seated WITHOUT a shift-end brief. The predecessor (session_01ARYe3yQTQCUFm5qPYNgKaJ) never signed off; its last lane act was the #14273 dev report at 2026-09-07T01:32Z, ~7.8h before this fire. The four mutex readings are recorded in full on marker 5568381001 — ⛔ read them there rather than trusting this line.

Standing parameters, carried forward: in-flight ceiling 5 (maintainer 2026-09-03, 「任务很多，并发保持5」). Devs AND isolated review subagents both count. ⛔ A Clause-② dispatch must leave a slot free for its reviewer.

⛔⛔ THIS SEAT IS OFF CONTRACT_REVIEW_TIER — but the tier IS reachable. These are two different facts and the predecessor's post conflated them.

CONTRACT_REVIEW_TIER = claude-fable-5-1 (scripts/pm/dispatch-gates.mjs:10023, read on origin/main this fire). get_session returns session_context.model claude-opus-5 and last_served_model claude-opus-5 ⇒ ⛔ no clause-② PR is reviewed in-seat.

⭐⭐ MEASURED THIS FIRE, and it retires the predecessor's standing blocker: an Agent dispatch passing model: fable does run at tier from this session. Transcript grep of a review subagent returned "model":"claude-fable-5-1" on 9 of 9 messages, and no 429 occurred. The predecessor's three-hour "tier exhausted" episode of 2026-09-04 was its own session's quota and ⛔ does not carry to this one. ⇒ Clause-② work is dispatchable and reviewable from this seat, via isolated model: fable subagents.

⛔⛔ Do NOT fuse-check a subagent with get_session — it CANNOT answer, and it cost a review round this fire

references/contract-review.md:54 states it: inside mode:subagent, get_session measures the dispatching session, ⛔ never the subagent, so it can only ever return a false "off tier". A reviewer was dispatched at tier, told to fuse-check itself with get_session, correctly read claude-opus-5 (this seat's model) and correctly refused to review. The instrument, per contract-review.md:56, is the seat grepping the subagent transcript for the harness-stamped model field after the fact. ⛔ Never put a get_session fuse in a subagent prompt.

⛔ Session channel: direct REST is UNAVAILABLE to this session — MCP only

GET /repos/objectstack-ai/objectstack/issues/9857 through the agent proxy answers HTTP 403: "GitHub access is not enabled for this session. An org admin must connect the Claude GitHub App for this organization." The per-session REST probe is spent. ⚠️ A fact about this session's channel, ⛔ not about the repo or the token — dev subagents in this same session have been reporting successful REST writes, so ⛔ do not generalise this to them.

2. Ledger — current values, 2026-09-07T10:0xZ

origin/main = ce8caba9 at last read. ⚠️ It moved twice inside this one fire (0344f40 → ce8caba9); ⛔ re-fetch before any tree claim, and treat dispatch-gates.mjs's STALE TREE warning as load-bearing.

In flight — 3 of 5

target	card	surface
contract review (model: fable, isolated)	#16024 / PR #16376	clause-② verdict on the driver-turso timeout / localPath / wasm disposition
os-dev (opus, mode:subagent)	#16434	driver-sql live-cell test budget — vitest.config.ts and/or per-it
os-dev (opus, mode:subagent)	#16289	sql-driver.ts hash-shadow NULL-safe arm → formatDuplicateGroups

State corrections made this round — each paired with a comment in the same stroke

• [finding] Sweep: which consumers compare or format a value whose runtime type differs between the Date-materialising drivers and the ISO-text ones #13973 → pm:queue (H19 release). ⛔ Not released on "the blocker closed": released on what the hold was ABOUT. The shared canonical-ISO normaliser turns an Invalid Date from a driver into a 500, where String() served text #14078's NaN guard was verified present in every named spelling on origin/main (protocol.ts:1730, sys-metadata-repository.ts:152/:205, rest-server.ts:774/:838, database-loader.ts:94/:150, landed by PR fix(metadata-protocol,metadata,rest): a total Date arm on the shared canonical-ISO spelling — all five arms at once #16427), and the hold's second limb — The shared canonical-ISO normaliser turns an Invalid Date from a driver into a 500, where String() served text #14078's fix half carrying pm:retriage — is spent. 放行双查 both answered on the card.
• sum over a column that is NULL in every row of a group: driver-sql answers null, the engine's in-memory aggregate tier answers 0 — same query, same rows, fork chosen by a driver capability bit #15546 → needs-user-decision with a full four-facet block and a 「维护者速读」. ⭐ This seat came within one write of dispatching it and was wrong. emptyGroupValueFor does NOT settle it: the domain:cli seat measured (5546222185) that the policy's scope ("a database reports that group by omitting the row entirely" — an empty row set) points one way while its rationale (objectui#3136, a blank hiding the number a compliance dashboard exists to show) points the other. Three seats had already said the ruling is the maintainer's; the request to route it had sat 2 days.
• driver-sql: store the file family (file / image / avatar / video / audio) as the bare sys_file id in a string column — drop FILE_REFERENCE_TYPES from JSON_COLUMN_TYPES, per-deployment switch on the adr-0104-file-references flag (ruling on #15041, step 2) #15989 → pm:blocked + Blocked-by: #16185, assignee cleared with a Release: line. It was pm:queue with a live assignee (H24) and pm:queue was the wrong half anyway — its own comment said 「pm:queue here does NOT mean dispatchable」.
• [ADR-0049] @objectstack/driver-turso publishes three config keys nothing reads — timeout on the TS interface, localPath and wasm on the zod schema #16024 — assignee set (was pm:dispatched with none).
• [finding] ResolvedAuthzContext.authRefusal has zero transport readers — both #8287 refusal reasons collapse to the generic anonymous 401 on every wire #14273 — verified clean: closed completed, no pm:* residue. ⛔ Nothing owed.

⚠️ Triage gap this seat cannot close, raised in the round report

#16185 / #16184 / #16183 — the three pieces #15989 was split into on 2026-09-06T04:57Z — are still ungraded (no domain:*, no pm:*, no priority:*) two days on. They are inside triage's sweep disjunction ① by construction. ⛔ This seat does not grade. One of them (#16183) is the sole carrier of a measured data-loss defect in a merged ADR (ADR-0104 step 3's Postgres retype does not abort on a non-string cell), which is why it is restated on #15989 as well.

3. Hot-file serial queue — 2026-09-07T10:0xZ

⭐⭐ READ THIS BEFORE THE CLAIM, NOT AFTER.

• packages/drivers/driver-sql/src/sql-driver.ts — HELD by driver-sql: the hash-shadow NULL-safe arm still hand-rolls duplicate-group formatting, the drift formatDuplicateGroups exists to prevent #16289 (in flight). Queue behind it, serial.
• packages/drivers/driver-sql/vitest.config.ts + live-cell it budgets — HELD by [finding] driver-sql's live PG + MySQL matrix runs under vitest's default 5000ms — the only live-DB driver in the repo with no testTimeout, and it just dequeued an unrelated PR #16434 (in flight). ⚠️ Disjoint from driver-sql: the hash-shadow NULL-safe arm still hand-rolls duplicate-group formatting, the drift formatDuplicateGroups exists to prevent #16289 by file surface; fold-or-serial was answered SERIAL-and-independent on claim 5568559811 (gate ① fails — different defect shape, different fix). ⚠️ They interact in TIME: a live-cell timeout on driver-sql: the hash-shadow NULL-safe arm still hand-rolls duplicate-group formatting, the drift formatDuplicateGroups exists to prevent #16289's PR is diagnosed against [finding] driver-sql's live PG + MySQL matrix runs under vitest's default 5000ms — the only live-DB driver in the repo with no testTimeout, and it just dequeued an unrelated PR #16434 first, ⛔ never as a flake.
• packages/drivers/driver-turso/** — HELD by PR feat(driver-turso)!: timeout bounds remote operations; localPath and wasm leave the published config schema (ADR-0049 enforce-or-remove) #16376 (awaiting contract review). ⚠️ TursoDriverConfig.timeout has no seam on the WebSocket transport (wss:// / ws://) in @libsql/client 0.17.4 — documented as unbounded, not delivered #16378 (pm:queue, p3 — timeout has no seam on the wss:///ws:// transport) is the same file surface and was filed BY that PR. ⛔ Do not dispatch TursoDriverConfig.timeout has no seam on the WebSocket transport (wss:// / ws://) in @libsql/client 0.17.4 — documented as unbounded, not delivered #16378 until feat(driver-turso)!: timeout bounds remote operations; localPath and wasm leave the published config schema (ADR-0049 enforce-or-remove) #16376 lands.
• packages/objectql/src/engine.ts — free of in-flight work. ⚠️ sum over a column that is NULL in every row of a group: driver-sql answers null, the engine's in-memory aggregate tier answers 0 — same query, same rows, fork chosen by a driver capability bit #15546 would have landed near the aggregate fork (:13816) and is now in the decision box, so it holds nothing.
• packages/objectql/src/in-memory-aggregation.ts, packages/spec/src/data/aggregation-*.ts — free, and both are frozen behind the sum over a column that is NULL in every row of a group: driver-sql answers null, the engine's in-memory aggregate tier answers 0 — same query, same rows, fork chosen by a driver capability bit #15546 ruling. ⛔ No PR may pin the current sum divergence in either direction while it is undecided (Platform half of server-side list-view grouping: pin the compiled group-header and row-page queries through the existing POST /data/:object/query door (driver-sql + in-memory) #15330's pin deliberately does not; that restraint binds).

4. Notes — platform facts and lane disciplines that are current

• ⭐⭐ A rate-limit error is evidence about the CALLER, never about the resource. Re-proved this fire from the other side: the predecessor's post declared the tier a standing blocker; this session reached it on the first try. ⛔ Never inherit a capacity fact — measure it.
• ⭐⭐ packages/spec is another lane, and it does not become mine by being needed. sum over a column that is NULL in every row of a group: driver-sql answers null, the engine's in-memory aggregate tier answers 0 — same query, same rows, fork chosen by a driver capability bit #15546's third deliverable (a nullable aggregand in aggregation-conformance.ts) is a domain:spec card whichever way the ruling goes. Same for anything the decision box hands back.
• ⭐⭐ A closed blocker is a prompt to check, never the answer. Read what the conversion comment made the wait ABOUT, then verify THAT against the tree. [finding] Sweep: which consumers compare or format a value whose runtime type differs between the Date-materialising drivers and the ISO-text ones #13973's release this round rested on the guard being in the tree, not on The shared canonical-ISO normaliser turns an Invalid Date from a driver into a 500, where String() served text #14078's state.
• ⭐⭐ The exported-name set answers "did an export move", ⛔ never "did the surface move". Three instances now (fix(core): plugin startup elapsed time is durationMs, the unit-bearing name its spec contract declares #16057, [ADR-0049] @objectstack/driver-turso publishes three config keys nothing reads — timeout on the TS interface, localPath and wasm on the zod schema #16024, [finding] ResolvedAuthzContext.authRefusal has zero transport readers — both #8287 refusal reasons collapse to the generic anonymous 401 on every wire #14273): a member added to or removed from an exported type leaves the name set unchanged. A member-level reading is owed every time.
• ⭐⭐ engine.ts / sql-driver.ts / protocol.ts line anchors move constantly. Measured again this fire: triage's sum over a column that is NULL in every row of a group: driver-sql answers null, the engine's in-memory aggregate tier answers 0 — same query, same rows, fork chosen by a driver capability bit #15546 anchor engine.ts:13493 had drifted to :13816. ⛔ Re-derive every anchor by symbol on your own head; ⛔ never reason from a number in a card, a brief, or this post.
• ⭐ A zero-hit grep is not a result without a positive control that fires. Used twice this fire (the The shared canonical-ISO normaliser turns an Invalid Date from a driver into a 500, where String() served text #14078 guard sweep; driver-sql: the hash-shadow NULL-safe arm still hand-rolls duplicate-group formatting, the drift formatDuplicateGroups exists to prevent #16289's pin-asserts-only-the-prefix reading, controlled by 24 expect( calls in the same file).
• ⭐ Hand the dev the measurement, not the question, when you already took it. driver-sql: the hash-shadow NULL-safe arm still hand-rolls duplicate-group formatting, the drift formatDuplicateGroups exists to prevent #16289's card made "check whether the pin asserts the tail" the round's first job; measuring it at dispatch turned an open question into a shaped deliverable (the change is invisible to the existing pin, so coverage must be extended).
• ⭐ A dispatch premise handed over as Zone 2 gets falsified by the dev; one asserted as Zone 1 ships. When unsure, it is Zone 2.
• ⭐ A cross-seat request must be a CARD in the target lane's queue — a seat-post knock or a ruling comment is invisible to that lane's candidate query and sweep.
• Semver: envelope on a published verb ⇒ minor · new public-entry export ⇒ minor · published type narrowing ⇒ minor + BREAKING + adr-0087: · envelope on an existing refusal / accept-set widening ⇒ patch · repairing an implementation that silently violated its own already-published declared type ⇒ patch · comment-and-test-only ⇒ skip-changeset. ⛔ major refused by check-changeset-no-major.mjs. ⚠️ The WHICH LEVEL prose in pr-automation.yml still says "no check computes it"; that is stale — the LEVEL AXIS in check-changeset-no-major.mjs does compute the coupled clause-② + patch case.
• Readings: list_issues labels is OR and never returns assignees · issue_read get_labels refuses a PR number while issue_write update on it succeeds · issue_read get returns closed_by_pull_requests, the cheapest way to see a closing keyword · the PR side runs the AFFECTED subset while the queue build runs the FULL suite, so a PR green on its head can still eject · list_pull_requests at perPage: 50, get_files on a large PR and get_job_logs at tail_lines: 450 all EXCEED the tool token cap · issue_read get_comments on a busy card also exceeds it — page it at perPage: 3–8 · dispatch-gates.mjs with NO path argument derives the change set from git off the merge base and that derivation is authoritative over any hand-listed set.
• Governed surfaces (docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md): draft-only. ⛔ Never flip ready / enqueue / arm auto-merge on own judgment; ⛔ never approve from an agent seat. packages/spec/** is not governed — that is lane ownership, a different question.

[baozhoutao]

Seat takeover: domain:metadata.

• GitHub account: baozhoutao
• Session: session_01KDU3qAuJyajAQm3GkUXdfA
• Seated via: maintainer invocation /pm-dispatch metadata (seat was listed ⏳ vacant, awaiting maintainer assignment per the sticker body)
• Same-stroke updates (three-element pairing): title → [PM seat] domain:metadata — 🟢 baozhoutao, assignee → baozhoutao, body "当前 PM" section updated. Body is authoritative.

Posture on arrival: per the sticker body, this seat does not dispatch until the inventory migration (triage seat's MOVE/STAY/FLAG audit out of domain:engine-core) is recorded complete. I will verify migration state next; until it is complete this seat runs standby duties only (queue watch, blocked-unlock sweep, no claims, no dispatches).

---

Generated by Claude Code