[hotlong]

No issue: this registers a sibling repository for the PM loop, at the maintainer's direction (quoted below).

What changes

• scripts/pm/check-governed-merges.mjs:
  • GOVERNED_REPOS gains { id: 'mobile', slug: 'objectstack-ai/mobile' };
  • the docblock records why;
  • the two self-test pins that spell the roster move five → six.
  • The scoped workflows row is unchanged, so mobile's EAS workflows are not a governed surface (same as hotcrm). The default-scoped rows (ADRs, .claude/**, skills, AGENTS.md, CLAUDE.md, North Star) now govern mobile too.
• .claude/skills/pm-dispatch/references/lanes/mobile.md (new): the repo:mobile seat charter.
  • The seat is summoned on demand and creates no patrol routine.
  • Business UI stays in the Console; the shell takes native capability only.
  • Console defects found on mobile are filed at objectstack, never worked around in the shell.
  • While a push to main runs eas-build / eas-update, merges in that repo are the maintainer's (AGENTS.md release directive).
  • Device-only acceptance goes to the maintainer and is never reported as verified.
• scripts/pm/ensure-pm-labels.sh: the pm vocabulary loop includes objectstack-ai/mobile. No repo:mobile seam row is added, because no reader exists yet.
• references/project-forms.md: the seat words include mobile.
• references/cross-repo-coordination.md: the single-lane repo list includes mobile.
• scripts/pm/check-skill-line-ratchet.mjs: rows for the new charter (49 lines, 0 table-row bytes), at the landed count.

Why

objectstack-ai/mobile 2.0 is a native shell around the Console (objectstack-ai/mobile#144). Its follow-up cards (objectstack-ai/mobile#145–#148) need a seat to be dispatched. Admission was put to the maintainer as three options; the answer was:

Register, seat on demand (Recommended)

The rationale presented with that recommendation: most follow-up work lands in this repository's existing ui / server lanes (#29039–#29042), so the mobile lane's volume is low and a standing routine would spend budget on an empty queue.

Verification

Run in this branch's worktree, each with its exit code captured before any pipe:

• node scripts/pm/check-skill-line-ratchet.mjs --self-test: 164 cases pass. The gate itself exits 0; it first flagged 7 charter lines over the 120-byte budget, which were wrapped before the pin was set.
• node scripts/pm/check-skill-id-lint.mjs (and --self-test): clean.
• node scripts/pm/check-governed-merges.mjs --self-test: 537 assertions, exit 0. It needs pnpm install first.
• node scripts/pm/check-governed-prose.mjs: exit 0.
• node scripts/pm/post-stamped.mjs --self-test: 753 cases. OWN_REFERENCE_PREFIXES derives from the roster.
• node scripts/pm/check-half-states.mjs --self-test: 5185 cases.
• node scripts/pm/check-label-desc-cap.mjs: exit 0.
• npx eslint on the two changed .mjs files: clean. bash -n scripts/pm/ensure-pm-labels.sh: ok.
• node scripts/pm/dispatch-gates.mjs --self-test: still running when this PR was opened; CI carries it.

Clause-②: no
Metadata-protocol: none

Nothing here publishes: scripts/pm and .claude/** are repo tooling, so there is no changeset.

Landing

Governed surface: .claude/** is Tier S and no Tier H path is touched. This PR is left in draft for its contract-tier review of record. The steps after merge belong to the maintainer:

• install the fleet App on objectstack-ai/mobile;
• run scripts/pm/ensure-pm-labels.sh against it;
• the seat's first summons writes its seat post.

维护者速读

• 改了什么:把 mobile 仓登记进 PM 循环:受管仓名册加一行，新增 repo:mobile 席位宪章（按需召唤、不建巡查 routine），标签词表与席位词同步。
• 为什么改:mobile 已改为宿主 Console 的原生壳，后续卡要靠 pm-dispatch 派发；你选了「登记、按需召唤」。
• 风险与回滚:只动 PM 工具与 .claude/**，不碰产品包；回滚即还原本 PR。mobile 的 EAS workflow 不纳入受管面。
• 先看:references/lanes/mobile.md 的「常设承诺」，尤其是「main 上 push 触发 EAS 期间合并归你」这一条。
• 两分钟验证:node scripts/pm/check-governed-merges.mjs --self-test 与 node scripts/pm/check-skill-line-ratchet.mjs，两者都应退出 0。
• 需要你做的:按 Tier S 走达档复核后落地；合并后在 mobile 仓安装车队 App，再对它跑一次 ensure-pm-labels.sh。

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (not touched)
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes on the changed files.
• 4. One issue, one branch off an up-to-date main, one pull request. (no issue; branch off main from today)
• 5. A change that publishes carries a changeset. (nothing publishes)
• 6. packages/spec touched: n/a.
• 7. No hand edits to generated or release-owned docs.
• 8. Title, body and comments are in English. (the 维护者速读 block is the maintainer's channel)

---

Generated by Claude Code

[hotlong]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: a3b6d392f52e90bad3d4cc97952f55510eb67e9a
Local-runs: none
Scope: .claude/skills/pm-dispatch/references/cross-repo-coordination.md, .claude/skills/pm-dispatch/references/lanes/mobile.md, .claude/skills/pm-dispatch/references/project-forms.md + scripts/pm/check-governed-merges.mjs (GOVERNED_REPOS, GOVERNED_SURFACES, the five→six self-test pins), scripts/pm/ensure-pm-labels.sh, scripts/pm/check-skill-line-ratchet.mjs, scripts/pm/check-skill-id-lint.mjs, scripts/pm/fleet-roster.mjs (DEFAULT_REPOS), .claude/settings.json (per-repo allow rows), .claude/skills/pm-dispatch/SKILL.md, references/seat-lifecycle.md, references/lanes/hotcrm.md, references/decision-analysis.md, AGENTS.md (Prime Directives 14 and 15), and in objectstack-ai/mobile at the mobile#144 head (5d2707f) and its main (53bde47): .github/workflows/eas-build.yml, eas-update.yml, eas-submit.yml, ci.yml, lint-typecheck.yml, docs/HYBRID-SHELL.md, .changeset/, package.json

① Derived judgments

1. GOVERNED_REPOS gains mobile. The unscoped rows (docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md, docs/NORTH-STAR.md) now govern mobile, and the scoped rows (workflows, ui-*) do not. That reading is RIGHT. One correction: .claude/** carries tierRepos: ['objectstack'], so in mobile it is Tier H, not Tier S.
2. mobile's .github/workflows/** is not a governed surface, yet those workflows are mobile's publish mechanism. RIGHT as a derivation, WRONG as a resting state. Escalated in ③.
3. Nothing in mobile is governed today. Neither its main nor the 🔗 Broken links detected in documentation #144 head holds any governed path. RIGHT, and the same shape as hotcrm.
4. The self-test pins six-governed-repos-declared and all-six-repos-are-resolved-not-just-the-self-repo are correct, with mobile resolving UNAUDITED. RIGHT.
5. The other readers of GOVERNED_REPOS (queue guard wording, half-states H43, check-owed-reviews, dispatch-gates sister-repo functions, post-stamped OWN_REFERENCE_PREFIXES) now answer for mobile. RIGHT.
6. ensure-pm-labels.sh creates the 14 loop labels in mobile, but not pm:seat: that row is objectstack-only, even though the hotcrm precedent keeps its seat posts in hotcrm. WRONG by omission (S4).
7. project-forms.md now resolves the seat word mobile. RIGHT, but its line 26 contradicts the charter (M1).
8. cross-repo-coordination.md adds mobile to the single-lane list. RIGHT, but line 3's dependency direction is not extended (S7).
9. Ratchet rows: 49 lines, widest line 117 bytes, no table rows, id-lint clean. RIGHT.
10. fleet-roster.mjs DEFAULT_REPOS lacks mobile, so the fleet board will not list the seat. WRONG by omission (S4).

② Semver level

Nothing publishes, so skip-changeset is correct. The Check Changeset failure ran before the label was applied; the later labeled run skipped. Clause-②: no and Metadata-protocol: none are correct.

③ Boundary flags

• Author login hotlong; commit author "Claude"; not a fork; draft; +76 / −9 across 6 files.
• Tier S in objectstack; no Tier H path. A check was still in progress at review time, so the head was not landable even on a PASS.
• Release directive (PD15): verified that eas-build.yml and eas-update.yml fire on push to main in mobile, both at the 🔗 Broken links detected in documentation #144 head and on main. Not handled:
  • (a) eas-submit.yml is not named.
  • (b) mobile is outside the workflows row, so a seat PR that edits eas-*.yml is ungoverned, and the charter's maintainer-merge line expires once the workflows go manual.
  • Escalate to the maintainer as a decision on the workflows row's scope.
• Write identity: .claude/settings.json allow rows are per-repo and mobile has none. Neither the diff nor the landing steps mention it.
• Ruling provenance: the maintainer's choice exists only as a PR-body quotation, with no card or comment id.
• Ordering: every shell fact the charter asserts is true at the 🔗 Broken links detected in documentation #144 head and false on mobile main. The landing order must be stated (S3).

④ Design judgment

lanes/mobile.md

• M1 — must-fix. "本席不建巡查 routine,队列清空即退席" contradicts four standing rules, each of which names the director seat as its only exception:

  • SKILL.md line 72 (project seats wake by PR subscription plus a self-bound patrol routine, director excepted);
  • project-forms.md line 26;
  • seat-lifecycle.md line 39 (taking the seat creates the patrol routine);
  • seat-lifecycle.md line 86 (an empty queue means standby, not exit).

  A summoned seat resolves that conflict to the stricter rule, so the maintainer's choice is not delivered. The charter's exit condition also narrows SKILL.md's four-part self-exit. Fix: amend SKILL.md line 72 and project-forms.md line 26 in place to admit an on-demand seat, and have the charter use the four-part self-exit and open and close its mailbox per summons.

• S1. The charter claims 落地 (landing) for the seat, but merges in mobile are the maintainer's. The seat's window should end at ACCEPT plus hand-off.

• S2. Console defects are blocked in mobile with no unlock criterion. The criterion should be a released platform version reachable by the configured server, not a merge.

• S3. The charter needs an ordering line (summon the seat only after the shell rewrite lands), or the PR must state its landing order.

• S4. The seat-post location is unspecified. Following the hotcrm precedent means adding pm:seat in mobile and adding mobile to DEFAULT_REPOS.

• S5. The release inventory omits eas-submit.yml, and "配置了 EXPO_TOKEN 时" is a condition no seat can read, because secrets are unreadable. Make the rule unconditional.

cross-repo-coordination.md

• Against its registration checklist: the seat post (S4), labels (S4) and the release inventory (S5) are incomplete, and the write-identity transplant is not addressed (S6).
• S7. Line 3's dependency direction and decision-analysis.md line 46's app-repo list both omit mobile.

project-forms.md

• Part of M1.

Cited code

• S8. Comments in check-governed-merges.mjs and ensure-pm-labels.sh that state the current roster still say "five", and hotcrm.md still says "五仓统一".

Implemented-by: claude/cool-volta-azu3gs
Reviewed-by: session_01Q4EjjRHkJgnuLkU9vVgHHR

VERDICT: FAIL

---

Generated by Claude Code

[hotlong]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 33e1e9cdf374b923bdad3c67bb0a98dcd4277f1a
Local-runs: none
Scope: .claude/skills/pm-dispatch/SKILL.md, .claude/skills/pm-dispatch/references/cross-repo-coordination.md, .claude/skills/pm-dispatch/references/decision-analysis.md, .claude/skills/pm-dispatch/references/lanes/hotcrm.md, .claude/skills/pm-dispatch/references/lanes/mobile.md, .claude/skills/pm-dispatch/references/project-forms.md, .claude/skills/pm-dispatch/references/seat-lifecycle.md + scripts/pm/check-governed-merges.mjs, scripts/pm/ensure-pm-labels.sh, scripts/pm/check-skill-line-ratchet.mjs, scripts/pm/fleet-roster.mjs, scripts/pm/check-label-desc-cap.mjs, scripts/pm/check-half-states.mjs (H70), scripts/pm/check-skill-id-lint.mjs, AGENTS.md Prime Directives 14 and 15, objectstack-ai/mobile at the mobile#144 head and its main

① Derived judgments

Delta 33e1e9c is the only commit on top of a3b6d39. Every judgment in the first record still holds. The delta changes the following:

1. pm:seat is now created in mobile, 15 labels in all. RIGHT.
2. DEFAULT_REPOS lists mobile. The fixture batteries iterate fixture.repos, so no fixture row is owed. RIGHT.
3. The on-demand exception is added to SKILL.md lines 72 and 75, project-forms.md line 26 and seat-lifecycle.md line 86. Each stays within its file's line ceiling and under 120 bytes. RIGHT.
4. The ratchet row for mobile.md is 55, measured at 55 lines with a widest line of 118 bytes, and the file is new against main. RIGHT.
5. The header prose of check-governed-merges.mjs now says six. The remaining "five" at line 112 is historical. RIGHT.
6. check-half-states H70 (a held pm:seat with no Patrol: line) would flag the routine-less on-demand seat. WRONG by omission (S9).

② Semver level

Unchanged. Nothing publishes, skip-changeset is applied, and Check Changeset was skipped on this head. Clause-②: no and Metadata-protocol: none are correct.

③ Boundary flags

• Author hotlong, not a fork, draft. 117 additions and 38 deletions across 11 files. Seven .claude/** paths, all Tier S, and no Tier H path.
• Checks were still in progress when this record was written, so the head is not landable on this record until every check is green.
• The charter treats all three EAS workflows as release acts and keeps every mobile merge, workflow PRs included, with the maintainer. That is an adequate compensating control while the question of the workflows row's scope stays open.
• The workflows row's scope for mobile and S6 (the .claude/settings.json allow rows) are left to the maintainer. Neither leaves a must-fix in this diff.
• Ordering is resolved by the charter's precondition line, so this PR may land before mobile#144.

④ Design judgment

Findings from the first record: M1 RESOLVED; S1, S2, S3, S4, S5 and S7 RESOLVED; S6 escalated to the maintainer and accepted; S8 RESOLVED except one leftover "Five-repo loop" at ensure-pm-labels.sh line 217 (trivial).

New findings:

• S9 — should-fix. H70 and seat-lifecycle.md line 39 still assume every held seat records a Patrol: line, so the on-demand mobile seat would trip H70. H70 is report-only. Fix by either:
  • having the charter state what an on-demand seat records instead, or
  • excluding on-demand seats in the gate.
• S10 — should-fix, minor. The term 按需席 is used in SKILL.md but defined only in lanes/mobile.md. Define it at SKILL.md's 席位两形 line or in project-forms.md.

Nothing the delta touches breaks against the code it cites.

Implemented-by: claude/cool-volta-azu3gs
Reviewed-by: session_01Q4EjjRHkJgnuLkU9vVgHHR

VERDICT: PASS

---

Generated by Claude Code

[hotlong]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 41a35b30f7726cbd829af66361d798f4c46f3ddf
Local-runs: none
Scope: .claude/skills/pm-dispatch/SKILL.md, .claude/skills/pm-dispatch/references/cross-repo-coordination.md, .claude/skills/pm-dispatch/references/decision-analysis.md, .claude/skills/pm-dispatch/references/lanes/hotcrm.md, .claude/skills/pm-dispatch/references/lanes/mobile.md, .claude/skills/pm-dispatch/references/project-forms.md, .claude/skills/pm-dispatch/references/seat-lifecycle.md + scripts/pm/check-skill-line-ratchet.mjs, scripts/pm/ensure-pm-labels.sh, scripts/pm/check-half-states.mjs (H70, directiveValues, hasPatrolLine), scripts/pm/record-recognisers.mjs (PATROL_REF), references/seat-post-protocol.md

① Derived judgments

Delta 41a35b3 is the only commit on top of the PASS head 33e1e9c: 11 files, +119 / −39 net against main.

1. The charter now has the seat stub record Patrol: none — 按需席. H70 reads it through hasPatrolLine, which checks presence only, so the line clears H70. The seat-online vocabulary in record-recognisers already admits patrol none. RIGHT, with no gate change needed.
2. project-forms.md line 26 now defines 按需席 as a seat its lane charter declares on demand. RIGHT.
3. ensure-pm-labels.sh no longer contains "five". RIGHT.
4. Ratchet rows measured at the head:
   • lanes/mobile.md is 56 lines against a ceiling of 56;
   • every other touched file sits at its ceiling;
   • no non-table line exceeds 120 bytes, and there are no issue citations. RIGHT.

② Semver level

Unchanged. Nothing publishes, and skip-changeset applies.

③ Boundary flags

• Unchanged from the previous record.
• Checks on this head were still in progress when this record was written, so the head is not landable on this record until the required set is green.

④ Design judgment

• S8 residue: RESOLVED.
• S9: RESOLVED on the charter side.
• S10: RESOLVED.
• Two nits for a later density pass, not findings:
  • the PATROL_REF comment in record-recognisers names only the director as a seat without a patrol;
  • the stub template on line 66 of seat-post-protocol.md does not mention 按需席.
• Nothing the delta touches breaks.

Implemented-by: claude/cool-volta-azu3gs
Reviewed-by: session_01Q4EjjRHkJgnuLkU9vVgHHR

VERDICT: PASS

---

Generated by Claude Code

[hotlong]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 93fb90c370cb93375ce26c2d86cdf9f5b364f4bb
Local-runs: none
Scope: .claude/skills/pm-dispatch/SKILL.md, .claude/skills/pm-dispatch/references/cross-repo-coordination.md, .claude/skills/pm-dispatch/references/decision-analysis.md, .claude/skills/pm-dispatch/references/lanes/hotcrm.md, .claude/skills/pm-dispatch/references/lanes/mobile.md, .claude/skills/pm-dispatch/references/project-forms.md, .claude/skills/pm-dispatch/references/seat-lifecycle.md + scripts/pm/ensure-pm-labels.sh (the pm:seat rows, the gh reconcile wrapper, the loop forms), scripts/pm/check-label-desc-cap.mjs (parseDescriptions, loopValues, expand, and the self-test cases over the real file), the Lint · repo & tooling gates job log on 41a35b3, and everything read for the three earlier records

① Derived judgments

Delta 93fb90c is the only commit on top of 41a35b3 and touches only scripts/pm/ensure-pm-labels.sh. The net diff against main is 11 files, +123 / −40.

1. The created label set is unchanged. The two literal pm:seat lines (objectstack, mobile) become one line inside a loop over both repos, with the same colour and the same 94-character description. The script still issues the same two invocations, in the same order. UNCHANGED.
2. The gate's rationale holds. check-label-desc-cap requires the number of distinct invoked descriptions to be at least the number of parsed lines. Two identical lines collapsed to one distinct description, and that reproduces the case that failed in the 41a35b3 job log. The loop gives one parsed line with no variable in its description. The file now has 46 create lines, each with a distinct description. The rationale HOLDS.
3. Correction to the record chain: the two earlier PASS records read Lint · repo & tooling gates as in progress on 33e1e9c and 41a35b3. In fact it concluded failure on both, on this one case. Neither head was landable. This head is the first on which that gate can go green.

② Semver level

Unchanged. Nothing publishes, and skip-changeset applies.

③ Boundary flags

• Unchanged.
• The required checks had not yet completed on this head when this record was written. The head is not landable on this record until the required set is green, Lint · repo & tooling gates included.

④ Design judgment

The seven governed prose files are untouched since 41a35b3, so every judgment of the previous record stands:

• M1 and S1–S10 are resolved;
• S6 and the workflows row question remain escalated to the maintainer.

The loop holds against the gate it answers, its comment states the gate's reason correctly, and nothing else moves.

Implemented-by: claude/cool-volta-azu3gs
Reviewed-by: session_01Q4EjjRHkJgnuLkU9vVgHHR

VERDICT: PASS

---

Generated by Claude Code

[hotlong]

Maintainer rulings on the two escalations from the contract reviews

The maintainer ruled both escalations in-session on 2026-11-02, after reading a four-axis analysis from the decision framework. Their choices, verbatim:

1. Should the workflows row cover mobile?

   B: don't add (Recommended)

   The register is not extended, so GOVERNED_SURFACES workflows stays scoped to objectstack, objectui and cloud.

   • Basis: the 「新增门禁默认否」 rule, and no ruling names mobile.
   • The charter line that keeps every mobile merge, and every PR touching mobile's .github/workflows/**, with the maintainer remains the control.
   • Re-open condition: the maintainer names mobile for the row.

2. S6: per-repo allow rows for mobile in .claude/settings.json

   A: reads + PATCH (Recommended)

   Implemented in 3ace753:

   • mobile gets hotcrm's read rows, POST labels, PATCH pulls/* and PATCH issues/*;
   • it deliberately gets no ccr/ready_for_review and no ccr/auto_merge;
   • the deny list is unchanged.

   A delta contract review on that head is in progress.

---

Generated by Claude Code

[hotlong]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 3ace75316f9e24bfda005ea0620cf35d1d4f663a
Local-runs: none
Scope: .claude/settings.json, .claude/skills/pm-dispatch/SKILL.md, .claude/skills/pm-dispatch/references/cross-repo-coordination.md, .claude/skills/pm-dispatch/references/decision-analysis.md, .claude/skills/pm-dispatch/references/lanes/hotcrm.md, .claude/skills/pm-dispatch/references/lanes/mobile.md, .claude/skills/pm-dispatch/references/project-forms.md, .claude/skills/pm-dispatch/references/seat-lifecycle.md + scripts/pm/check-settings-deny-roster.mjs, scripts/check-settings-bind-window.mjs, scripts/pm/check-harness-current.mjs, scripts/pm/check-governed-merges.mjs (claude-tree row), scripts/pm/check-governed-queue-guard.mjs (SETTINGS_PATH), scripts/pm/label-write.mjs, scripts/pm/dispatch-gates.data.mjs, scripts/check-doc-authoring.mjs, AGENTS.md Prime Directive 14, and everything read for the four earlier records

① Derived judgments

Delta 3ace753 is the only commit on top of 93fb90c and touches only .claude/settings.json. The net diff against main is 12 files, +135 / −41.

1. Rows, read from the parsed file:

   • hotcrm has 13 allow rows;
   • mobile has 11, which are hotcrm's set minus exactly the two ccr rows (ready_for_review, auto_merge);
   • mobile minus hotcrm is empty.

   That matches the ruled set: reads, POST labels, PATCH pulls and PATCH issues. RIGHT.

2. The JSON parses. RIGHT.

3. The deny list's 17 entries are untouched. check-settings-deny-roster reads only permissions.deny. RIGHT.

4. The other readers of settings.json are either unaffected or describe the file only in prose. No gate pins the number or content of the allow rows. HOLD.

5. On the previous head 93fb90c, every check-run completed with success or skipped. That is the first fully green head of this PR.

② Semver level

Unchanged. Nothing publishes, and skip-changeset applies.

③ Boundary flags

• There are now eight .claude/** paths, settings.json included, all Tier S. There is no Tier H path.
• Checks were still in progress or queued when this record was written. The head is not landable on this record until the required set is green.
• Escalations closed by the maintainer's rulings on 2026-11-02 (recorded on this PR):
  • S6: "A: reads + PATCH (Recommended)". This commit implements it exactly.
  • The workflows row: "B: don't add (Recommended)". The register is not extended, and the charter line that keeps mobile merges and mobile workflow PRs with the maintainer is the control of record.
• The new rows widen only the raw REST allowlist for a mobile seat:
  • MCP write tools stay denied;
  • no row lets a seat take a mobile PR out of draft or arm auto-merge.

④ Design judgment

• The seven governed prose files are untouched since 41a35b3, and every earlier judgment stands.
• The settings.json change holds against every piece of code that reads it.
• Nothing breaks.
• Informational, not a finding: a seat that is already seated keeps the copy of the file it read at start, so the mobile seat's first summons after merge should be a fresh session.

Implemented-by: claude/cool-volta-azu3gs
Reviewed-by: session_01Q4EjjRHkJgnuLkU9vVgHHR

VERDICT: PASS

---

Generated by Claude Code