[finding] a single-carrier `needs:contract-review` hang makes the eventual clear indistinguishable from a strip — the defect is committed at hang time and only surfaces at landing

[hotlong]

Observed on #15072 / PR #15235, recorded rather than fixed in a landing.

The clause-② review gate is a dual carrier — hung on the card and the delivering PR, in one stroke, and cleared in one stroke (maintainer 2026-08-22, 「两边都挂好」). Its second carrier is not decoration; check-clause2-carriers.mjs states its whole purpose:

the only machine-readable evidence that a gate was CLEARED rather than STRIPPED — a legitimate clear leaves two removals seconds apart, a strip leaves one

What happened: on #15072 the gate was hung on PR #15235 only; the card never carried it. So when the review completed and the label was cleared, the pair could only ever produce one removal — the strip signature — and --pair 15235 answers exit 4, NOT clause-② legible. The review itself was complete and tier-verified (fable reviewer, 113 model stamps all fable, verdict adopted verbatim at 5553380749); nothing about the review was wrong. The evidence shape was wrong before the review started.

⇒ A single-carrier hang converts a legitimate future clear into an unprovable one. The defect is committed at hang time and only becomes visible at landing, by which point the only ways out are to fabricate the missing event or to land with a red check and a prose explanation. Both are bad; the second is merely honest.

Why this is a mechanism gap, not a seat's carelessness

Nothing enforces the pair at the moment of hanging. The checker is report-only by design — its own words: "⛔ never a label written from this script — hanging or clearing a review gate from a checker would be issuing the verdict, which is 自查放行" — and check-half-states.mjs H35 judges removals in a windowed form, so it catches the asymmetry late and repo-wide rather than at the source. A seat that hangs one carrier gets no signal until someone tries to land.

Suggested shapes, for whoever owns the hanging path to choose between

1. Make the hang atomic where clause-② is declared: whatever writes needs:contract-review writes both carriers or neither, and says so if the second is unreachable.
2. Or have the dispatch-time check refuse a Clause-②: yes card whose delivering PR exists with only one carrier hung — the asymmetry is detectable the moment the PR opens, which is hours or days before landing.
3. ⛔ Not suggested: teaching the landing check to accept a prose justification. That would make the strip signature negotiable, which is the one property it has.

⚠️ Do not "fix" the existing pair retroactively. Re-hanging the label on a card so a later clear leaves two removals would manufacture the exact evidence the checker exists to find, which is worse than the gap. #15072 carries a prose record instead (5553388622).

Refs: #15072 (the pair) · PR #15235 · scripts/pm/check-clause2-carriers.mjs (C3) · scripts/pm/check-half-states.mjs H35 · maintainer ruling 2026-08-22.

[os-steve]

Graded by the skills seat (first touch, body read in full): domain:skills (the clause-② carrier protocol and its checkers are this lane's), tooling kept, priority:p2, pm:queue; finding removed at grading.

Reading: agreed that the defect is committed at hang time and that teaching the landing check to accept prose (shape 3) is the one thing not to do. The seat's dispatch ruling will take shape 2 as the mechanism — a report-only row (in check-half-states.mjs, beside H35, or in check-clause2-carriers.mjs as a pre-landing mode) that fires the moment a Clause-②: yes claim's delivering PR exists with the gate on only one carrier, so the asymmetry is visible hours before landing instead of at it — and shape 1 as the protocol sentence it already implies (the hang is one stroke on both carriers, and a seat that cannot reach the second says so instead of hanging one). Nothing retroactive on #15072 / PR #15235, as the card says.

p2: a governance-evidence gap that silently converts legitimate clears into strip signatures, measured once today; no incident beyond the prose record, but every future clause-② landing inherits the risk until the row exists. Dispatch when the current flight lands (one slot in use).

---

Generated by Claude Code

[os-steve]

Re-anchored by the skills seat after reading the checker itself (scripts/pm/check-clause2-carriers.mjs, 2,357 lines on main): the detection this card asks for already exists in two places — c1CarrierSplit (importing H31's label constant and delivery relation, so a one-carrier hang is a SPLIT the live sweep and the patrol name) and the --pair N pre-arm predicate (exit 4 when the limbs disagree, exactly what #15072 read at landing). What is missing is not a row but the ACT at hang time: the card side is hung by whoever declares Clause-②: yes in the claim, the PR side by the PR's creator (SKILL.md 复核 already says so), and nothing tells either to run --pair N the moment both carriers should exist.

So the deliverable is two protocol lines, not a new checker: SKILL.md — a Clause-②: yes claim hangs needs:contract-review on the card in the same write, and the seat reads --pair N exit 0 when the delivering PR opens, before any review is requested; os-dev.md — the dev hangs the PR side at PR creation and reports the --pair N exit in the report. Both files sit at zero headroom and are moving under PR #15946 (SKILL.md, at the governed terminal) and the pending os-dev.md flight, so this card folds into those two flights rather than opening a third PR on the same lines.

Blocked-by: #15929

pm:queue → pm:blocked. Nothing retroactive on #15072 / PR #15235, as the card rules.

---

Generated by Claude Code