fix(pm): name the Regen-provenance token in the rule, and one hop on two carriers is one hop

Three things the at-tier review named. (1) The rule line now carries the
literal `Regen-provenance:` token, so a seat reading the governed text
alone can write a line the reader matches; it stays one line at 110 bytes
and the file stays at its ceiling. (2) regenChainToHead de-duplicates hops
on record + from + to BEFORE the ambiguity test: the reader searches both
carriers and the text trains the dual-carrier habit, so one hop posted on
the PR and on its card arrived twice and ended the walk. Two DIFFERENT
hops into one head still do. (3) The queue battery's duplicate specimen
becomes a real slipped-in-edit case, and the path it names is asserted at
the reader that owns the reason.

Claude-Session: https://claude.ai/code/session_01Wnstp2kTth7sGXfr8fXypc
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.claude/skills/pm-dispatch/references/contract-review.md

@@ -18,7 +18,7 @@
 - FAIL 同 PASS 剥双载体:同笔留卡上交接评论(引复审、独立性对、欠改);卡态与 assignee 不动。
 - 重挂前先查裁决:闸门标签缺失 ⇒ 先 grep 卡评论找复审结论;`get_reviews` 读空 ≠ 未复审。
 - PASS + 无标 + head 未动 = 已清标不是被剥;head 后移或无结论才重挂;清标缺引记录即半态。
-- 例外:纯重生成 head 后移原记录继续管;判据机读已提交树 ⛔ 非自述;PR 落 provenance 行。
+- 例外:纯重生成 head 后移原记录继续管;判据机读已提交树;PR 落 `Regen-provenance:` 行。
 
 ## 复核归属与资格(按面)
 

scripts/pm/check-clause2-carriers.mjs

@@ -863,7 +863,7 @@ const SELF_TEST_BATTERIES = Object.freeze({
   '#18862: cross-author LIVE claims with no `Release:` between — the hand-over the protocol never wrote, named; judged only after its effective instant': 52,
   '#16770: the exit-0 line says which carriers agreed — LABEL carriers — and that the PR body was not read': 14,
   '#18892: the claim comment\'s EDIT reading — taken from the two stamps already in hand, reported and never failed': 10,
-  '⭐ the 2026-09-20 ruling: a pure-regeneration head move KEEPS the record, decided on the COMMITTED trees': 23,
+  '⭐ the 2026-09-20 ruling: a pure-regeneration head move KEEPS the record, decided on the COMMITTED trees': 25,
 });
 
 // DELETING an entry silences that battery's floor exactly as effectively as
@@ -3165,7 +3165,15 @@ const shaMeets = (a, b) => a.startsWith(b) || b.startsWith(a);
  * thread carries no chain — the only direction this may err in.
  */
 export function regenChainToHead(pair) {
-  const hops = regenProvenanceHops(pair);
+  // ⭐ DE-DUPLICATED FIRST, on record + from + to. The reader searches BOTH
+  // carriers and the governed text trains the dual-carrier habit, so ONE hop
+  // posted on the PR and on its card arrives here twice — identical bytes, not
+  // ambiguity. Judged by the ambiguity test below it would END the walk and
+  // kill the carry in its most likely shape; two DIFFERENT hops into one head
+  // still do, which is the fact that test exists for.
+  const hops = [
+    ...new Map(regenProvenanceHops(pair).map((h) => [`${h.record}\u0000${h.from}\u0000${h.to}`, h])).values(),
+  ];
   let target = String(pair?.headSha ?? '').toLowerCase();
   if (target.length < H51_SHA_MIN_HEX) return null;
   const chain = [];
@@ -8142,6 +8150,8 @@ export async function selfTest() {
   t('⛔ a line naming only one sha is not a hop — the tail after it is the seat\'s transcript and is unread', regenProvenanceHops({ prComments: [{ id: 9, body: `Regen-provenance: 3301 · \`${HEAD_9AF9}\`` }] }).length === 0);
   t('the chain walks BACK over several hops, oldest first', regenChainToHead({ headSha: 'cccccccc', prComments: [PROV(HEAD_9AF9, 'bbbbbbbb'), PROV('bbbbbbbb', 'cccccccc')] })?.map((h) => h.from).join() === `${HEAD_9AF9},bbbbbbbb`);
   t('⛔ two hops arriving at ONE head carry no chain — ambiguity is never ranked', regenChainToHead({ headSha: NEW_HEAD, prComments: [PROV(HEAD_9AF9), PROV('bbbbbbbb')] }) === null);
+  t('⭐ the SAME hop on BOTH carriers is ONE hop, ⛔ not ambiguity — the dual-carrier habit this file trains must not kill the carry', regenChainToHead({ headSha: NEW_HEAD, prComments: [PROV()], cardComments: [PROV(HEAD_9AF9, NEW_HEAD, 3301, 3351)] })?.length === 1);
+  t('…and it CARRIES end to end from there, so the pair is CLEAN rather than 重挂', (() => { const dual = moved([RECORD_ON_9AF9, PROV()], GIT_EMPTY, { cardComments: [CLAIM('Clause-②: yes'), PROV(HEAD_9AF9, NEW_HEAD, 3301, 3351)] }); return gateBindingState(dual).state === 'completed' && locateReviewOfRecord(dual).state === 'found' && pairRows(dual).length === 0; })());
   t('⛔ a thread with no line carries none, so today\'s rule is untouched where nobody claims the exception', regenChainToHead(moved([RECORD_ON_9AF9])) === null && gateBindingState(moved([RECORD_ON_9AF9])).state === 'moved-after-clear');
   // the tree test — and it reads COMMITTED trees, never the working one
   t('⭐ an EMPTY non-`merge=os-regen` diff CARRIES the record: the pair reads COMPLETED, ⛔ not 重挂', gateBindingState(CARRIED()).state === 'completed');

scripts/pm/check-governed-queue-guard.mjs

@@ -554,7 +554,7 @@ const SELF_TEST_BATTERIES = Object.freeze({
   '⭐ #18701: the record lives on the PR or its card, and BOTH are read': 14,
   '⛔ #19036: the SIZE line at the queue — imported, per queued PR, fail-closed': 30,
   '⭐ #19344: the remedy names a path the ruleset actually offers': 5,
-  '⭐ the 2026-09-20 ruling: a certified PURE REGENERATION carries the record to the queued head': 10,
+  '⭐ the 2026-09-20 ruling: a certified PURE REGENERATION carries the record to the queued head': 11,
 });
 
 // DELETING an entry silences that battery's floor exactly as effectively as
@@ -4459,13 +4459,20 @@ export async function selfTest() {
   const qRegen = { moved: 'packages/spec/api-surface/ui.txt\0', attrs: 'packages/spec/api-surface/ui.txt\0merge\0os-regen\0' };
   const qCarry = { moved: 'packages/spec/api-surface/ui.txt\0AGENTS.md\0', attrs: 'packages/spec/api-surface/ui.txt\0merge\0os-regen\0AGENTS.md\0merge\0unspecified\0', own: {} };
   const qHand = { moved: 'AGENTS.md\0', attrs: 'AGENTS.md\0merge\0unspecified\0', own: { [REF_HEAD]: 'AGENTS.md\0' } };
+  // (ii) an edit SLIPPED IN beside the regeneration: a generated path moved, and
+  // so did one of this pull request's own, which its delta at the NEW head names.
+  const qSlipped = { moved: 'packages/spec/api-surface/ui.txt\0scripts/pm/x.mjs\0', attrs: 'packages/spec/api-surface/ui.txt\0merge\0os-regen\0scripts/pm/x.mjs\0merge\0unspecified\0', own: { [REF_HEAD]: 'scripts/pm/x.mjs\0' } };
   const gitPure = qgit(qRegen);
-  const gitHand = qgit({ ...qHand, own: { [REF_HEAD]: 'AGENTS.md\0' } });
+  const gitHand = qgit(qSlipped);
   const carried = await tierRun({ comments: onOldHead, runGit: gitPure, baseRef: QBASE });
   assert('⭐ a-record-on-an-OLDER-head-CARRIES-when-the-move-is-a-certified-pure-regeneration', carried.exitCode === EXIT_CLEAR && carried.entries[0].record.state === 'stands' && carried.entries[0].record.carriedHops === 1, JSON.stringify(carried.entries[0].record));
   assert('and-the-CLEAR-names-the-head-actually-reviewed-and-says-it-re-ran-on-the-committed-trees', /carried forward over 1 certified PURE-REGENERATION hop/.test(renderGuardVerdict(carried)) && /COMMITTED trees/.test(renderGuardVerdict(carried)) && /never on the `Regen-provenance:` line being present/.test(renderGuardVerdict(carried)), renderGuardVerdict(carried));
   const handMoved = await tierRun({ comments: onOldHead, runGit: gitHand, baseRef: QBASE });
-  assert('⛔ a-HAND-WRITTEN-path-in-the-range-refuses-exactly-as-an-uncarried-old-head-does', handMoved.exitCode === EXIT_REFUSED_UNAPPROVED && handMoved.entries[0].record.state === 'absent');
+  assert('⛔ (ii) an-EDIT-SLIPPED-IN-beside-the-regeneration-refuses-exactly-as-an-uncarried-old-head-does', handMoved.exitCode === EXIT_REFUSED_UNAPPROVED && handMoved.entries[0].record.state === 'absent');
+  // ⭐ WHICH path is named by the reader that owns the reason; at the queue the
+  // refusal surfaces as an absent record, so the name is asserted at its source.
+  const { unexplainedPathsBetween } = await import(RECOGNISER_SOURCES.tier);
+  assert('…and-the-reader-NAMES-the-slipped-in-path-rather-than-the-generated-one-beside-it', unexplainedPathsBetween(gitHand, { from: REF_OLD, to: REF_HEAD, base: QBASE }).join() === 'scripts/pm/x.mjs', unexplainedPathsBetween(gitHand, { from: REF_OLD, to: REF_HEAD, base: QBASE }).join());
   const blindTree = await tierRun({ comments: onOldHead, runGit: () => { throw new Error('fatal: bad object'); }, baseRef: QBASE });
   assert('⛔ a-tree-this-build-cannot-reach-is-UNREADABLE-exit-4-never-clean', blindTree.exitCode === EXIT_REFUSED_UNREADABLE && blindTree.entries[0].record.state === 'unreadable');
   assert('⛔ and-a-run-with-NO-git-reader-refuses-too-the-line-alone-certifies-nothing', (await tierRun({ comments: onOldHead, baseRef: QBASE })).exitCode === EXIT_REFUSED_UNREADABLE);