A timestamp a seat writes into GitHub must come from the clock read by the same act that writes it — make an estimated stamp unspellable (helper token and/or a report-only patrol row), after two recorded ~1h mis-estimates

[os-justin]

Split out of #17308 (its third item) by the skills seat at first grading (session_01MoTv7pn338AZ71owsp19gQ, 2026-09-10T05:5xZ); the two platform facts stay on #17308. ⛔ Filed as a mechanical item, not a discipline line: the same failure is recorded twice on the triage seat post (R+164 「轮次计时全靠感觉,错了约 4 倍」, then R+165: ~70 minutes off, ~15 audit comments stamped with an estimated time), with a "measure it next time" remedy between them that did not hold.

The invariant to make mechanical

Every timestamp a seat writes into a GitHub comment or body (the <sub> reading time, the YYYY-MM-DDThh:mmZ on claims, dispatches, verdicts, round reports and seat-post edits) must come from a clock read by the same act that writes the text — never from the seat's sense of elapsed time. The protocol already requires the stamp (「板面/树/队列读数恒带 UTC 取数时刻」); what is missing is that an ESTIMATED stamp has a spelling today.

Shape (the dev picks the smallest mechanism that removes the spelling; both halves are candidates)

1. Write side — a scripts/pm/ helper that posts a comment / edits a body and substitutes a {{NOW}} token with date -u +%Y-%m-%dT%H:%MZ taken in the same call (REST via GH_TOKEN, the channel every seat has); the seat writes the token, never the time. Dispatch prompts and the seat-post protocol then say: stamps are tokens.
2. Read side — a report-only check-half-states.mjs row (H56) that compares a comment's stamped time to its created_at and lists stamps off by more than a stated tolerance (e.g. 15 min), so a hand-typed estimate is visible on the anchor rather than trusted.

Acceptance: the helper (if built) has a self-test; the row (if built) has a fixture pair (on-time / off-by-70-min) and renders on the anchor; references/platform-readings.md or the seat-post protocol names the mechanism in one line; no discipline prose is added.

---

Generated by Claude Code

[os-justin]

Claim: skills seat, session session_01MoTv7pn338AZ71owsp19gQ (GitHub os-justin), 2026-09-10T06:37Z — this seat's own split card (from #17308's third item), dispatched into the round's free slot.

• Session: session_01MoTv7pn338AZ71owsp19gQ
• Branch: claude/issue-17314-stamped-timestamps
• Worktree: /home/user/objectstack-issue-17314, cut from origin/main 501959b72a1c
• Domain: domain:skills — governed surface (scripts/pm/**; .claude/** only if the pointer line fits)
• File surface (region-declared): a new scripts/pm/ helper (+ its self-test) that substitutes a {{NOW}} token with the clock read in the same call when posting a comment or editing a body over REST; optionally a report-only H56 row in scripts/pm/check-half-states.mjs (+ fixtures) comparing a comment's stamped time to its created_at; one pointer line in references/seat-post-protocol.md ONLY if it fits net-zero (91/91) — else the pointer is deferred to this seat. ⛔ Not references/platform-readings.md (PR docs(pm-dispatch): three measured container readings into the platform table (419 to 422) #17317 at the terminal), ⛔ not .claude/skills/pm-dispatch/SKILL.md (PR pm-dispatch: a metadata project's cards, decisions included, live in its own repo; only platform problems are filed on objectstack/objectui #17315 at the terminal; the :163–:165 timestamp rule stays as written).
• Container & model: S/M, mode:subagent, build tier = default (scripts/pm/** carries no path mandate; --tier prints none), review = skills-seat self-review at the contract-review tier.
• Clause-②: no — seat tooling; no accept set or public surface widens.
• Thread-read: card body; 0 comments at claim time.
• Serial constraints: no open PR touches scripts/pm/check-half-states.mjs or a new helper path (open PR file lists read 2026-09-10T06:37Z; only PR docs(pm-dispatch): three measured container readings into the platform table (419 to 422) #17317 touches platform-readings.md, excluded above); Delete the published skills/objectstack-pm-dispatch skill — a stale three-state copy of the internal PM protocol with no known consumer, shipped into every new app — and retire its catalog row, docs page, frame-sync copy, tier-table entry, ratchet pins and gate fixtures (maintainer ruling 2026-09-10) #17311's dev (parallel) owns scripts/check-*.mjs, scripts/pm/dispatch-gates.mjs, scripts/pm/check-governed-merges.mjs — disjoint. H17: no hold names these files (index rows name os-verify-lock.sh and dispatch-gates.mjs only).
• Premise checks: action face git log -4 on check-half-states.mjs read 2026-09-10T06:37Z (newest 8efe2753, H55); work-item face: no comment-posting helper exists under scripts/pm/ today (listing read 2026-09-10T06:37Z); seat-post-protocol.md 91/91 measured.

---

Generated by Claude Code

[os-justin]

Dispatched — R9, 2026-09-10T06:38Z, mode:subagent, default build tier (scripts/pm/**, no path mandate), skills-seat review at the contract-review tier. Claim 5614267277 is the dev's identity; branch claude/issue-17314-stamped-timestamps. Disjoint from #17311 (in flight) and from the two PRs at the terminal (#17315, #17317). Terminal decided by check-governed-merges --test on the actual diff: governed ⇒ draft + four-piece; pure scripts/pm/** ⇒ seat review → ready → queue.

---

Generated by Claude Code

[os-justin]

os-dev-report

Reported 2026-09-10T07:26Z — this comment was written by scripts/pm/post-stamped.mjs itself, which is this card's acceptance in one act: the stamp above came from the clock this invocation read, and the read-back below is the proof.

{
  "issue": 17314,
  "status": "done",
  "branch": "claude/issue-17314-stamped-timestamps",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/17326",
  "premise_still_valid": true,
  "summary": "Both halves landed, because neither alone removes the spelling. WRITE SIDE: scripts/pm/post-stamped.mjs posts a comment or rewrites a card body over REST with GH_TOKEN, substituting the NOW token with a clock read in the SAME invocation (two tokens in one body get one stamp), with the WAS token as the only other spelling — a declared quoted reading, contents validated as exactly one stamp so it is not a free-text escape. Three refusals, no flag turns them off: POSITIONAL (a bare stamp on the opening line or a subscript reading-time line), MIXED (the token plus a bare stamp elsewhere — the case the card names), UNKNOWN (a token surviving substitution, so a mistyped a mistyped NOW token cannot post literally and leave the artefact unstamped). The positional one is NOT the mixed one widened: mixed alone never fires on a seat that simply never types the token, which is every comment in the recorded failure. Then it reads the artefact back and prints id, url, the platform's own write time, the drift against it, and a byte comparison of the stored body — proof, not assumption. READ SIDE: H56 in check-half-states.mjs, report-only, band state (H44's band — H44's class one field over: a reading that cannot be dated, and one whose date is wrong). It reads exactly H44's corpus and buys no request, placed after H44's loop and before H46 so the two censuses describe one population. Two false-positive sources closed: a minute-grained stamp is widened to its own minute (otherwise every correctly stamped comment files a row), and an edited comment is judged against the whole created_at..updated_at window. A line with more than one stamp is HELD OUT and counted, never guessed at, so rows are a lower bound and the census says by how much. The two sides import ONE stamp definition, ONE position reader and ONE tolerance from check-half-states.mjs, so they cannot come to disagree. PM assumptions: A confirmed (no posting helper existed under scripts/pm/); B confirmed (H55 modelled: predicate, fixture pair, census clause, band); C PARTLY FALSIFIED — check-self-test-wired.mjs skips any script no workflow names (`if (!named.has(script)) continue;`), so it does not by itself require every scripts/** file to be wired; wired anyway by convention (package.json + a lint.yml step), and check:pm-dispatch-gates did NOT exceed the foreground cap, it completed detached in about 5 min, exit 0; D confirmed but with one constraint the dispatch did not carry — the ratchet also enforces a 120-byte PER-LINE budget, which is what shaped the pointer's wording; E band chosen: state, argued against the other three.",
  "tests": "node scripts/pm/post-stamped.mjs --self-test -> exit 0, verdict line: '✓ post-stamped self-test: 68 cases pass across 6 batteries — offline, no network, no token.' | node scripts/pm/check-half-states.mjs --self-test -> exit 0, '✓ check-half-states self-test: 3171 cases pass.' (3103 before this change; +68 for H56, including the on-time / off-by-70-min fixture pair the card asks for). | pnpm check:pm-dispatch-gates -> exit 0, '✓ dispatch-gates self-test: 1674 cases pass.' (run detached, then reaped with tail --pid). | node scripts/check-self-test-wired.mjs -> exit 0, '✓ ... every one of the 200 script(s) CI runs that ship a --self-test has that self-test run by CI.' | REFUSALS demonstrated live, exit code captured before any pipe: a bare opening-line stamp -> exit 2 '[positional] the opening line carries the bare stamp ...'; token + bare stamp elsewhere -> exit 2 '[mixed] ... a reader cannot tell which'; the token form -> exit 0 dry run, one clock substituted and the quoted stamp rendered verbatim. | node scripts/pm/check-governed-merges.mjs --test <5 paths> -> exit 3, verbatim: '⛔ GOVERNED — a human merge is the review record for this PR (#9495 regime)', on .claude/** x1; it also prints 'paths not on the register: .github/workflows/lint.yml, package.json, scripts/pm/check-half-states.mjs, scripts/pm/post-stamped.mjs' — so scripts/pm/** alone is indeed NOT on the register, and the .claude pointer line is what governs this PR. | pnpm lint (repo-wide, eslint . --no-inline-config) -> exit 0 on the final commit 0e9f0fd93; no narrowing claimed and none needed. | ABLATION: not applicable and not faked — this PR adds no guard whose failure needs proving by mutation; the equivalent instrument is the refusal set, each member driven by a fixture in the self-test with its own passing control beside it (a bare stamp in ordinary prose stays legal, a declared quoted stamp stays legal), so a weakened refusal reddens the self-test rather than going quiet.",
  "gates": "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran <record> -> exit 0: '74 derived famil(ies) accounted for — 71 run, 3 NOT-MEASURED (3 DERIVED from a recorded exit 3)', 0 UNRUN. Every exit code recorded as '<command> :: exit <code>', each captured before any pipe. The 3 NOT MEASURED are check:dual-build-cjs-loads, check:lean-entry-closure and check:type-check-debt, each exiting 3 PREREQUISITE NOT MET because it loads BUILT output and the workspace is not fully built; each ran its own self-test green first. They are derived from package.json being in the diff, not from any package changing — the diff touches no package source, so no build closure is owed and CI owns them. Derivation was re-run after the final commit and after a fresh fetch; the list did not move. The first derivation (pre-.claude-edit) was 68 families; the skill-file line added 6 more (doc-authoring, doc-formula-expressions, pm-governed-merges, pm-skill-id-lint, pm-skill-ratchet, skill-frame-sync) and all 6 were run green. check:doc-formula-expressions first exited 3 PREREQUISITE NOT MET, was cleared by building @objectstack/formula and @objectstack/lint under scripts/pm/os-verify-lock.sh (VERDICT command-exit 0, held 156s, waited 0s), and then exited 0.",
  "line_budget": ".claude/skills/pm-dispatch/references/seat-post-protocol.md: 91 lines before and 91 after — the pointer was folded into the existing write-side-refresh line (L28) rather than added, so nothing was raised and nothing was bought. check:pm-skill-ratchet exit 0, reading '.claude/skills/pm-dispatch/references/seat-post-protocol.md is 91 lines (ceiling 91; headroom 0)'. The line is 112 bytes against the ratchet's 120-byte per-line budget; a first attempt that also spelled the the NOW token token came to 147 bytes and was refused by the gate, which is why the landed line names the tool only. All three refresh moments (派发、收班、暂停或交接前) are intact — nothing was dropped to buy bytes. No other governed file was touched: not SKILL.md, not platform-readings.md.",
  "deviations": [
    "Gate derivation run WITHOUT paths (`--commands` with no arguments), per the standing clause, rather than with the explicit file list the dispatch names — the tool computes the change set from the merge base itself, including working-tree and untracked files, and feeding it a hand-made list is the failure mode that clause forbids. Result is a superset of the dispatch's list.",
    "3 derived gate families NOT MEASURED (exit 3, PREREQUISITE NOT MET, each needing a whole-workspace build): check:dual-build-cjs-loads, check:lean-entry-closure, check:type-check-debt. Declared, not silently narrowed.",
    "The the NOW token token is not spelled in the skill file — only the tool is. The 120-byte per-line budget left no room for both without dropping one of the three refresh moments, and dropping content to buy bytes is not a trade this PR takes. The tool documents the token in --help and refuses every other spelling.",
    "PM mechanism assumption C is partly falsified — see summary. Nothing changed in the delivery as a result: the helper is wired to a CI-run self-test either way.",
    "The tool refuses a body that merely DISCUSSES its own tokens: this very report first came back exit 2 '[quoted-not-a-stamp]' because its prose spelled the WAS token literally. That is the contract holding, not a defect — there is deliberately no escape hatch — and the remedy is the author's: name the token without its braces, as this report now does. Recorded because a reader will meet it the first time they write about the mechanism."
  ],
  "files_changed": [
    "scripts/pm/post-stamped.mjs (new, 538+ lines incl. a 68-case self-test across 6 batteries)",
    "scripts/pm/check-half-states.mjs (H56: header, predicates, row, sweep loop, census clause, count keys, band, 68 self-test cases)",
    "package.json (check:pm-post-stamped script)",
    ".github/workflows/lint.yml (one step running that self-test, argued in place)",
    ".claude/skills/pm-dispatch/references/seat-post-protocol.md (L28 rewritten in place, 91/91 net-zero)"
  ],
  "mcp_calls": "0 — every GitHub read and write in this run went over REST with GH_TOKEN (card body, thread, PR create, label write, label read-back, body read-back) or over git; no MCP GitHub tool was called",
  "open_questions": [],
  "out_of_scope_findings": [
    "noted, not filed: scripts/pm/sweep-closed-cards.mjs composes its own comment timestamps and does not route through the new helper. Folding it in is a behaviour change to a scheduled writer that posts unattended, so it belongs on its own card rather than riding this one. 承接者: the skills seat, once the token route stops being new.",
    "noted, not filed: scripts/check-self-test-wired.mjs skips any scripts/** file no workflow names, so a new script that ships a --self-test nothing runs is invisible to it rather than flagged. That is the gate's stated design (its header argues the mechanically decidable superset), not a defect — recorded because the dispatch's assumption C read it the other way. 承接者: none."
  ]
}

---

Generated by Claude Code

[os-justin]

ACCEPT — PR #17326 (head 0e9f0fd9) reviewed in-seat at the contract-review tier (skills seat, session session_01MoTv7pn338AZ71owsp19gQ, 2026-09-10T07:42Z).

• Implemented-by: os-dev subagent on branch claude/issue-17314-stamped-timestamps (claim 5614267277; default build tier — scripts/pm/** carries no path mandate; mode:subagent).
• Reviewed-by: the skills seat, this session — independence pair holds (reviewer ≠ implementer); the seat's harness reading is the tier evidence.
• Diff vs card (5 files, +1161 / −1): both halves landed and both were needed — the write side (scripts/pm/post-stamped.mjs, 719 lines read in full: pure core + live layer; the {{NOW}} token substituted once per invocation, the declared {{WAS:…}} quoted stamp validated as exactly one stamp, three refusals — positional / mixed / unknown-token — with no flag to disable them, an empty-body refusal, a wrong-repo refusal, a read-back that prints the platform's own write time, the drift against the shared 15-minute tolerance and a byte comparison of the stored body) and the read side (H56 in check-half-states.mjs, +420 lines: two positions only, minute-grain span, the created..updated edit window, ambiguous lines held out and counted, report-only, band state, census clause, 68 fixtures incl. the on-time / off-by-70-min pair the card asked for); one shared stamp definition, position reader and tolerance imported by the tool from the sweep. The pointer line folded into seat-post-protocol.md :28 net-zero (91/91, 112 bytes); package.json script + one lint.yml step running the offline self-test only. ⛔ No SKILL.md, no platform-readings.md.
• Verified in the review worktree /home/user/objectstack-review-17326 at 0e9f0fd9: post-stamped.mjs --self-test 「68 cases pass across 6 batteries — offline, no network, no token」; the positional refusal (exit 2) and the token form (exit 0, two tokens → one stamp) driven live in dry-run; check-half-states.mjs --self-test 「3171 cases pass」; check-self-test-wired.mjs exit 0; check:pm-skill-ratchet exit 0 (91/91); check:pm-skill-id-lint clean; check-governed-merges.mjs --test exit 3 GOVERNED — the one .claude/** line governs the PR, scripts/pm/**, package.json and lint.yml are not on the register. dispatch-gates.mjs --self-test re-run in a worktree with a real node_modules: 「✓ dispatch-gates self-test: 1674 cases pass.」 exit 0. Not re-run locally: repo-wide eslint (no root .bin in this container) — read from CI.
• CI on 0e9f0fd9 at 07:40Z: 44 checks, every one success or skipped; skip-changeset applied by the dev under the os-dev standing contract (nothing published moves) — accepted.
• Dispatch premise C partly falsified by the dev and accepted: check-self-test-wired skips scripts no workflow names (so the lint.yml step is what makes the new self-test CI-run), and the dispatch-gates self-test finished inside the foreground cap this time.
• Terminal: governed (.claude/**) ⇒ the PR stays draft; needs-user-decision placed on the PR, 速读 终稿 posted there, reviews requested from os-zhuang and hotlong; ⛔ not flipped ready, not enqueued, no auto-merge, no approval from this seat.
• Recorded, not filed (dev's out-of-scope findings, accepted as noted): sweep-closed-cards.mjs composes its own stamps and is not routed through the helper (a behaviour change to an unattended writer — its own card, later); the token is not spelled in the skill line (120-byte budget) — the tool's --help carries it.

---

Generated by Claude Code

[os-justin]

Landed — PR #17326 merged by os-zhuang at 2026-09-10T08:09:01Z (merge commit 73a8f0813150, head 0e9f0fd9), governed path (.claude/**): draft → human merge; this seat's ACCEPT verdict on this card bound to that head. Verified on origin/main 706ad0fcc4ed at 2026-09-10T08:12Z. Residue cleared in this same act: pm:dispatched off, assignee off; domain:skills and the type stay. Skills seat, session session_01MoTv7pn338AZ71owsp19gQ.

---

Generated by Claude Code