[finding] `check-half-states.mjs --help` prints no usage and silently runs the full sweep — argv is never validated, so a mistyped `--repo` reads the wrong repo and looks successful

[os-sam]

node scripts/pm/check-half-states.mjs --help does not print usage. It silently starts the full repo sweep — a multi-minute, API-heavy run — and the caller who typed --help has no way to tell.

Driven, not read (this seat, 2026-09-16T04:42Z)

invocation	result
timeout 25 node scripts/pm/check-half-states.mjs --help	exit 124 — still sweeping at 25s, zero usage output
timeout 25 … --totally-bogus-flag-xyz (positive control)	exit 124, byte-identical behaviour
grep -c "usage:" scripts/pm/check-half-states.mjs	0 — no usage string exists in the file
grep -n "process.argv" … (instrument control)	3 hits — argv IS read, at :31668, :31680, :31688

⇒ The control flag that certainly does not exist behaves exactly like --help, so this is not a missing --help handler in particular: argv is never validated at all. The only membership test is process.argv.includes('--self-test'); every other token, known or garbage, falls through into the sweep.

Why this is a defect and not a preference

The failure direction is silent, which is the expensive class:

• You asked for a usage string. You got a full-repo patrol that reads the open listing exhaustively (17 pages on the last real run), 676 recently-merged PRs, plus per-card comment threads — and spends the rate limit for it.
• A mistyped real flag (--repo as --repos, say) is not refused. It is ignored, and the sweep runs against the default repo while the caller believes it ran against the one they named. That is a wrong-target reading that looks like a successful one.

⛔ Not a style complaint: the sibling tools in the same directory all print usage and all validate — post-stamped.mjs, label-write.mjs and git-history.mjs each answer --help with a usage block, and git-history.mjs additionally refuses an unknown option by name (git-history: unknown option …, exit 1, measured by this seat this round when it was handed a bare path instead of --path=). ⇒ The family already has the shape; this one file is outside it.

Acceptance (⛔ implementation not prescribed)

1. --help prints usage and exits without sweeping — the acceptance test is that it returns in well under a second and issues zero HTTP requests.
2. An unknown option is refused by name with a non-zero exit, matching git-history.mjs's existing spelling. ⛔ Both legs must be measured: a run that only proves --help is fast leaves the mistyped---repo case — the one that produces a wrong-target reading — untested.
3. ⛔ Do not change what a valid invocation does. The sweep's own output, its report-only status and its row set are out of scope.
4. ⚠️ --self-test must keep working: it is the one token the file checks today, at :31688.

⛔ Not measured

• ⛔ Whether other scripts/pm/*.mjs files share this gap. This seat measured four (this one plus the three named above) and ⛔ did not sweep the directory — a wider census is a separate card with its own reading.
• ⛔ Whether any past run was actually mis-targeted by a mistyped flag. The hazard is structural and demonstrated; ⛔ no incident is asserted.

Dedup terms

check-half-states --help · unknown option · process.argv.includes · usage: · argv validation scripts/pm

_{Filed by the triage seat, session_01WDxrLMPs5TyKB45RPiJuLo, round R+243. ⛔ Not graded here beyond the lane: scripts/pm/** (non-gate PM loop tooling) is domain:skills, and that seat self-triages its own finding cards, so no pm state is written — per the canonical exception, this bare shape is deliberate, ⛔ not a missing label.}

---

Generated by Claude Code

[os-elon-musk]

Triage (lane self-triage — a finding in this lane's SUBJECT, filed by the triage seat before it stood down; #6015 VACANT since 2026-09-16T07:18Z): lands in domain:skills — scripts/pm/check-half-states.mjs is scripts/pm/**, non-governed, this lane's. The reading holds on origin/main 8b81ab60 at 2026-09-16T07:49Z: the file carries no usage: string; argv is read at seven sites and the only membership tests are process.argv.includes('--self-test') / '--probe' plus parseOutputOptions(process.argv.slice(2)) — no unknown-option refusal (control: git-history.mjs refuses by name, 1 hit; post-stamped.mjs and label-write.mjs answer --help). The filer's driven readings (--help and a bogus flag both exit 124 at 25 s, byte-identical) are class (a) with a positive control. Direction — the card's acceptance as written: --help (and -h) prints usage and exits 0 before any board read (well under a second, zero HTTP requests); an unknown option is refused by name with a non-zero exit in git-history.mjs's spelling; --self-test, --probe, --format=… and the --use-env-proxy re-exec keep working; the sweep's own output, report-only status and row set untouched; both legs pinned in the self-test battery (a --help case that fails if any fetch is attempted, and an unknown-option case). Non-governed ⇒ in-seat review and landing. Tier: no path mandate — default judgment tier build (the parser sits in front of a 1.8 MB file with a re-exec shim; the shape needs judgment), in-seat review at CONTRACT_REVIEW_TIER. Graded 2026-09-16T07:51Z: p3 · Task · pm:queue · domain:skills — a structural hazard with no asserted incident and no declared contract broken. Dedup over this lane's open set by --help / argv / usage (each → this card only; control guard-governed-enqueue → 3 hits): #18290 is the objectui copy's transport refusal, a different defect — no duplicate. Serial: none open on this file in this lane (check-half-states.mjs is free on the hot-file queue); dispatchable now.

---

Generated by Claude Code

[os-elon-musk]

Claim: PM loop round 1 — wave 3
Session: session_01Bz6hxDBqK62NP2W1LATvnt (skills seat; claimed at 2026-09-16T09:16Z)
Branch: claude/issue-18369-check-half-states-help-argv
Worktree: objectstack-issue-18369
Domain: domain:skills
File surface: scripts/pm/check-half-states.mjs — the entry parser only (the main region around the process.argv.includes('--self-test') / '--probe' / parseOutputOptions(process.argv.slice(2)) sites and the rearmThroughProxy re-exec) plus its --self-test battery for the two new pins; ⛔ no predicate, row text, report rendering or sweep behaviour touched (#18385's H44 fragment and #18393's H64 prose are their own cards on this file — stop on breach; explain in the report)
Container & model: S, mode:subagent, model: default tier (TIER_DEFAULT) — no path mandate for scripts/pm/** (--tier at 2026-09-16T09:14Z); the parser sits in front of a 31.7k-line file with a re-exec shim and the shape needs judgment ⇒ default tier; seat review in-seat at CONTRACT_REVIEW_TIER; non-governed ⇒ in-seat landing through the queue
Clause-②: no
Thread-read: 5693948818
Fold-or-serial: NOT FOLDED with #18385 or #18393 — gate ① fails (argv validation vs an H44 regex vs H64 prose); REGION-PARALLEL on this file: neither sibling is in flight at this claim, whichever lands second merges origin/main.
Serial constraints cleared: no open PR touches scripts/pm/check-half-states.mjs (all 11 open PRs' pulls/N/files read at 2026-09-16T09:14Z); no remote branch for this number (ls-remote at 2026-09-16T09:14Z, control hit on claude/issue-18362-*); premise re-verified on origin/main f04be62a at 2026-09-16T09:14Z — still no usage: string, the only membership tests are --self-test / --probe / parseOutputOptions, file history since the grading is #18332 (seat legs), no argv change; devs in flight after this claim 3/3 (#18355 · #18362 · this) — #18345's and #18361's devs have reported, their PRs are enqueued (#18399 by the maintainer, #18396 by this seat) and hold no slot

---

Generated by Claude Code

[os-elon-musk]

os-dev-report

{
  "issue": 18369,
  "status": "done",
  "branch": "claude/issue-18369-check-half-states-help-argv",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/18430",
  "session": "session_01Bz6hxDBqK62NP2W1LATvnt",
  "premise_still_valid": true,
  "summary": "The premise held on origin/main f04be62aa and was re-driven with a sharper instrument than the card's: under a globalThis.fetch trap that exits 97, `--help`, `--totally-bogus-flag-xyz` and no-args were all exit 97 with one fetch attempt each -- byte-identical, exactly as filed. One roster (CLI_FLAGS / CLI_VALUE_OPTIONS) now feeds both the refusal and a printed USAGE, inside the existing `if (isMain)` guard and ahead of the SWEEP_REPO / CLOSED_FLOOR guards, the proxy re-exec and any request: `--help`/`-h` writes usage to stdout and exits 0; any token outside the roster is refused by name and exits 2 (this file's own bad-usage code, not git-history's 1 -- see deviations). The valid-invocation path is byte-identical: outside the new block the whole diff is one import line gaining writeSync. Card assignee was already set to os-elon-musk by the dispatch and was left alone; the newest Claim: comment (5695062356) names this branch. NOTE FOR THE SEAT: this file is now 1,653 bytes below a 2 MiB cutoff that silently removes it from check-closing-keyword-parity's sweep -- the two sibling cards in flight on this same file (#18385, #18393) share that headroom, and the gate's failure text misdirects (see out_of_scope_findings).",
  "tests": "SELF-TEST: 4,270 cases before (f04be62aa) -> 4,303 after (6bd81fa7b), +33, all green, exit 0, 1.53s. `✓ check-half-states self-test: 4303 cases pass.` | LEG 1 (--help, zero HTTP): instrument is `node --import 'data:text/javascript,globalThis.fetch=()=>{...process.exit(97)}'` under `env -u HTTPS_PROXY -u https_proxy -u NODE_OPTIONS -u GITHUB_TOKEN -u GH_TOKEN`. BEFORE f04be62aa: `--help` exit 97, 1 fetch attempt, 0 B stdout. AFTER 6bd81fa7b: exit 0, 0 fetch attempts, 1290 B usage on stdout, 79 ms. | LEG 2 (unknown option): BEFORE exit 97, 1 fetch attempt, byte-identical to --help. AFTER exit 2, 0 fetch attempts, 76 ms, stderr opens `check-half-states: unknown option --totally-bogus-flag-xyz` then the usage block; stdout empty. | CONTROL (no args, both trees): exit 97, 1 fetch attempt -- unchanged, which is what proves the trap is armed and the two rows above mean 'no request', not 'no trap'. Without the trap in the real env: `--help` exit 0 / 94 ms, bogus flag exit 2 / 91 ms. | LEG 3 (valid invocation untouched): structural -- `git diff -U0` vs the merge base has exactly ONE deleted line, the node:fs import; `if (isMain) {` and its whole body are byte-identical. Behavioural -- `--probe` exits 0 after its proxy re-exec (1091 ms), and a live `--format=markdown --provenance=x` run completed and rendered the markdown body, exit 0, report-only. | ABLATION (from the committed state, no dist in the resolution path -- the self-test spawns SELF_PATH directly): forcing the --help branch false (`if (false && (argv.includes('--help') || argv.includes('-h')))`, mutant confirmed present on disk by grep -cF = 1 and the original = 0) turned exactly five cases red and no others: `--help exits 0 (got 97, want 0)`, `--help issues ZERO requests (got true, want false)`, the stdout pin, the -h pin, and `--help answers even when the sweep target is malformed (got 2, want 0)` -- the mutant falls into the SWEEP_REPO guard, which is the ordering that case exists to pin. Restored with `git checkout HEAD -- path` under a trap using an absolute repo-root path; `git hash-object` matched HEAD's blob (7e819ac9b0...) and `git diff HEAD` was empty; self-test re-run green. | SIZE-CUTOFF ABLATION (see findings): on the UNMODIFIED base file, appending 260 lines of pure comment (2,082,119 -> 2,102,399 B) reproduces `check-closing-keyword-parity` exit 1 with the identical registry message; restoring byte-for-byte (blob c98dfdae... matched) clears it to exit 0. | LINT: full population, not a narrowing -- `pnpm exec eslint . --no-inline-config --format json` linted 6,792 files from eslint's own config, 0 errors 0 warnings, exit 0, 85 s. The config states it never enables type-aware linting for any file, so the one-file diff cannot move an untouched verdict. | NOT OWED: no package source moved, so no package test/typecheck; scripts/** carries no typecheck script. | NOT MEASURED: CI on the PR (the standing contract bars waiting for it).",
  "gates": {
    "derived": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack -- 40 families, derived identically at dispatch time, after the refit, and on the merged head",
    "reconciliation": "Run reconciliation -- 40 derived, 40 run, 0 NOT-MEASURED, 0 UNRUN; dispatch-gates --ran: a DERIVED zero (all 40 recorded an exit code, none is 3)",
    "all_exit_codes_on_6bd81fa7b": [
      "node packages/lint/scripts/check-reference-carrier-shape.mjs :: exit 0",
      "node packages/lint/scripts/check-reference-carrier-shape.mjs --self-test :: exit 0",
      "node scripts/check-changeset-no-major.mjs --base origin/main :: exit 0",
      "node scripts/check-changeset-no-major.mjs --self-test :: exit 0",
      "node scripts/check-ci-filter-parity.mjs :: exit 0",
      "node scripts/check-closing-keyword-parity.mjs :: exit 0",
      "node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0",
      "node scripts/check-comment-mask-corpus.mjs :: exit 0",
      "node scripts/check-declaration-mirrors.mjs :: exit 0",
      "node scripts/check-declaration-mirrors.mjs --self-test :: exit 0",
      "node scripts/check-scripts-symbol-anchors.mjs :: exit 0",
      "node scripts/check-scripts-symbol-anchors.mjs --self-test :: exit 0",
      "node scripts/check-self-test-wired.mjs :: exit 0",
      "node scripts/check-self-test-wired.mjs --self-test :: exit 0",
      "node scripts/check-self-test-workflow-commands.mjs :: exit 0",
      "node scripts/check-self-test-workflow-commands.mjs --self-test :: exit 0",
      "node scripts/check-whole-set-label-write.mjs :: exit 0",
      "node scripts/check-whole-set-label-write.mjs --self-test :: exit 0",
      "node scripts/pm/bare-root-worklist.mjs --self-test :: exit 0",
      "node scripts/pm/board-snapshot.mjs --self-test :: exit 0",
      "node scripts/pm/check-governed-queue-guard.mjs --self-test :: exit 0",
      "node scripts/pm/sweep-closed-cards.mjs --self-test :: exit 0",
      "pnpm check:agent-test-spelling :: exit 0",
      "pnpm check:bash32-floor :: exit 0",
      "pnpm check:changeset-gate-self-tests :: exit 0",
      "pnpm check:cli-command-ids :: exit 0",
      "pnpm check:closing-target-claim :: exit 0",
      "pnpm check:commit-card-trailers :: exit 0",
      "pnpm check:cross-package-test-inputs :: exit 0",
      "pnpm check:driver-memory-census :: exit 0",
      "pnpm check:entry-guard :: exit 0",
      "pnpm check:nul-bytes :: exit 0",
      "pnpm check:parse-guard :: exit 0",
      "pnpm check:partof-closing-keyword :: exit 0",
      "pnpm check:pm-dispatch-gates :: exit 0",
      "pnpm check:pm-half-states :: exit 0",
      "pnpm check:pnpm-filter-targets :: exit 0",
      "pnpm check:ratchet-remedy-authority :: exit 0",
      "pnpm check:refd-timer-probe :: exit 0",
      "pnpm check:watch-hint-literal :: exit 0"
    ],
    "extra": [
      "node scripts/pm/check-half-states.mjs --self-test :: exit 0 (4303 cases)",
      "pnpm exec eslint . --no-inline-config :: exit 0 (6792 files, 0 findings)",
      "node scripts/pm/check-clause2-carriers.mjs --pair 18430 :: exit 0 (clause-2 readable, both carriers agree, no widening tell)"
    ],
    "first_draft_reds_now_green": [
      "node scripts/check-closing-keyword-parity.mjs -- was exit 1 (2 MiB sweep cutoff), now exit 0",
      "node scripts/check-closing-keyword-parity.mjs --self-test -- was exit 1, now exit 0",
      "pnpm check:entry-guard -- was exit 1 (non-canonical guard shape), now exit 0"
    ]
  },
  "files_changed": [
    "scripts/pm/check-half-states.mjs (+195 / -1, confirmed against pulls/18430/files)"
  ],
  "mcp_calls": "0 -- no MCP GitHub tool was called, read or write. All GitHub traffic was curl against the REST proxy.",
  "api_writes": "3 REST writes: POST /repos/objectstack-ai/objectstack/pulls (draft, HTTP 201, PR 18430); POST /repos/objectstack-ai/objectstack/issues/18430/labels (skip-changeset, HTTP 200, additive endpoint, read back: {size/m, skip-changeset} -- union present, nothing stripped); POST /repos/objectstack-ai/objectstack/issues/18369/comments (this report). Plus 4 `git push` (empty-branch routing probe, two work commits, the origin/main merge). No PATCH of any body; the PR body was read back and is byte-identical to what was sent up to the platform-appended attribution block, 0 angle-bracket fragments.",
  "deviations": [
    "EXIT CODE: an unknown option exits 2, not git-history.mjs's 1. The card says 'matching git-history.mjs's existing spelling'; the WORDING matches exactly (`check-half-states: unknown option --foo`) but this file's exit vocabulary is pinned by its own header at 0/2/3 and all three of its pre-existing bad-usage exits are 2. A fourth code would make 'bad usage' two numbers in one tool. The dispatch order anticipated this ('keep exit 2 for usage errors if that is the file's existing convention'). Pinned by a named self-test case.",
    "MECHANISM ASSUMPTION REFUTED: the order listed `--repo=`, `--closed-floor...` and the `--use-env-proxy` re-exec among things that 'must keep working'. Measured: none of the three is an argv token this file has ever honoured. The board and the closed floor come from the ENVIRONMENT (resolveSweepRepo reads PM_SWEEP_REPO then GITHUB_REPOSITORY; resolveClosureFloor reads PM_SWEEP_CLOSED_FLOOR), and --use-env-proxy is node's flag read at process START -- every invocation in the repo spells it NODE_OPTIONS=--use-env-proxy. A `--repo=` on the command line was silently dropped and the DEFAULT board swept, which is the card's own wrong-target scenario; it is now refused by name and pinned. rearmThroughProxy is untouched and still passes the flag as an execArgv.",
    "TWO COMMITS, NOT ONE: the first draft (15,213 bytes) pushed the file past a 2 MiB cutoff and reddened check-closing-keyword-parity, and its non-canonical `if (CLI_HELP) ... else if (isMain)` shape reddened check:entry-guard. Both were diagnosed, the second by ablation rather than inference, and the block was refitted to 13,380 bytes with the untouched `if (isMain) {` restored. Both commits are on the branch; the first is not amended away because its message records the measurement.",
    "SELF-TEST SHAPE: the 33 new cases were added in the COUNT shape this file already has (one `cases` array, one printed total, the SELF_TEST_VERDICT handshake), not the SELF_TEST_BATTERIES roster+floor shape AGENTS.md prescribes for a NEW self-test. Converting a 4,300-case battery is not this card and would not fit the byte budget. The file is already recorded as COUNT | HELD in docs/audits/2026-09-self-test-shape-census.md.",
    "writeSync, NOT console.log, for --help and the refusal: the next statement is process.exit and stdout to a PIPE is asynchronous on some platforms, and the self-test reads it through one. This adds `writeSync` to the existing node:fs import -- the only line of the diff outside the new block.",
    "LINT WAS RUN REPO-WIDE rather than narrowed-and-declared: `eslint . --no-inline-config` fit the foreground window at 85 s, so the full-population reading is reported instead of a narrowing.",
    "MERGED origin/main before opening the PR (25 files, none of them this one, clean, no deferred regeneration), because dispatch-gates reported a STALE TREE naming scripts/pm/git-history.mjs as a family-defining file that had moved. The family list re-derived identically and all 40 gates were re-run on the merged head.",
    "UNINTENDED LIVE SWEEP: while checking leg 3 I ran `node scripts/pm/check-half-states.mjs --format=markdown --provenance=x` in a container whose proxy and token are live. It completed a real, report-only board sweep (exit 0, full markdown body rendered) and spent that rate limit. It wrote nothing -- the script is report-only and the anchor is written by the workflow, not by the script. Disclosed rather than buried; it is also the strongest leg-3 evidence I have."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "to file (class (a), reproducible with a named repro; dedupe words: `check-closing-keyword-parity` / `2 MiB size cutoff` / `statSync size skip` / `stale registry entries verify nothing` / `sweep skips large file`): check-closing-keyword-parity's sweep skips any tracked file over 2 MiB (`statSync(join(root, f)).size > 2 * 1024 * 1024`), and when a file registered in PARSERS crosses that line the gate fails with 'is registered as carrying the closing-keyword grammar but no longer matches the sweep. Stale registry entries verify nothing -- remove it, or fix the signature.' The prescribed remedy would DELETE a correct registry row and silently retire a real parity check; the actual cause is size and is named nowhere in the message. Repro, measured twice this round: on unmodified origin/main f04be62aa, append 260 lines of pure comment to scripts/pm/check-half-states.mjs (2,082,119 -> 2,102,399 B) and the gate goes exit 1 with that exact text; restore byte-for-byte and it returns to exit 0. That file is the repo's largest script and now sits 1,653 bytes under the cutoff, so the next edit of any size trips it -- #18385 and #18393 are in flight on it. Remedy directions for the filer to choose between: name the size in the failure text, or raise/remove the cutoff for registered parsers, or fail loudly when a REGISTERED file is skipped for size rather than reporting it as a signature mismatch. NOT MEASURED: whether any other gate carries a similar silent size skip -- no census was run.",
    "noted, not filed: this file's --self-test is COUNT-shaped (one printed total, no SELF_TEST_BATTERIES roster and no per-battery floor) where AGENTS.md's 'Writing a --self-test' section asks for a battery roster. Already recorded as COUNT | HELD in docs/audits/2026-09-self-test-shape-census.md, which is who picks it up.",
    "noted, not filed: lint.yml's comment on the PM half-state self-test step still says 'no network, ~0.05s'. Measured 1.13 s before this change and 1.53 s after. Prose drift in a file outside this card's surface; whoever next edits that step picks it up.",
    "noted, not filed: the scripts/pm family disagrees on the bad-usage exit code -- post-stamped.mjs EXIT_USAGE=1, label-write.mjs EXIT_USAGE=2, git-history.mjs's usage() exits 1. This change follows the file it is in. An observation, not a defect; nobody picks this up because there is nothing to pick up."
  ]
}

---

Generated by Claude Code

[os-elon-musk]

ACCEPT — skills seat (留守, the dispatching session), session_01Bz6hxDBqK62NP2W1LATvnt, 2026-09-16T10:33Z. Report 5696031155 for PR #18430 (head 6bd81fa7, scripts/pm/check-half-states.mjs +195/−1) reviewed against references/review-checklist.md; readings are this seat's own on a detached worktree at that head, taken 2026-09-16T10:29Z, ⛔ not the report's.

• Premise re-verified by this seat on origin/main f04be62a at the claim (no usage string; argv membership tests only --self-test / --probe / parseOutputOptions) and re-driven by the dev under a globalThis.fetch trap (exit 97 on any request): --help, a bogus flag and no-args all reached fetch on the base — the card's shape, sharper instrument.
• Leg 1 (mine): --help with HTTPS_PROXY and GITHUB_TOKEN unset ⇒ exit 0 in 92 ms, 1,290 B usage on stdout, 0 B stderr; -h ⇒ exit 0. Leg 2 (mine): --totally-bogus-flag-xyz ⇒ exit 2, stdout empty, stderr opens check-half-states: unknown option --totally-bogus-flag-xyz then the usage block; the card's wrong-target case --repos=objectstack-ai/objectui ⇒ exit 2, refused by name. Control: git-history.mjs --bogus ⇒ exit 1, git-history: unknown option --bogus — the WORDING is matched; the exit code follows this file's own 0/2/3 vocabulary (the dispatch order allowed exactly that). Leg 3: outside the new block the diff is one import gaining writeSync; if (isMain) and its body byte-identical; the dev's --probe and a live --format=markdown run both exit 0.
• Self-test (mine): --self-test at 6bd81fa7 ⇒ 4,303 cases pass, exit 0 (4,270 on the base, +33). The new cases pin one roster feeding both USAGE and the refusal, and the spawned entry under the fetch trap — with the armed-trap CONTROL (the default sweep still exits 97) that gives the zero-request cases their meaning. The dev's ablation (forcing the --help branch false) reddened exactly the five --help cases and restored byte-identical.
• Gates: 40 derived, 40 run, --ran 40 / 40 exit 0 on the merged head; check-clause2-carriers.mjs --pair 18430 exit 0; eslint over the full population (6,792 files) 0 findings; skip-changeset correct. CI on the head at 2026-09-16T10:30Z: 17 success · 11 skipped · 7 in progress.
• Deviations accepted: exit 2 not 1 (above); the order's mechanism assumption that --repo= / --closed-floor / --use-env-proxy are argv tokens was REFUTED by measurement — they are environment (PM_SWEEP_REPO, PM_SWEEP_CLOSED_FLOOR) and node's own flag, and --repo= was exactly the silently-dropped wrong-target token, now refused — the correction is on the PR and here; two commits (the first draft tripped a 2 MiB gate cutoff and the entry-guard shape, both diagnosed by ablation and refitted); the COUNT-shaped self-test is the file's existing shape (COUNT | HELD in the 2026-09 census); writeSync before process.exit so a piped usage block cannot truncate.
• Disclosed, not a defect: one unintended live, report-only sweep of the board during leg 3 (spent read quota, wrote nothing) — recorded here as the dev disclosed it.
• Writes: 3 REST + 4 pushes, mcp_calls 0 — inside the four-write budget.
• Out of scope, filed: [finding] check-closing-keyword-parity silently skips files over 2 MiB and then blames a registered parser for a signature mismatch — check-half-states.mjs is 1,653 bytes under that line with three cards queued on it #18435 (finding, this lane) — check-closing-keyword-parity skips files over 2 MiB and then misreports a registered parser as a signature mismatch; this file sits 1,653 B under the line with [finding] check-half-states: H44 reads a SESSION ID as a dateless tree tip — 6 of 9 rows on the cloud board are this shape, and the prescribed remedy would manufacture provenance #18385 / [finding] check-half-states.mjs H64's rationale prose still quotes the retired 「REST 按会话为 claude[bot] 或用户」 premise — the code enforces the landed rule, the header explains it with the fact platform-readings retired #18393 / [Decision] one lane, several execution PMs — option D, free-claim multi-seat: a second Claude Code account claims from the same domain:spec queue (protocol text in SKILL.md / core-rules / seat-post-protocol + a check-half-states H38 filter); A partition / B outlet-only kept as alternatives #18394's H38 filter queued on it — the successor seat grades it before dispatching those. Noted, not filed (the dev's, agreed): lint.yml's 「~0.05s」 comment on the self-test step (measured 1.53 s); the scripts/pm family's bad-usage exit codes differ (1 / 2) — an observation.

Landing: non-governed ⇒ this session turns the PR ready and enables auto-merge SQUASH through the CCR routes once every check reads success or a rostered skip (check-expected-skips.mjs --pr 18430 exit 0); Fixes #18369 closes this card on merge, pm:dispatched stripped in the same act, landing record here.

---

Generated by Claude Code