Skip to content

[Half-state patrol] check-half-states live sweep — generated view (please pin) #9857

Description

@os-warren

os-half-state-sweep — machine-findable marker for this generated view.

Generated view — not a second tracker. Authority lives on each card and PR (one-board rule); this body is rewritten IN PLACE by the scheduled patrol workflow (.github/workflows/half-state-patrol.yml) on every run, and the edit history is the archive. Report-only: every row is patrol input, never a gate verdict, and this sweep never fixes a state. Each predicate and the protocol clause it enforces are documented in scripts/pm/check-half-states.mjs.

Swept 2026-09-14T01:59:39.772Z · expected every 6h (cron 37 1,7,13,19 * * * UTC) · next by 2026-09-14T07:37Z · run 34797484770 · commit f27e86b087adb063f669186feda15c196709f4a4 · trigger schedule

The timestamp above is the patrol's own heartbeat, and the line states the cadence that makes 「stalled」 decidable: a Swept line still sitting there past the next by deadline beside it means the standing caller died, which is the failure this anchor was created to make visible. ⛔ Do not carry a cadence over from a sibling anchor — the four patrols differ by 4× and each states its own. Read it before you read the rows.

⚠️ 2 UNJUDGED row(s) in this sweep — an input this patrol could NOT read, not a state it read and found clean. They are sorted above the ordinary rows so the body's size trim can never be what removes them (#4690, #11218), and they are the rows to judge BY HAND: nothing in a later sweep will resolve them on its own.

check-half-states: swept 440 open pm-/p0-labeled issue(s), 511 open issue(s) in the unscoped pass (H13–H15, H18), 5 open PR(s) (merge state read on 1 of 1 H16 candidate(s)) and 817 recently-merged PR(s) in objectstack-ai/objectstack — 461 half-state(s) found. H8's merged window is a TIME cap of 8 day(s), read in 10 page(s) (horizon reached: a delivery inside the window was seen, not merely the first N rows). H22 read 266 recently-closed issue(s) for pm:* state residue, COUNTED into the census line above and filed as no row at all (ruled 2026-08-31, 批 #13; folded #14072) (older closed carriers are outside the window by design). H22's closed-card window is a TIME cap of 3 day(s), reaching back to 2026-09-10, read in 3 page(s) (boundary reached: paging ran past the horizon, not merely the first N rows). It is a CLOSURE horizon: rows are selected on closed_at, while paging is bounded by updated_at — the stream is consumed by closed-issue ACTIVITY (~139.4/day, measured 2026-09-11), not by closures (~11/day), which is why the page cap it replaced covered a ragged 2.1 days of update-recency rather than the closure window it read as. rate premise OK — observed ~92.3/day against pinned MEASURED_CLOSED_ISSUE_UPDATES_PER_DAY = 139.4/day, measured 2026-09-11 (3d ago) (factor 0.66, band 2x). H23 read 266 squash commit message(s) from the default branch, carrying 178 closing-keyword binding(s) across 162 message(s). H23's commit window is a TIME cap of 3 day(s), read in 3 page(s) (boundary reached: paging ran past the horizon, not merely the first N rows). The open listings (H1–H18 inventory, H13 unscoped pass, open PRs) is an EXHAUSTIVE listing, read in 18 page(s) (complete: paging reached the end of the stream, so this IS the whole population). Hold comments read on 104 of 104 H17 candidate(s). Blocked-by: comment fallback read on 84 of 84 candidate(s). Restart-when: hold comments read on 85 of 85 H9 candidate(s). Awaiting-maintainer entries (H55): 0 open pm:awaiting-maintainer card(s) last touched before 2026-09-10T00:00:00Z — COUNTED here and filed as no row (they entered before the Maintainer-action: line was owed; the bounded reclassification worklist is a separate act); 0 with no readable updated_at, judged rather than counted; Maintainer-action: threads read on 2 of 2 judged candidate(s). Blocker liveness (H19): targets resolved on 63 of 65 distinct Blocked-by: target(s) named by open pm:blocked card(s) — the 2 unresolved target(s) are named on their own cards' rows, and those rows sort ABOVE the size trim so they cannot be what a truncated body drops (#11218: this clause used to be an unconditional promise, and on the 2026-08-25T02:08Z sweep it was false — 199 rows were trimmed and not one rendered row carried an unresolved target). Cross-repo reachability was measured directly on 1 sibling repo(s), of which 1 do(es) not answer this credential — those targets are unjudgeable by ruling (each install reads its own repo with its own repo-scoped token) and ⛔ no re-run resolves them. Dispatch liveness (H20 + H27): remote branch read on 5 of 5 distinct claimed branch(es) named by open pm:dispatched card(s) past the 60-minute threshold — one read serving both rows, so H27's 24h population is a subset of this one and costs no request of its own. Seat liveness (H32): marker thread read on 5 of 5 HELD seat post(s) whose lane is countable on THIS board — a seat held for a sibling repo's lane is out of scope here (its inventory is unreadable from this sweep, so an empty-looking queue would mean nothing), and an unread thread makes H32 decline to judge that seat rather than accuse it. Gate-removal patrol (H35): 0 removal(s) of a gate-semantic label read from 0 page(s) of the repo-wide issue-event stream over the last 12h — no per-card timeline fetch. 0 of them are UNJUDGEABLE (a gate that only ever had ONE carrier leaves 「双载体同笔清标」 no evidence in either direction, so neither H31 nor H35 can say cleared-or-stripped). Shared-file holds (H36): changed-file page read on 4 of 4 open PR(s) — a pair needs both sides read, so a shortfall can only MISS a hold, never invent one. Governed review requests (H43): 0 of the open PR(s) whose changed-file page was read hit the governed register, and the submitted-review leg answered on 0 of 0 that the request/assignment union already left short (oldest-first, 25 per run). An unread review leg leaves its row standing on the two cheap fields and the row says so; a PR whose file page went unread is not judged by this item at all. Family folds (H37): 0 live shared branch(es) claimed by more than their own chain head, and a member comment page read on 0 of 0 open pm:queue card(s) — that second read is bought ONLY when a fold is live, so 0 of 0 is a board with no fold in flight rather than a pass that skipped one, and an unread member can only MISS a drifted write, never invent one. Dangling references (H40): 274 of 400 attempted resolution(s) answered, over 6166 distinct # reference(s) read off the LIVE board — 516 open card(s)/PR(s) and 211 already-cached comment thread(s), so comment coverage is the gated subset rather than the whole board, and merged/closed archive is out of the corpus by design. 998 number(s) were answered free from listings already in hand, and 4768 were NOT ATTEMPTED at the 400-resolution budget (newest-first; this pass reached down to #15917) — not attempted is not clean; 1 reference(s) name a number above the highest this sweep saw and were held out rather than resolved. 126 do(es) not resolve and 0 could not be judged — ⛔ only HTTP 404 is read as unresolvable, a CLOSED card resolves normally and is never a finding, and no cause is asserted for any of them. Suppressed content is invisible, so every count here is a LOWER BOUND. Untimestamped readings (H44): 1522 comment(s) across 211 thread(s) ALREADY in hand were read for the five artefact shapes, and the seat leg widened the fetch to 7 of 7 HELD seat post(s) — every held seat, whatever its lane spelling, which is wider than H32's own population and deliberately so. ⛔ A verdict posted on a PULL REQUEST is NOT in this corpus: no listing here fetches a PR comment page, so this row's silence about PRs is an unread surface and never a clean one, and every count above is a LOWER BOUND. Estimated stamps (H56): 1522 of the comment(s) above carried a platform created_at to judge a typed stamp against, 0 did not and are UNJUDGED rather than clean, and 11 stamped line(s) carried more than one stamp and were held out rather than guessed at. Tolerance 15 min, measured against the whole created_at..updated_at window, so a stamp legitimately refreshed by a later EDIT never fires and a comment edited long after posting is judged against a wide window — a stated under-read, and the safe direction for a patrol reading somebody else's artefact. Claim-less implementations (H46): 3 of 3 bound card thread(s) were read for a Claim: naming the PR's head branch. A bound number this sweep cannot see as an OPEN card — closed, a PR, or beyond the listing ceiling — is UNJUDGED rather than clean, so this count is a LOWER BOUND. Epic parent reads (H45): 8 of 8 open pm:epic card(s) had their sub-issues parent read answered — a 404 No parent issue found IS an answer here, because parentless is what it means. That index is enumerated as its own population and kept OUT of the label pages every other row is judged over (SEEN_LABEL_PAGES), so this row buys one page plus one read per carrier and moves no other row's input. A carrier whose parent read did not answer is UNJUDGED rather than clean. Release records (H47): 31 of 255 card(s) this row can speak about had a comment thread ALREADY in hand to judge. It fetches NOTHING of its own, so a card whose thread no other row bought is UNJUDGED rather than clean, and the no-assignee pm:queue leg is the thinnest half of that corpus — H2 buys a thread only for an ASSIGNED card. A card that was never claimed is clean and indistinguishable from an exit nobody recorded, so this count is a LOWER BOUND. Maintainer briefs (H48): 0 of 0 governed open PRs judged, one issue-comment thread bought per governed open PR (at most 5 page(s) of 100). This is a NEW fetch class rather than a second reader of one already in hand: commentCache holds CARD threads only. A thread that failed or reached that ceiling is UNJUDGED rather than short, a PR whose changed-file page went unread is not in this population at all, and a governed PR with NO **ACCEPT** verdict is CLEAN rather than quiet. Partial landings (H49): 15 of 15 open pm:dispatched + assigned card(s) had a comment thread in hand to judge against the merged window. It fetches NOTHING of its own — H2 buys that thread for exactly this population, so a shortfall is a thread H2 could not read, and such a card is UNJUDGED rather than clean. The PR side is the H8 merged window plus the open listing, so a Refs landing older than the window is invisible here. Thread-read fields (H50): 15 of 15 open pm:dispatched card(s) had a COMPLETE comment thread in hand to judge the newest Claim: against (0 still full at the page ceiling or failed mid-walk — UNJUDGED rather than clean, since the newest claim may sit on a page this row never saw); 0 extra comment page(s) bought completing full first pages. A claim stamped before the field landed is never a row. Open questions (H52): 203 of 440 listed open card(s) had a COMPLETE comment thread in hand to judge the newest os-dev-report against (4 carried a newest report whose JSON payload did not read — UNJUDGED rather than clean, since an unread payload has an UNKNOWN open_questions array). It fetches NOTHING of its own, so a shortfall is a thread no other row bought, or one still full at its first page, and such a card is UNJUDGED rather than clean. A CLOSED card is out of this population entirely, and the residual-question rule is what carries a question past its own card. Contract-review handoffs (H51): 0 of 0 gated open PR(s) had a readable issue-comment thread to judge the newest contract-review verdict against (at most 5 page(s) of 100, shared with H48's cache). A thread that failed or reached that ceiling is UNJUDGED rather than clean, and a verdict naming an OLDER head is CLEAN rather than quiet — the head moved, so the carrier is genuinely live again. Carriers without increment (H53): 0 of 0 gated open card(s) had a COMPLETE comment thread to judge for a Claim: (0 extra comment page(s) bought completing full first pages). It BUYS that thread rather than reading a cache: the population is unassigned by construction and H2 buys one only for an ASSIGNED card, so a cache-only reading would report this whole shape UNJUDGED while looking healthy. An incomplete or failed walk is UNJUDGED rather than clean, since a full page may hide the newest claim. The PR leg is the open listing plus H8's bounded merged window, so a landing older than that window is as invisible here as it is to H8. Scheduled non-blocking workflows (H57): 22 workflow(s) on the swept repo declare a schedule; 7 were judged against their latest event=schedule run and 0 are UNJUDGED rather than clean because that read failed. Held out: 15 declaring a PR-gating trigger (pull_request / pull_request_target / merge_group — the structural reading of "not in the required set", deliberately NARROWER than the ruleset's own answer, so a scheduled workflow that runs on pull requests without being required is silence this row does not break), 0 for a non-active workflow state. A further 2 workflow file(s) carried an on: block this file refused to read, so whether they belong to this population is UNJUDGED. Cost 8 request(s): the workflows listing plus one event=schedule read per judged workflow, and ⛔ never a status=success count. Queued ruling markers (H58): 224 open pm:queue card(s) had their BODY judged against 3 frozen heading anchor(s) — 3 with a comment thread ALREADY in hand, 221 on the body ALONE. It fetches NOTHING of its own, so a card whose thread no other row bought has an UNREAD second channel rather than a clean one, and the rows are a LOWER BOUND. It matches ATX HEADINGS outside fenced code only: a marker quoted in prose, in a table, in a code span or in a blockquote is invisible here by design. Merged-PR closing linkage (H59): 751 declared closure(s) and 582 keyword-LESS mention(s) from the bodies in H8's merged window were judged against the open listing this sweep already holds; a declared target still on that listing is a FALSE OPEN row and costs no request. 2056 further mention(s) named a card that is neither open nor inside H22's 3-day closed window, so their closure could not be PLACED and they are UNJUDGED rather than clean — this row's real reach is the SHORTER of the two windows, ⛔ never H8's 8 days. Of the mentions that could be placed, only a closure inside the measured 5s band buys evidence: 0 card(s) had ONE timeline page read (cap 40 card(s) per sweep, ⛔ no retry on any status), 0 could not be read and 0 were past that cap — all UNJUDGED, never clean. A declaring SIBLING PR inside the same band EXPLAINS a closure and this row stays quiet, because batched landings put two merges in one second. ⚠️ The closed event carries no commit_id on this board (measured), so the commit leg is exact where it fires and fires on nothing here; the band leg is circumstantial and every row says so. Rows are a LOWER BOUND. User-authored seat content (H64): 1041 of 2038 text(s) read carry a seat/dev signature; 846 of those are authored by a USER account rather than claude[bot] — 43 created on/after 2026-09-13T00:00:00Z and judged, 10 filed as rows under this family's own 10-row cap (newest first, because the body trim eats the highest card numbers), and 803 counted here as a CENSUS reaching back to 2026-08-05T19:32:57Z. 0 signed text(s) carried no readable user and were DECLINED rather than accused. It fetches NOTHING of its own: the corpus is the open card and PR bodies in hand plus the card threads H44 and H56 read, so a PULL-REQUEST comment thread is outside it by construction and these numbers are a LOWER BOUND. Report-only: findings are patrol input, not a gate verdict.

Findings

  • H19 #15140pm:blocked and 1 of 1 Blocked-by: target(s) could NOT be resolved this sweep (objectstack-ai/cloud#1962 (HTTP 404; objectstack-ai/cloud is NOT readable to this sweep's credential)) — the set judged against the BODY's Blocked-by: set, the authoritative carrier whenever the body states one (a body is rewritten in place, a comment is an archive) — so whether this block has outlived its blocker is UNJUDGED, not confirmed. Unread is not still-open (check:react-declaration-parity 是唯一没接进任何 workflow 的源码审计门禁,且无 MANIFEST 时静默 skip 退出 0 —— 它现在永远不可能红 #4690): a target dropped in silence reads as a healthy block forever, which is the exact failure this item exists to end, so it is named here instead. ⚠️ UNJUDGED is not a quiet row and must not be skimmed as one: this card's block is exactly as unverified as if nothing had been read at all. ⚠️ 1 of them are unjudgeable for a reason that has NOTHING to do with this card: the repo itself does not answer this sweep's credential (measured directly, by a separate GET /repos/<owner>/<name> — not inferred from the issue 404). That is the cross-repo class the contract-first split manufactures, and it is a standing, ACCEPTED limit rather than a defect to chase: each patrol install reads its own repo with its own repo-scoped token by ruling, so no re-run and no re-read of this card will ever resolve these. ⛔ Do not "fix" it on the card — judge the target BY HAND, or take a credential change to routing/security, whose call it is. Report-only, and the release is NOT this script's to make: the state model gives it two mechanical double-checks (pm:blocked/pm:on-hold row, 「放行双查」) — ① release only against the condition carried by the MOST RECENT conversion comment, never an earlier blocker on the thread (a condition already spent, re-fired, reinstates an expired premise as the current one), and ② refuse to release when the card carries a MERGED PR newer than that conversion comment (the card moved on after the condition was written, so the cited fact can be true and no longer current). This row surfaces the candidate; the unlock sweep releases it — ⛔ never a label written from this script. When that release does happen it is the landed ACT — 「释放是显式动作:让卡离手者同笔清 assignee + Release: 行(会话/因/去向);下一任重新认领。」 — ONE write with TWO halves: it clears the assignee AND carries the Release: line (session, cause, destination). Dropping the field alone leaves no record of who let the card go, the half-state H47 reports. A card returned to pm:queue still carrying the assignee of the seat that parked it is dispatchable to the queue view and taken to the claim rule at the same time (H24), which is the state the unlock scan was measured leaving behind — ⚠️ agent identity only, a HUMAN assignment is ⛔ never cleared by an agent.
  • H19 #15214pm:blocked and 1 of 3 Blocked-by: target(s) could NOT be resolved this sweep (objectstack-ai/cloud#1979 (HTTP 404; objectstack-ai/cloud is NOT readable to this sweep's credential)) — the set judged against the BODY's Blocked-by: set, the authoritative carrier whenever the body states one (a body is rewritten in place, a comment is an archive) — so whether this block has outlived its blocker is UNJUDGED, not confirmed. Unread is not still-open (check:react-declaration-parity 是唯一没接进任何 workflow 的源码审计门禁,且无 MANIFEST 时静默 skip 退出 0 —— 它现在永远不可能红 #4690): a target dropped in silence reads as a healthy block forever, which is the exact failure this item exists to end, so it is named here instead. ⚠️ UNJUDGED is not a quiet row and must not be skimmed as one: this card's block is exactly as unverified as if nothing had been read at all. ⚠️ 1 of them are unjudgeable for a reason that has NOTHING to do with this card: the repo itself does not answer this sweep's credential (measured directly, by a separate GET /repos/<owner>/<name> — not inferred from the issue 404). That is the cross-repo class the contract-first split manufactures, and it is a standing, ACCEPTED limit rather than a defect to chase: each patrol install reads its own repo with its own repo-scoped token by ruling, so no re-run and no re-read of this card will ever resolve these. ⛔ Do not "fix" it on the card — judge the target BY HAND, or take a credential change to routing/security, whose call it is. The card's other 2 target(s) did resolve, and are still open. Report-only, and the release is NOT this script's to make: the state model gives it two mechanical double-checks (pm:blocked/pm:on-hold row, 「放行双查」) — ① release only against the condition carried by the MOST RECENT conversion comment, never an earlier blocker on the thread (a condition already spent, re-fired, reinstates an expired premise as the current one), and ② refuse to release when the card carries a MERGED PR newer than that conversion comment (the card moved on after the condition was written, so the cited fact can be true and no longer current). This row surfaces the candidate; the unlock sweep releases it — ⛔ never a label written from this script. When that release does happen it is the landed ACT — 「释放是显式动作:让卡离手者同笔清 assignee + Release: 行(会话/因/去向);下一任重新认领。」 — ONE write with TWO halves: it clears the assignee AND carries the Release: line (session, cause, destination). Dropping the field alone leaves no record of who let the card go, the half-state H47 reports. A card returned to pm:queue still carrying the assignee of the seat that parked it is dispatchable to the queue view and taken to the claim rule at the same time (H24), which is the state the unlock scan was measured leaving behind — ⚠️ agent identity only, a HUMAN assignment is ⛔ never cleared by an agent.
  • H38 #6023pm:seat post is STALE — its lane domain:devx carries a Claim: on [finding] The SCIM/identity ADR-0071 citation resolves to the dataset semantic-layer record — 39 files point at a decision about multi-hop joins #14361 written 21.8h AFTER this post's last event (claim 2026-09-14T01:40:21.000Z, post 2026-09-13T03:54:22.000Z). A shift dispatched work and did not record it, so every number the post states — 在飞 / 队列 / 决策箱 / the round number — describes a round that has since moved on, while updated_at makes the post read as SETTLED rather than as stale. ⚠️ This is the measured shape: one seat ran ~31h to wave 4 and dispatched five cards under a title still claiming the previous round. ⛔ Not an accusation of carelessness — the same post already carried this exact lesson in its own ledger, written one shift earlier, and the next shift reproduced it; that is the evidence prose does not hold here, not evidence about any seat. Remedy: refresh the seat post (or post a round marker) so the successor reading it sees the round that is actually running. Report-only: ⛔ this row never writes a label, a title or a marker.
  • H38 #7623pm:seat post is STALE — its lane domain:skills carries a Claim: on [finding] Dispatch tooling: concurrent subagents of one session share one flat scratchpad (silent, well-formed collisions), and a carrier-shape gate blind spot that could not be verified #18061 written 0.2h AFTER this post's last event (claim 2026-09-14T01:48:33.000Z, post 2026-09-14T01:38:29.000Z). A shift dispatched work and did not record it, so every number the post states — 在飞 / 队列 / 决策箱 / the round number — describes a round that has since moved on, while updated_at makes the post read as SETTLED rather than as stale. ⚠️ This is the measured shape: one seat ran ~31h to wave 4 and dispatched five cards under a title still claiming the previous round. ⛔ Not an accusation of carelessness — the same post already carried this exact lesson in its own ledger, written one shift earlier, and the next shift reproduced it; that is the evidence prose does not hold here, not evidence about any seat. Remedy: refresh the seat post (or post a round marker) so the successor reading it sees the round that is actually running. Report-only: ⛔ this row never writes a label, a title or a marker.
  • H52 #9659 — the newest os-dev-report (comment 5330963994, 2026-08-18T16:15:12Z) carries 1 non-empty open_questions entry(ies) while the card carries NO needs-user-decision label: 「Do you want a PRE-EMPTIVE injection of @objectstack/formula, given zero divergence today but live call sites? It is the only one of the four whose bundled surfa…」. So a question only the maintainer can answer is filed, well-formed and UNREACHABLE — it is in no inbox, no candidate query and no staleness alert, while the card's own state label — whichever of the six it is — reads as work in progress on every board, so nothing a reader can see says a decision is owed. ⚠️ This is the shape that produces three success signals and a wrong answer: the dev did its job, the report validated, the seat accepted it, and the decision never arrived. Remedy, in the order the protocol asks for it: if the question is the one this card was dispatched on, put the card in the inbox (needs-user-decision) and present it; if it is a RESIDUAL raised while EXECUTING a ruling this card already carries, ⛔ never re-hang the label here — file a NEW card carrying the question and linking the ruled one, because a re-flagged card leaves the inbox unable to say WHICH question is open and invites a reader to re-present a ruling that has already been executed, and because this card's close would take the label, and the question's only visibility, with it. If the question has already been ANSWERED, say so in the next report, whose empty open_questions is the record that stands this row down. ⛔ Nothing here changes the report contract: the array is the right place for the question. Report-only patrol INPUT: nothing is blocked and no label is written.
  • H52 #9707 — the newest os-dev-report (comment 5335163974, 2026-08-18T22:56:20Z) carries 1 non-empty open_questions entry(ies) while the card carries NO needs-user-decision label: 「Should packages/lint gain an additive, browser-safe subpath export (e.g. './authoring-capabilities') carrying validateCapabilityReferences without the node-only…」. So a question only the maintainer can answer is filed, well-formed and UNREACHABLE — it is in no inbox, no candidate query and no staleness alert, while the card's own state label — whichever of the six it is — reads as work in progress on every board, so nothing a reader can see says a decision is owed. ⚠️ This is the shape that produces three success signals and a wrong answer: the dev did its job, the report validated, the seat accepted it, and the decision never arrived. Remedy, in the order the protocol asks for it: if the question is the one this card was dispatched on, put the card in the inbox (needs-user-decision) and present it; if it is a RESIDUAL raised while EXECUTING a ruling this card already carries, ⛔ never re-hang the label here — file a NEW card carrying the question and linking the ruled one, because a re-flagged card leaves the inbox unable to say WHICH question is open and invites a reader to re-present a ruling that has already been executed, and because this card's close would take the label, and the question's only visibility, with it. If the question has already been ANSWERED, say so in the next report, whose empty open_questions is the record that stands this row down. ⛔ Nothing here changes the report contract: the array is the right place for the question. Report-only patrol INPUT: nothing is blocked and no label is written.
  • H52 #10032 — the newest os-dev-report (comment 5363412215, 2026-08-20T23:45:14Z) carries 2 non-empty open_questions entry(ies) while the card carries NO needs-user-decision label: 「My own instrument wrote a raw NUL byte into scripts/check-test-completeness.mjs mid-run, and I want it recorded rather than quietly fixed. perl -0pi -e 's{...}…」 · 「This card's title carries two claims and only one is now discharged. The zero-output half has been chased twice and both cited occurrences dissolved on inspecti…」. So a question only the maintainer can answer is filed, well-formed and UNREACHABLE — it is in no inbox, no candidate query and no staleness alert, while the card's own state label — whichever of the six it is — reads as work in progress on every board, so nothing a reader can see says a decision is owed. ⚠️ This is the shape that produces three success signals and a wrong answer: the dev did its job, the report validated, the seat accepted it, and the decision never arrived. Remedy, in the order the protocol asks for it: if the question is the one this card was dispatched on, put the card in the inbox (needs-user-decision) and present it; if it is a RESIDUAL raised while EXECUTING a ruling this card already carries, ⛔ never re-hang the label here — file a NEW card carrying the question and linking the ruled one, because a re-flagged card leaves the inbox unable to say WHICH question is open and invites a reader to re-present a ruling that has already been executed, and because this card's close would take the label, and the question's only visibility, with it. If the question has already been ANSWERED, say so in the next report, whose empty open_questions` is the record that stands this row down. ⛔ Nothing here changes the report contract: the array is the right place for the question. Report-only patrol INPUT: nothing is blocked and no label is written.
  • H52 #11286 — the newest os-dev-report (comment 5393404811, 2026-08-24T09:39:41Z) carries 1 non-empty open_questions entry(ies) while the card carries NO needs-user-decision label: 「The card's own reasoning for the removal option rests on a dependency that does not exist. [finding] sys_user.manager_id now carries two independent organization screens, in two packages, with no shared code #11286 says 'plugin-approvals already depends on plugin-sharing, so t…」. So a question only the maintainer can answer is filed, well-formed and UNREACHABLE — it is in no inbox, no candidate query and no staleness alert, while the card's own state label — whichever of the six it is — reads as work in progress on every board, so nothing a reader can see says a decision is owed. ⚠️ This is the shape that produces three success signals and a wrong answer: the dev did its job, the report validated, the seat accepted it, and the decision never arrived. Remedy, in the order the protocol asks for it: if the question is the one this card was dispatched on, put the card in the inbox (needs-user-decision) and present it; if it is a RESIDUAL raised while EXECUTING a ruling this card already carries, ⛔ never re-hang the label here — file a NEW card carrying the question and linking the ruled one, because a re-flagged card leaves the inbox unable to say WHICH question is open and invites a reader to re-present a ruling that has already been executed, and because this card's close would take the label, and the question's only visibility, with it. If the question has already been ANSWERED, say so in the next report, whose empty open_questions is the record that stands this row down. ⛔ Nothing here changes the report contract: the array is the right place for the question. Report-only patrol INPUT: nothing is blocked and no label is written.
  • H26 #11333 — The wait is TRANSITIVE: #13458 is itself pm:blocked, so this card is waiting on a card that is waiting. A single-level predicate cannot see past one hop, and the measured chain was real one level up and FALSE two levels up (the target was an H19 finding on the same sweep — both of ITS blockers had closed). This row does not chase the chain; it says to look one level further.
  • H52 #11453 — the newest os-dev-report (comment 5401760566, 2026-08-24T21:43:12Z) carries 1 non-empty open_questions entry(ies) while the card carries NO needs-user-decision label: 「Non-blocking, for the contract-review tier: DELIVERY_NOT_ELIGIBLE is reused rather than minted, and the ledger's inline gloss for it (packages/spec/src/api/e…」. So a question only the maintainer can answer is filed, well-formed and UNREACHABLE — it is in no inbox, no candidate query and no staleness alert, while the card's own state label — whichever of the six it is — reads as work in progress on every board, so nothing a reader can see says a decision is owed. ⚠️ This is the shape that produces three success signals and a wrong answer: the dev did its job, the report validated, the seat accepted it, and the decision never arrived. Remedy, in the order the protocol asks for it: if the question is the one this card was dispatched on, put the card in the inbox (needs-user-decision) and present it; if it is a RESIDUAL raised while EXECUTING a ruling this card already carries, ⛔ never re-hang the label here — file a NEW card carrying the question and linking the ruled one, because a re-flagged card leaves the inbox unable to say WHICH question is open and invites a reader to re-present a ruling that has already been executed, and because this card's close would take the label, and the question's only visibility, with it. If the question has already been ANSWERED, say so in the next report, whose empty open_questions` is the record that stands this row down. ⛔ Nothing here changes the report contract: the array is the right place for the question. Report-only patrol INPUT: nothing is blocked and no label is written.
  • H26 #11753 — The wait is TRANSITIVE: objectstack-ai/objectui#7611 is itself pm:blocked, so this card is waiting on a card that is waiting. A single-level predicate cannot see past one hop, and the measured chain was real one level up and FALSE two levels up (the target was an H19 finding on the same sweep — both of ITS blockers had closed). This row does not chase the chain; it says to look one level further.
  • H19 #11973pm:blocked while 1 of 2 Blocked-by: target(s) — judged against the BODY's Blocked-by: set, the authoritative carrier whenever the body states one (a body is rewritten in place, a comment is an archive) — is CLOSED (#13689 (closed 2026-09-07T12:00:53Z)): the block has outlived its blocker. Nothing else here asks this question — H4 asks whether the line EXISTS, H14 asks the REVERSE index — so an expired block sits with a well-formed line, a correct label and no row anywhere: one measured card sat ~4.5h past its blocker's close and was found only by a human walking the graph, another was released only by a manual triage pass. 1 target(s) are still open (#11978), so this is a PARTIAL discharge and the card may still be legitimately blocked — the row reports it, it does not decide it. Report-only, and the release is NOT this script's to make: the state model gives it two mechanical double-checks (pm:blocked/pm:on-hold row, 「放行双查」) — ① release only against the condition carried by the MOST RECENT conversion comment, never an earlier blocker on the thread (a condition already spent, re-fired, reinstates an expired premise as the current one), and ② refuse to release when the card carries a MERGED PR newer than that conversion comment (the card moved on after the condition was written, so the cited fact can be true and no longer current). This row surfaces the candidate; the unlock sweep releases it — ⛔ never a label written from this script. When that release does happen it is the landed ACT — 「释放是显式动作:让卡离手者同笔清 assignee + Release: 行(会话/因/去向);下一任重新认领。」 — ONE write with TWO halves: it clears the assignee AND carries the Release: line (session, cause, destination). Dropping the field alone leaves no record of who let the card go, the half-state H47 reports. A card returned to pm:queue still carrying the assignee of the seat that parked it is dispatchable to the queue view and taken to the claim rule at the same time (H24), which is the state the unlock scan was measured leaving behind — ⚠️ agent identity only, a HUMAN assignment is ⛔ never cleared by an agent.
  • H26 #11973 — The wait is TRANSITIVE: #11978 is itself pm:blocked, so this card is waiting on a card that is waiting. A single-level predicate cannot see past one hop, and the measured chain was real one level up and FALSE two levels up (the target was an H19 finding on the same sweep — both of ITS blockers had closed). This row does not chase the chain; it says to look one level further.
  • H28 #11973pm:blocked whose BODY names 1 CLOSED Blocked-by: target(s) (#13689 (closed 2026-09-07T12:00:53Z)) while a COMMENT names 1 that is still OPEN (#11978) and appear(s) nowhere in the body — so the body line is STALE: it states a wait that is over, and the wait that is actually running is parked in the channel the body is supposed to be the canonical home for. This is the written half of a RE-PARK: a seat found the body's upstream closed, carded the real prerequisite, and wrote the new blocker into a comment (the cheaper, safer write) without spending the body line. ⚠️ Read what that costs before the migration: until the liveness read was ungated this card resolved ONLY the closed body target and was published as a card whose every blocker had closed — a FALSE unlock candidate, and one such card was released to pm:queue while its real blocker was open and dispatched. The row now fires alongside H19's PARTIAL discharge rather than instead of it: H19 says the block is half-expired, this says WHICH half is documentation. Remedy: rewrite the body line to name the live blocker (the comment stays as history), so the next reader — human or sweep — finds the current wait in the canonical home. ⛔ Report-only: never a body or a label written from this script.
  • H52 #11973 — the newest os-dev-report (comment 5474706712, 2026-08-31T06:39:20Z) carries 2 non-empty open_questions entry(ies) while the card carries NO needs-user-decision label: 「Out-of-repo half of the interim window: the enterprise organizations package's own wiring still triggers on grant inserts, which never fire on fresh walled rigs…」 · 「The walled-rig end-to-end acceptance criterion (design section 2 flow on a walled rig) is not reachable from this repo's harness; every unit-pinnable step is gr…」. So a question only the maintainer can answer is filed, well-formed and UNREACHABLE — it is in no inbox, no candidate query and no staleness alert, while the card's own state label — whichever of the six it is — reads as work in progress on every board, so nothing a reader can see says a decision is owed. ⚠️ This is the shape that produces three success signals and a wrong answer: the dev did its job, the report validated, the seat accepted it, and the decision never arrived. Remedy, in the order the protocol asks for it: if the question is the one this card was dispatched on, put the card in the inbox (needs-user-decision) and present it; if it is a RESIDUAL raised while EXECUTING a ruling this card already carries, ⛔ never re-hang the label here — file a NEW card carrying the question and linking the ruled one, because a re-flagged card leaves the inbox unable to say WHICH question is open and invites a reader to re-present a ruling that has already been executed, and because this card's close would take the label, and the question's only visibility, with it. If the question has already been ANSWERED, say so in the next report, whose empty open_questions is the record that stands this row down. ⛔ Nothing here changes the report contract: the array is the right place for the question. Report-only patrol INPUT: nothing is blocked and no label is written.
  • H26 #11975pm:blocked on 1 target(s) that can never CLOSE: #13515 (pm:on-hold). The unlock predicate is "the Blocked-by: target closed", and pm:on-hold / needs-user-decision are by definition states a card sits in WHILE OPEN — so this block has NO MECHANISM THAT WILL EVER RELEASE IT. Every existing check passes on this card (the line is present, the target resolves, the target is open, the label is correct), which is why the measured instances were found by a human reading and by no gauge; H9 asks the mirror question about the HELD card and nothing asked about the WAITING one. ⚠️ Not a claim that the block is wrong — waiting on a deferred card is sometimes exactly right. It says the wait is indefinite BY CONSTRUCTION, so the release has to come from the target's own state changing (a ruling answered, a hold restarted) and someone has to want that.
  • H26 #11978 — The wait is TRANSITIVE: #11975 is itself pm:blocked, so this card is waiting on a card that is waiting. A single-level predicate cannot see past one hop, and the measured chain was real one level up and FALSE two levels up (the target was an H19 finding on the same sweep — both of ITS blockers had closed). This row does not chase the chain; it says to look one level further.
  • H26 #11979 — The wait is TRANSITIVE: #11978 is itself pm:blocked, so this card is waiting on a card that is waiting. A single-level predicate cannot see past one hop, and the measured chain was real one level up and FALSE two levels up (the target was an H19 finding on the same sweep — both of ITS blockers had closed). This row does not chase the chain; it says to look one level further.
  • H52 #12237 — the newest os-dev-report (comment 5414190535, 2026-08-25T17:28:33Z) carries 3 non-empty open_questions entry(ies) while the card carries NO needs-user-decision label: 「The frontmatter title is one string serving four consumers (SERP <title>, on-page

    , sidebar nav label, llms.txt heading), and no field separates them. Apply…」 · 「The rule's own numbers need confirming before 176 files are rewritten: the card says '50-60 characters including the | ObjectStack suffix' but two of its thr…」, +1 more. So a question only the maintainer can answer is filed, well-formed and UNREACHABLE — it is in no inbox, no candidate query and no staleness alert, while the card's own state label — whichever of the six it is — reads as work in progress on every board, so nothing a reader can see says a decision is owed. ⚠️ This is the shape that produces three success signals and a wrong answer: the dev did its job, the report validated, the seat accepted it, and the decision never arrived. Remedy, in the order the protocol asks for it: if the question is the one this card was dispatched on, put the card in the inbox (needs-user-decision) and present it; if it is a RESIDUAL raised while EXECUTING a ruling this card already carries, ⛔ never re-hang the label here — file a NEW card carrying the question and linking the ruled one, because a re-flagged card leaves the inbox unable to say WHICH question is open and invites a reader to re-present a ruling that has already been executed, and because this card's close would take the label, and the question's only visibility, with it. If the question has already been ANSWERED, say so in the next report, whose empty open_questions is the record that stands this row down. ⛔ Nothing here changes the report contract: the array is the right place for the question. Report-only patrol INPUT: nothing is blocked and no label is written.

  • … 442 further row(s) omitted to fit GitHub's issue-body limit; the full list is in the workflow run log.

Family ledger — computed vs rendered, every row family (#13947)

What each row family COMPUTED this sweep, and how much of it reached the list above. rendered below computed means the body's size trim ate the difference; the full list is in the workflow run log. This table is RESERVED out of the render budget BEFORE the finding rows are laid out — the same reservation the H17 index, the H39 census and the H40 section hold — so the trim can never be what removes it. Rows above are ordered by the same band shown here (HALF_STATE_FAMILY_BAND), highest band first, so a row survives the trim on what it IS rather than on how many unrelated rows were laid out before it.

⚠️ 29 family(ies) had rows omitted by the body trim: H4 (0/13), H19 (3/21), H20 (0/2), H26 (6/15), H52 (7/23), H57 (0/3), H2 (0/2), H8 (0/4), H9 (0/73), H10 (0/2), H13 (0/4), H23 (0/2), +17 more in the table.

family band computed rendered
H4 stall 13 0
H19 stall 21 3
H20 stall 2 0
H26 stall 15 6
H28 stall 1 1
H38 stall 2 2
H52 stall 23 7
H57 stall 3 0
H2 state 2 0
H8 state 4 0
H9 state 73 0
H10 state 2 0
H13 state 4 0
H23 state 2 0
H24 state 2 0
H30 state 84 0
H44 state 35 0
H50 state 12 0
H54 state 6 0
H55 state 2 0
H56 state 6 0
H58 state 1 0
H62 state 2 0
H63 state 6 0
H64 state 10 0
H5 inventory 7 0
H6 inventory 10 0
H11 inventory 73 0
H14 inventory 21 0
H15 inventory 1 0
H61 inventory 16 0

Computed 0 row(s) this sweep, and therefore absent from the table (27): H1, H3, H7, H12, H16, H18, H21, H25, H27, H29, H31, H32, H33, H34, H35, H36, H37, H43, H45, H46, H47, H48, H49, H51, H53, H59, H60. These families were EVALUATED and found nothing — they have no rows to omit. Every family that computed a row is IN the table with its count, whether or not the trim left any of that row family in the body above, so a family missing from the list of findings is never ambiguous between the two readings.

Dangling references (H40)

126 number(s) referred to by the live board do NOT resolve, and 0 could not be judged. ⛔ Report-only, and ⛔ no cause is asserted: a number can fail to resolve because it was deleted, transferred, or made unreachable, and this sweep cannot tell those apart — a reference that fails is a fact, everything after it is a question for a human. ⛔ Do not rewrite the referring text and do not close anything; if a number returns, the reference was always correct. 400 resolution(s) attempted of 6166 distinct # reference(s) read off 2038 live-board text(s) (516 open card(s)/PR(s) + 211 already-cached comment thread(s)); 998 answered free from listings in hand, 4768 NOT ATTEMPTED at the 400-resolution budget (attempted down to #15917), 1 above #18093, the highest number this sweep saw.

On-hold trigger-file index (H17)

Before dispatching, intersect your dispatch's file surface against this list and NAME any card it hits in the dispatch brief. These are the trigger files open holds declare — the opportunistic-restart mechanism (maintainer-accepted 2026-08-11) whose intersection was measured at 0-for-19 while it lived only as a remembered protocol step (#10034). Report-only: a card here is a hold in good standing, never a finding. Extraction is deterministic — every path shown is a tracked file; anything unverifiable was dropped rather than guessed, so this list under-reports and never invents. (read on 104 of 104 open pm:on-hold card(s); 8643 tracked file(s) in the oracle.)

  • #2657packages/spec/src/automation/webhook.zod.ts, packages/spec/src/integration/connector.zod.ts, packages/spec/src/kernel/metadata-plugin.zod.ts, packages/spec/src/kernel/metadata-type-schemas.ts, packages/spec/src/security/sharing.zod.ts
  • #6009packages/drivers/driver-sql/src/sql-driver.ts
  • #6736packages/plugins/plugin-sharing/src/sharing-service.ts
  • #7401packages/plugins/plugin-security/src/security-plugin.ts
  • #8345packages/services/service-analytics/src/analytics-service.ts, packages/spec/src/data/currency-fraction-digits.ts, packages/spec/src/data/field.zod.ts
  • #8346docs/PLATFORM_GAPS_FROM_TEMPLATES.md, packages/spec/src/ui/view.zod.ts
  • #8347packages/client/src/realtime-api.ts, packages/runtime/src/http-dispatcher.ts
  • #8740packages/drivers/driver-sql/src/sql-driver.ts
  • #8897scripts/check-durability-degradation-log-level.mjs
  • #8966content/docs/deployment/meta.json, content/docs/meta.json
  • #9139packages/lint/src/data-model-rules.ts, packages/lint/src/validate-security-posture.test.ts
  • #10315scripts/check-cross-package-test-inputs.mjs
  • #10572examples/app-todo/package.json
  • #10694scripts/check-cross-package-test-inputs.mjs
  • #11331packages/cli/src/utils/osplugin.ts, packages/core/src/security/plugin-artifact-integrity.ts
  • #12576scripts/durability-read-invention.baseline.json
  • #12789packages/objectql/src/registry.ts
  • #12799scripts/check-type-check-coverage.mjs
  • #13528packages/services/service-storage/src/metadata-store.ts, packages/services/service-storage/src/storage-routes.ts
  • #13542packages/plugins/plugin-security/src/security-plugin.ts
  • #13776packages/rest/src/rest-route-ledger.ts, packages/runtime/src/route-ledger.ts
  • #14121packages/metadata/src/loaders/database-loader.ts
  • #14169packages/drivers/driver-mongodb/src/mongodb-driver.ts
  • #14290scripts/objectui-changeset-digest.mjs, scripts/pm/dispatch-gates.mjs
  • #14490.objectui-sha, scripts/sdui-manifest.record.json
  • #16173scripts/test-shard-timings.json
  • #16222scripts/test-shard-timings.json

Decision-box dependency flags (instruction ④)

Report-only and derived at READ TIME: a card below is an open needs-user-decision card that at least one OPEN card's Blocked-by: line names, and ⛔ no priority label is written for it. The standing instruction this discharges, verbatim: 「④(决策箱依赖旗标,2026-08-11 维护者裁决):每轮收尾简报的决策箱段须标注带有 open 下游依赖的决策卡(判据:任一 open 卡的 Blocked-by: 行指向它;读时派生,⛔ 不打优先级标签)。」 It is one lookup over the same reverse index H14 is judged against — no second channel and no second parser (#17968).

No open decision card is named by any open card's Blocked-by: line. The inbox was READ — this is a clean reading, not an unread one.

0 of 3 open needs-user-decision card(s) have an open downstream dependent.

NOT MEASURED beside it: 13 open pm:blocked card(s) carry no machine-readable Blocked-by: line in EITHER channel — H4's own count, reused rather than re-derived. Whatever those cards wait on cannot appear above. ⛔ Cite BOTH numbers or write NOT MEASURED: the flag count alone is a number that ran, and therefore reads as complete.

Population scope: dependent BODIES are read from every open issue in this repo (the unscoped listing); dependent COMMENTS only from open pm:blocked / pm:blocking cards whose body carries no Blocked-by: line. A dependent that states the wait in a comment and carries neither label, and any dependent in a sibling repo, is outside this reading — unread, not absent.

Closed-card pm:* residue (H39 census, informational): pm:dispatched 2069, pm:queue 858, pm:blocking 39, pm:blocked 20, pm:on-hold 14, pm:awaiting-maintainer 1, oldest closed 2026-08-02; 555 carrying both pm:queue and pm:dispatched. H22's 3-day closure window, read separately, holds 2 of 266 closed card(s) still carrying residue (pm:dispatched 2). Archive, not state — no cleanup is owed and none is planned (ruled 2026-08-31, 批 #13); readers scope pm:* queries to open cards, and that reason reaches a residue two hours old exactly as it reaches one from August, which is why the window above is counted here rather than filed as rows (#14072).

rate premise OK — observed ~102.4/day against pinned MEASURED_MERGES_PER_DAY = 137.5/day, measured 2026-08-23 (22d ago) (factor 0.74, band 2x).

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions