feat(pm): two report-only patrol rows — the decision card's four-facet block, and finding outliving its grade

.github/workflows/lint.yml

@@ -1232,6 +1232,38 @@ jobs:
       - name: Board-snapshot archiver self-test
         run: pnpm check:pm-board-snapshot
 
+      # Stale-`finding` sweep self-test (#16904) — same family and the same
+      # split as every step around it, and the split matters more here than for
+      # most: this tool WRITES. Its live path removes a label from real cards on
+      # a shared board, so a production run from CI would relabel the board
+      # because a pull request happened to run — the offline half is the only
+      # half CI can hold, and the sweep itself is run once per board, by hand,
+      # by the seat that owns that board.
+      #
+      # Until this step existed the instrument was UNFIRED: the tool shipped a
+      # 91-case `--self-test` that nothing in CI ran, which is the second half
+      # of the pair `check:self-test-wired` exists for (a script is IN its
+      # population only once a workflow names it, so an unwired tool's self-test
+      # is not a hole the gate can see — it is a hole only this step closes).
+      #
+      # What the self-test instruments is the set of rules a clean tree cannot
+      # exercise: the screen's ungraded verdict, which is the ONE thing the
+      # sweep must never strip (「`finding` ALONE is NOT stale」), the `pm:seat`
+      # refusal, the four-step write's read-back and its refusal on a raced
+      # label set, the batch caps and the resume cursor a 403 leaves, and the
+      # exit register that keeps "could not read the board" apart from "the
+      # board is clean". Weakening any of them leaves an ordinary run just as
+      # green — it would simply strip fewer cards, or more — and a wrong strip
+      # here is a write against a shared board, not a report.
+      #
+      # Since #16904's D2 the screen itself lives in `check-half-states.mjs` and
+      # this tool imports it, so the patrol row that REPORTS the population and
+      # the sweep that STRIPS it read one rule; the patrol's own self-test pins
+      # that this file still aliases that definition rather than re-growing a
+      # copy of it.
+      - name: Stale-`finding` sweep self-test
+        run: pnpm check:pm-stale-finding
+
       # Changeset-deadline census self-test (#16850) — same family and the same
       # split as every step around it. The LIVE census reads the shared board
       # over the API and is REPORT-ONLY by ruling: #16850 takes option 1 (detect

package.json

@@ -81,6 +81,7 @@
     "check:pm-widening-tells": "node scripts/pm/check-widening-tells.mjs --self-test",
     "check:pm-prior-rulings": "node scripts/pm/check-prior-rulings.mjs --self-test",
     "check:pm-closed-card-sweep": "node scripts/pm/sweep-closed-cards.mjs --self-test",
+    "check:pm-stale-finding": "node scripts/pm/sweep-stale-finding.mjs --self-test",
     "check:pm-post-stamped": "node scripts/pm/post-stamped.mjs --self-test",
     "check:pm-board-snapshot": "node scripts/pm/board-snapshot.mjs --self-test",
     "check:pm-changeset-deadline-census": "node scripts/pm/changeset-deadline-census.mjs --self-test",