fix(pm): the half-state patrol's seat legs read the triage post and the newest page — H44 reaches a vacant or Routine seat, H32 / H38 take their marker from the last page by claude[bot] · Pull Request #18332 · objectstack-ai/objectstack

claude · 2026-09-15T19:30:00Z

Two defects in one file, scripts/pm/check-half-states.mjs, both of the same shape: a seat
leg reading a seat post through the wrong population or the wrong window while the file
already declares the right one. Each is fixed by pointing the leg at that declaration.

1 — H44's seat leg could not reach the triage post it was written for

h44NeedsSeatComments was pm:seat + seatIsHeld, and seatIsHeld excludes a
🟢 Routine holder by name and every non-🟢 status. The triage seat runs as a Routine or
sits vacant most of the time — it read [PM seat] triage (objectstack-wide) — 🔴 空缺 …
throughout this work — so H44, H56 and H64 read NOTHING on the one post H44's own header
names as its worked example (「carrier of the round-open marker that is this card's worked
example」), while H65 read it every run through h65IsTriageSeatPost, which carries no
held gate.

The gate now admits the triage post through that same predicate, beside the held leg
rather than instead of it, so the file keeps ONE reading of 「is this the triage post」.

Measured cost: zero additional requests. H65 already buys exactly that page every run
through the shared seatPostRowsFor memo, so the widening only moves which row asks first.

⛔ No vacant-seat posture is owed, and that is measured rather than assumed. All three
rows accuse a COMMENT and name its author; none names the post's current holder, so
「nobody is on the clock」 changes nothing about whether an artefact on the thread states a
reading with no time on it. On the vacant triage post's newest page (18 comments,
2026-09-10T23:26:55Z → 2026-09-15T15:54:40Z) H44 files one carrier row naming 10 offending
comments, H56 files 0 and H64 files 0 — confirmed offline before the change and reproduced
exactly by the live run after it.

The design choice, on the four axes

Option A was to widen the gate to the triage post; option B was to keep the held gate and
rewrite the header to say the seat leg reaches only HELD posts. A, on all four axes —
the dispatching seat's reading is confirmed, not refuted.

实际业务需求 — measured, not inferred: the triage post carries 10 comments H44's own
grammar flags, 0 of them visible to the row today, on the busiest artefact producer on
the board (818 comments, 18 of them in the last five days). B leaves a report-only row
structurally unable to observe its own subject, which is dead letter.
项目长远合理性 — the file already declares both halves this needs (h65IsTriageSeatPost
for the population, seatPostRowsFor for the window). A hands the leg those declarations;
B is the workaround shape, correcting prose to match behaviour nobody wants.
防 AI 写代码犯错 — these three rows are exactly the ones that catch AI-written artefacts
stating a reading with no time on it or naming no session, and the triage post is where AI
seats write most. Declaring a purpose in the header that the runtime does not honour is the
anti-pattern this axis names. The held gate is an argument about ACCUSING A NAMED HOLDER of
idleness — H32's subject, not this row's; inheriting it was the category error.
创业阶段不扩散需求 — not a capability expansion: no new row, no new rule, no new request,
one new finding on the live board. It makes an existing declared row reach the population
its own header already claims, in the narrow spelling already in the file. 声明而未兑现是
实现缺口,补实现或退役 — the implementation is supplied. Immediate, no staged window.

2 — H32 and H38 read a seat post's OLDEST comment page

The seatMarkers gather captured commentRowsFor's page-less FIRST page, and GitHub serves
issue comments oldest-first, so latestSeatMarker returned the newest row of page 1. That row
is H32's idle clock and carries H32's wait exemption, and it is H38's T_seat.

Measured on the live board:

seat post	comments	page-1 newest	real newest	stale by
#6023	225	2026-08-27T16:38:35Z	2026-09-14T11:41:59Z	18 days
#6367	137	2026-09-04T07:56:39Z	2026-09-10T17:55:24Z	6 days
#7623	63	2026-09-15T09:00:39Z	2026-09-15T09:00:39Z	single page, identical

On #6023 the wait exemption was being judged on an August comment. The gather now takes the
window through seatPostRowsFor. It buys nothing new — this population is a subset of
H44's seat leg, the memo is shared, and asking here only makes the gather loop the first
asker; the page-less fetch it replaces was itself wasted, because H44's leg overwrote that
cache entry a pass below. latestSeatMarker's contract is unchanged, and a null page is left
out of seatMarkers exactly as the throw was.

⚠️ H38's live verdicts do not move, and the reason is pinned rather than left to be
discovered: seatPostLastEventMs maxes the comment stamps against the post's own
updated_at, and GitHub bumps that field whenever a comment is added, so the post's own
field already dominates. The page choice decides T_seat exactly where updated_at cannot
— a comment EDITED after the post's last bump, which is the one 「seat writing home」 signal
that lives only in the rows. Two self-test cases pin both halves of that.

Reverse verification

Ablation, per card, from the committed state (mutation proven on disk by blob hash before
each reading; restored with git checkout HEAD -- <path>, restore proven by an empty
git diff HEAD and a blob hash equal to HEAD's):

Card 1 — revert the predicate leg, keep its cases ⇒ 3 cases red by name:
H44 gate: ⭐ a VACANT triage post IS fetched — the held leg alone made this row dead letter on it,
H44 gate: ⭐ …and a 🟢 Routine triage post too, which seatIsHeld excludes BY NAME,
H65 scope: ⭐ H44's seat leg now REACHES the Routine triage post, through this very predicate.
Card 2 — revert the capture to the page-less read, keep its cases ⇒ 1 case red by name:
seat window: …and taken through the memo by more than one row, which is what makes it shared
(got 2, want 3). ⚠️ Stated precisely: that source-text pin is the ONLY case that can observe
this, and the file says why in seatWindowAudit's own header — the window lives inside
sweepInto, which takes no injectable transport, so the property a spy would prove has to be
proved on the text. The other 16 cases of this card pin the CONTRACT (which marker and which
T_seat each window yields) at function level and stay green under the ablation by
construction. That is the designed instrument, not a gap discovered late.

seatWindowAudit, before → after: pagelessPaths 1 → 1 · commentPaths 4 → 4 ·
purchaseSites 1 → 1 · readers 2 → 3. Only the reader count moves, and its pin is
rewritten in place with the superseded statement quoted above it.

Live patrol, origin/main de9c319a vs this head, both exit 0, same corpus both runs
(408 open pm-/p0-labeled, 507 unscoped, 13 open PRs, 683 recently-merged PRs):

family	origin/main	this head
H32	0	0
H38	1	1
H44	29	30
H56	6	6
H64	10	10
H65	1	1

Total half-states 476 → 477. The one row that moved is H44 #6015 — the vacant triage
post — naming comment 5626818520 as the oldest of 10 offending comments on it, which is
the offline prediction reproduced exactly. No row was lost. Coverage clause: the seat leg
reads 4 of 4 on origin/main and 5 of 5 here; H44's corpus 1488 comments across 398
threads → 1506 across 399, the 18 added being exactly the triage post's newest page; H32's
3 of 3 and H65's 1 of 1 are unchanged.

⚠️ A third commit was needed for that coverage clause: the live run printed
5 of 5 HELD seat post(s) while one of the five was the vacant triage post. Both readings
are legal English, so only a live run could catch it. The clause now names both legs; the
pin that asserted the HELD wording is rewritten in place, not deleted.

Self-test: 4235 on the old base → 4245 after card 1 → 4261 after card 2 → 4269 after
taking main in (PR #18326's 8 cases) → 4270 after the coverage-clause pin. Three pins
were rewritten in place rather than deleted, each with its superseded statement quoted above
it: the H65 scope case that asserted H44's gate reads false on a Routine triage post, the
audit's reader count, and the H44 coverage clause's HELD wording.

Gates

All 41 commands derived by node scripts/pm/dispatch-gates.mjs --commands scripts/pm/check-half-states.mjs
were run at this head and reconciled with --ran; the battery pnpm check:pm-dispatch-gates
is among them. ESLint on the file is clean, and the file carries no control bytes.

Acceptance notes

Out of scope, noted and not filed: the seat-post window is now correct for every reader, but
the property is only observable from source text, because the window lives inside sweepInto
which takes no injectable transport — a spy-able seam would let a case assert the gather's
window directly instead of counting call sites. Successor: whoever next edits sweepInto's
transport; nobody is queued on it today, and inventing the seam under these two cards would
have widened the surface well past them.

Non-governed (scripts/pm/**) — left DRAFT for the owning seat to land in-seat after review.
No reviewers requested, no auto-merge armed, no ccr route touched. skip-changeset: nothing
published moves — scripts/pm/** is not in any package's files[].

Fixes #18324
Fixes #18325

Generated by Claude Code

…18324) `h44NeedsSeatComments` was `pm:seat` + `seatIsHeld`, and `seatIsHeld` excludes a `🟢 Routine` holder by name and every non-🟢 status. The triage seat runs as a Routine or sits vacant most of the time — it read `🔴 空缺` on the live board at the filing — so H44, H56 and H64 read NOTHING on the one post H44's own header names as its worked example, while H65 read it every run through `h65IsTriageSeatPost`. The gate now admits the triage post through that same predicate, beside the held leg rather than instead of it: the file keeps ONE reading of 「is this the triage post」. Measured cost: ZERO additional requests, because H65 already buys exactly that page every run through the shared `seatPostRowsFor` memo, so the widening only moves which row asks first. ⛔ Not a vacant-seat posture, and that is measured rather than assumed: all three rows accuse a COMMENT and name its author, never the post's holder. On the vacant triage post's newest page (18 comments, 2026-09-10 → 2026-09-15) H44 files one carrier row naming 10 offending comments, H56 files 0, H64 files 0. H32's population is untouched — its subject is an accusation that a named holder is not working, which is what the held gate is for. Self-test 4235 → 4245 cases. The H65 case that pinned the old behaviour is rewritten in place, not deleted, with the superseded statement quoted above it. Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HZfg2AwVX191qCizp88gQr

…ge (#18325) The `seatMarkers` gather captured `commentRowsFor`'s page-less FIRST page, and GitHub serves issue comments OLDEST-FIRST, so `latestSeatMarker` returned the newest row of page 1. Measured on the live board: #6023's 225-comment thread yielded 2026-08-27T16:38:35Z while its real latest marker was 2026-09-14T11:41:59Z, 18 days newer; #6367 yielded 2026-09-04 against a real 2026-09-10. That row is H32's idle clock AND carries H32's wait exemption, and it is H38's `T_seat` — so the one reading on a seat post that must be the newest was the oldest page the endpoint serves. The gather now takes the window through `seatPostRowsFor`, the file's one declaration of a seat post's window. It buys nothing new: this population is a SUBSET of H44's seat leg, the memo is shared, and asking here only makes the gather loop the first asker. The page-less fetch it replaces was itself wasted — H44's leg overwrote that cache entry a pass below. `latestSeatMarker`'s contract is unchanged; a null page is left out of `seatMarkers` exactly as the throw was. ⚠️ H38's live verdicts rarely move, and the self-test pins why rather than leaving it to be discovered: `seatPostLastEventMs` maxes the rows against the post's own `updated_at`, which GitHub bumps on every new comment, so the page choice decides `T_seat` exactly where that field cannot — a comment EDITED after the post's last bump. `seatWindowAudit`'s reader pin is rewritten 2 -> 3 with the superseded statement quoted above it; its page-less (1), commentPaths (4) and purchase-site (1) readings are unchanged. Self-test 4245 -> 4261 cases. Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HZfg2AwVX191qCizp88gQr

Takes in PR #18326 (the H44_READING_TIMESTAMP region and its cases), which landed on main while this branch was in flight. Different regions of the same file; no conflict. Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HZfg2AwVX191qCizp88gQr

The live run on the widened leg printed `5 of 5 HELD seat post(s)` while one of those five was the VACANT triage post — the clause described its own count wrongly on every run. Measured against `origin/main`: the leg reads 4 of 4 there and 5 of 5 here, and the fifth is #6015. The clause now names both legs. Its numbers are unchanged, and the existing pin that asserted the HELD wording is rewritten in place with the superseded string quoted above it, plus one new pin on the two-leg sentence. Split from the first commit of this branch because the defect was only visible in a live patrol run taken after it — the self-test pins the clause's substrings and both readings are legal English. Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HZfg2AwVX191qCizp88gQr

claude · 2026-09-15T19:38:09Z

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 432a90a2ede6ce9a247a51ddc9a586d4be88a1a7

Reviewing seat: domain:skills, in-seat review at the contract-review tier — get_session read at 2026-09-15T07:15Z: configured_model = session_context.model = last_served_model, the constant's tier, no fallback notice this round. Fold of #18324 (chain head, claim 5685974564 — the five fold gates answered there) and #18325 (member, claim 5685976942); report 5686964968 on the chain head (posted through the tool; read back clean); Clause-②: no on both claims; default-tier build, seat review at tier.

① Derived judgments

Accept set / public surface: none moves — scripts/pm/check-half-states.mjs (+224/−33, the only file) against merge base de9c319a (= origin/main; the dev merged it in after PR fix(pm): H44's timestamp leg accepts an ISO instant whose hour follows a T — the ruled minute spelling no longer reads as untimestamped #18326 landed, no conflict — different regions of the same file); nothing published; skip-changeset read back (size/m + skip-changeset). Non-governed ⇒ in-seat landing. Four commits: one per card in order ([finding] check-half-states: H44's seat leg cannot reach the triage seat post it was written for whenever that seat is 🟢 Routine or vacant — h44NeedsSeatComments requires seatIsHeld, so the newest-page window is inert on #6015 until a session holds the seat #18324 af8877ed, [finding] check-half-states: H32 and H38 read a seat post's OLDEST comment page for the one reading that must be the newest — latestSeatMarker returns the newest row OF THE FIRST PAGE, which on a 225-comment post is an August comment, and that is H32's idle clock and H38's T_seat #18325 4c022746), the merge 8f1f9e42, and a third scoped to [finding] check-half-states: H44's seat leg cannot reach the triage seat post it was written for whenever that seat is 🟢 Routine or vacant — h44NeedsSeatComments requires seatIsHeld, so the newest-page window is inert on #6015 until a session holds the seat #18324 (432a90a2, the summary clause's own count word — the live run showed 「5 of 5 HELD seat post(s)」 while one was the vacant triage post) — accepted, scoped in its subject.
The change, read whole on a detached worktree of the head: [finding] check-half-states: H44's seat leg cannot reach the triage seat post it was written for whenever that seat is 🟢 Routine or vacant — h44NeedsSeatComments requires seatIsHeld, so the newest-page window is inert on #6015 until a session holds the seat #18324 — h44NeedsSeatComments becomes seatIsHeld(issue) || h65IsTriageSeatPost(issue) (the file's one reading of 「is this the triage post」, reused beside the held leg, never instead of it), the H44 header and the :9608 banner state the measured cost (ZERO — H65 already buys that page every run through the same memo) and why no vacant-seat posture is owed (the three rows accuse a COMMENT and its author, never the holder); the summary clause reads 「every HELD seat whatever its lane spelling, PLUS the TRIAGE post whether or not it is held」; eleven cases added, two rewritten in place with the superseded statement quoted. [finding] check-half-states: H32 and H38 read a seat post's OLDEST comment page for the one reading that must be the newest — latestSeatMarker returns the newest row OF THE FIRST PAGE, which on a 225-comment post is an August comment, and that is H32's idle clock and H38's T_seat #18325 — the seatMarkers gather reads seatPostRowsFor (the NEWEST page, memoised; a null page leaves the seat out per the check:react-declaration-parity 是唯一没接进任何 workflow 的源码审计门禁,且无 MANIFEST 时静默 skip 退出 0 —— 它现在永远不可能红 #4690 rule) instead of a page-less commentRowsFor; latestSeatMarker's contract untouched; H38's placement argument rewritten to say what moved (the WINDOW, not the population) and why the live verdict rarely moves (seatPostLastEventMs maxes the rows against the post's own updated_at, which GitHub bumps on every new comment — the page decides T_seat only for a comment EDITED after the last bump); the :9641 price paragraph rewritten; sixteen cases added on the measured [PM seat] domain:devx @ objectstack — 🟢 os-try-charles · session_017ef78bLdybu3AffehKkhfk · 本班第 64 轮 · 已落地 51 · 关卡 39 · 在飞 1(#19008)· 已复核待武装 1(PR #19159)· 等人工合 1(PR #18414)· 决策箱 2(#16303 · #13503)· 等字母 3 · 待改判 p1 1(#18671)· 呈分诊路由 4 张(workflows 面)· ⚠️ p2 队列 11 张可派 0 张 · 新立 50 卡 #6023 shape (page 1 → August marker, ~19-day idle, the exemption read off an August comment; the newest page → the real marker, both T_seat cases, the H38 verdict flip STALE → CLEAN, the population unmoved), seatWindowAudit's reader pin 2 → 3 rewritten with the old statement quoted. The seat's pure probes on both trees agree with the report: a vacant or Routine triage post reads h44 false → TRUE, h32 false → false, h65 true → true; a held domain:* seat true/true both; a vacant domain:* seat false/false both. Self-test 4243 / main → 4270 / head (4235 → 4245 → 4261 → 4269 after the merge → 4270); ESLint 0/0; check-self-test-wired OK; --pair 18332 0 for BOTH cards; the seat's battery on its worktree is reported in the provenance.
Gates 41 / 41 / 0 / 0 by --ran on the head; the battery 488.7 s, 1730 pass (dev). Reverse verification: per-card ablations from the committed state with blob proofs — [finding] check-half-states: H44's seat leg cannot reach the triage seat post it was written for whenever that seat is 🟢 Routine or vacant — h44NeedsSeatComments requires seatIsHeld, so the newest-page window is inert on #6015 until a session holds the seat #18324's predicate leg reverted → 3 of 4269 red by name; [finding] check-half-states: H32 and H38 read a seat post's OLDEST comment page for the one reading that must be the newest — latestSeatMarker returns the newest row OF THE FIRST PAGE, which on a 225-comment post is an August comment, and that is H32's idle clock and H38's T_seat #18325's gather reverted → exactly 1 red (the audit's reader count — the only case that can observe the gather, stated precisely: the window lives inside sweepInto, which takes no injectable transport, the same instrument [finding] check-half-states: H44's seat leg is blind on the triage seat post it was written for — its corpus is the thread's FIRST comment page (oldest-first, five weeks stale on #6015) and H44_ROUND_OPEN_MARKER no longer matches the marker spelling; H56 / H64 share the corpus #18312 used); both restored, git diff HEAD empty. Live patrol, control on de9c319a vs head, corpus identical (408 / 507 / 13 / 683): H44 29 → 30 (the one row added is [PM seat] triage (objectstack-wide) — ⚪ 座位空缺 · 前任 session_01Y6AwMBAN8zRUHgmgFdV1Qr 执「全板大扫除试运行」班 2026-09-19T01:5xZ 奉维护者令收班 · 收班简报 5738544201 · ⛔⛔ 本班一次影响 8 张卡的误判已全部回滚,接手先读正文「本班(大扫除试运行班)收班交接台账」再定级 · ⛔ 无自绑 Routine,座位不会自己醒 · 跨席请求欠 3 条 #6015, the vacant triage post, naming the oldest of 10 offending comments — the offline prediction reproduced), H32 0 → 0, H38 1 → 1, H56 6 → 6, H64 10 → 10, H65 1 → 1; the seat leg 4 of 4 → 5 of 5, H44's corpus 1488 → 1506 comments (exactly the triage post's newest page); what moved for H32 / H38 is the input's honesty — [PM seat] domain:devx @ objectstack — 🟢 os-try-charles · session_017ef78bLdybu3AffehKkhfk · 本班第 64 轮 · 已落地 51 · 关卡 39 · 在飞 1(#19008)· 已复核待武装 1(PR #19159)· 等人工合 1(PR #18414)· 决策箱 2(#16303 · #13503)· 等字母 3 · 待改判 p1 1(#18671)· 呈分诊路由 4 张(workflows 面)· ⚠️ p2 队列 11 张可派 0 张 · 新立 50 卡 #6023's marker 2026-08-27 → 2026-09-14, [PM seat] domain:engine — ⚪ VACANT · last seat session_01CqmCgU5RGDoJYhHUMVp2af, stood down 2026-09-17T22:01Z #6367's 2026-09-04 → 2026-09-10, the wait exemption no longer read off an August comment. The dev re-took the control on de9c319a in a second worktree because PR fix(pm): H44's timestamp leg accepts an ISO instant whose hour follows a T — the ruled minute spelling no longer reads as untimestamped #18326 alone drops 13 H44 carriers — attribution kept clean.

② Semver level

Not applicable — nothing published moves; skip-changeset measured.

③ Boundary flags

open_questions: none. Three seat premises refuted and owned here: 「the three multi-page HELD seat posts are #6021, #6023, #6367」 — #6021 reads vacant since 17:29Z; the held posts are #6023 / #6026 / #6367 / #7623, the multi-page ones #6023 and #6367 (changes nothing about the fix); 「widening costs additional requests」 — zero, by construction and by the identical H65 clause on both runs; 「a vacant-seat posture may be owed」 — no, measured on the live post's newest page (H44 1 carrier row, H56 0, H64 0; all name a comment). The seat's reading of option A is CONFIRMED on the four axes. Four deviations answered: three commits, not two — accepted (the third scoped and explained; a merge commit was not rewritten); the PR opened after the reverse verification — accepted (one PR create, no body PATCH, the readings had to be in the body); the control taken on de9c319a, not the chronologically first run — accepted, it is the honest baseline; a second control worktree — accepted (no stash, no HEAD move). Out of scope: noted, not filed — a spy-able seam for sweepInto's transport (dedupe words in the report; nobody queued on it); the harness post_turn_summary on the dev's container read 「PR #18332 merged」 while the PR was open and draft — a harness-written field, reported not corrected, and the landing shape was not breached (read back by this seat: draft, no reviewers, no auto-merge, size/m + skip-changeset). Landing: in-seat once every check on this head is green — ready through the CCR route, auto-merge SQUASH, the enqueue event and the queue ref read, provenance below; both cards stay pm:dispatched until the three landing readings.

Implemented-by: claude/issue-18324-seat-legs-window-population
Reviewed-by: session_01HZfg2AwVX191qCizp88gQr

VERDICT: PASS

Generated by Claude Code

claude · 2026-09-15T19:47:35Z

Landing provenance — skills seat, session session_01HZfg2AwVX191qCizp88gQr, 2026-09-15T19:47Z. Non-governed landing (scripts/pm/check-half-states.mjs only; the fold of #18324 and #18325): review of record 5687020469 PASS on head 432a90a2ede6ce9a247a51ddc9a586d4be88a1a7, ACCEPT 5687020859 on the chain head #18324, member record 5687021250 on #18325; every check on that head read green at 2026-09-15T19:46Z (26 success / 11 skipped / running none / failed none); the seat's own battery on a detached worktree of the head: dispatch-gates self-test: 1730 cases pass. · 488.3s on this box., exit 0. The seat flipped the PR ready through POST …/pulls/18332/ccr/ready_for_review and armed auto-merge SQUASH through PUT …/pulls/18332/ccr/auto_merge (the echo is not the reading); the ready_for_review event reads 2026-09-15T19:46Z and the added_to_merge_queue event two seconds later, both by claude[bot]; the queue ref refs/heads/gh-readonly-queue/main/pr-18332-de9c319a… read 1 twenty seconds after the enqueue (a lone entry, chained on de9c319a). Landing is confirmed by the three readings (merged_at + git log origin/main carrying (#18332) single-parent + the queue ref gone) at the next wake; then both cards' residue is stripped and the landing records posted. scripts/pm/check-half-states.mjs is then held by no open PR of this lane.

Generated by Claude Code

… skip is not a failure, and a check reports the skips outside the declared roster (objectstack-ai#18357) Fixes objectstack-ai#18308 ## What `.claude/skills/pm-dispatch/SKILL.md` :629 read 「入队资格 = PR 上每一个 check 全绿,⛔ 不是 required 子集;required 集是队列强制的地板。」 — a bar no landing on this repository can satisfy, because `skipped` is the ordinary conclusion of a path-filtered job and the charter defined no state for it. Measured over the ten most recent landed heads (below), every head carried 8–19 skipped check-runs beside its successes; the seat's landings read 「success = green, skipped = not failed」 by an unstated convention. Two changes, both inside the claimed file surface: 1. **SKILL.md :629, re-keyed in place** (112 B → 119 B, ≤120 B; 812 → 812 lines; no issue number): > `- 入队资格 = 每个 check 为 success 或预期 skip(名单:check-expected-skips.mjs),⛔ 不是 required 子集。` The bar now names the two states a check may be in — `success`, or an expected skip — and points at the one machine-readable roster of expected skips. The third clause of the old line (「required 集是队列强制的地板」) did not fit the byte ceiling and is carried by AGENTS.md §7 (「the queue enforces only the required set」); the ⛔ clause is kept verbatim. 2. **`scripts/pm/check-expected-skips.mjs`** (new; `package.json` gains `check:pm-expected-skips` = its `--self-test`): given `--pr N` or `--head SHA` (or a pre-fetched payload via `--check-runs-json FILE|-`), it reads the head's check-runs and judges every `skipped` run against a roster declared once, in the file, as data with a one-line reason per row. Exit register: **0** every skip is in the roster · **4** a skip is outside it (each named and classified: a filter miss, or a dependency skip when the same check suite holds a failed run; a raw `matrix` template in the name is read as "skipped before matrix expansion, i.e. a job-level gate — never a workflow-level `paths:` filter, which creates no check-run at all") · **3** NOT MEASURED (unresolvable sha, 404, network, no check-runs on the head, or a check-run still running — the skip set is not final). Report-only; the self-test pins structurally that the file carries no `method:` key and imports no writer. The roster is **tied to the workflows, not remembered**: `--self-test` parses each row's workflow with the `yaml` package and asserts the job exists, carries the row's name, carries an `if:`, that the `if:` spells the declared gate (`needs.filter.outputs.X != 'false'`, the `github.event.action` exclusion, or the label literal), and — for ci.yml rows — that the `filter` job's output keeps its `|| 'true'` widening, which is what makes "the merge-queue build runs it" true. The audit is driven red in the self-test on a deleted, renamed, un-gated and re-gated job, a lost widening and an unreadable workflow. ## The roster (11 names), measured over ten landed heads | name | workflow › job | mechanism | over the ten heads | |---|---|---|---| | `Build Core` | ci.yml › build-core | `filter` output `core` said false; REQUIRED context, judged on the queue build | skipped 10/10 | | `Temporal Conformance (live PG + MySQL)` | ci.yml › temporal-conformance | same, REQUIRED context | skipped 10/10 | | `Dogfood Regression Gate (${{ matrix.shard }}/3)` | ci.yml › dogfood | same; raw matrix template = pre-expansion name (the aggregate `Dogfood Regression Gate` runs `if: always()`, never skips) | skipped 10/10 | | `Dogfood Verify CLI` | ci.yml › dogfood-verify | same | skipped 10/10 | | `Test Core (${{ matrix.shard }}/6)` | ci.yml › test | `core` OR `crosspkg` both false (scripts/** is in `crosspkg`, so scripts/pm heads RUN it) | skipped 3/10 — only the .md-only heads | | `Build Docs` | ci.yml › build-docs | `filter` output `docs` | skipped 10/10 | | `Console Pin Gate` | ci.yml › console-pin | `filter` output `console` | skipped 10/10 | | `Check PR Size` | pr-automation.yml › pr-size | `if:` excludes `labeled` / `unlabeled` / `edited` events; each event is its own run on the same head | skipped 9/10, success beside it 10/10 | | `Auto Label` | pr-automation.yml › auto-label | same | skipped 9/10, success beside it 10/10 | | `Check Changeset` | pr-automation.yml › changeset-check | `if:` skips a PR carrying `skip-changeset` | skipped 10/10 (every head carried the label), success beside it 9/10 (the run before the label) | | `Packed-tarball smoke (opt-in)` | pack-smoke-optin.yml › pack-smoke | opt-in by `needs:pack-smoke` | skipped 10/10 | Never skipped on any of the ten heads (and carrying no `if:`): `Lint & Repo Gates`, the four `Type Check ·` lanes, `TypeScript Type Check`, `Test Core` and `Dogfood Regression Gate` (the aggregates), `Governed Surface Queue Guard`, `filter`, the four claim/keyword guards, `Check Documentation Links`, `Close issues referenced in other repositories`. Workflows with a workflow-level `paths:` filter (`half-state-patrol.yml`, `board-snapshot.yml`) produce no check-run at all on a non-matching head — they are absent on 6 of the ten heads, never `skipped` — which is the measured basis for the "a skipped check-run is never a `paths:` filter" reading. ## Reverse verification (all at `7a1f99ea`) | leg | result | |---|---| | `--head` on the ten landed heads objectstack-ai#18298 · objectstack-ai#18307 · objectstack-ai#18311 · objectstack-ai#18315 · objectstack-ai#18316 · objectstack-ai#18322 · objectstack-ai#18326 · objectstack-ai#18327 · objectstack-ai#18328 · objectstack-ai#18332 | **exit 0 on every one**; accepted skips per head: 11 · 12 · 11 · 19 · 12 · 8 · 11 · 18 · 18 · 11, every name in the roster; e.g. objectstack-ai#18322 (the 8-skip head): `Build Core`, `Build Docs`, `Check Changeset`, `Console Pin Gate`, `Dogfood Regression Gate (…/3)`, `Dogfood Verify CLI`, `Packed-tarball smoke (opt-in)`, `Temporal Conformance` | | constructed fixture: the real objectstack-ai#18322 payload with `Lint & Repo Gates` mutated to `skipped` | **exit 4**, naming `Lint & Repo Gates (check suite 94780297729)` and classifying it `filter-miss` | | garbage sha `--head deadbeef…deadbeef` | **exit 3** — `NOT MEASURED — HTTP 422 — the API cannot resolve that sha` | | `--pr 18315` (the head is looked up through the proxy) | exit 0, `19 skipped check-run(s), every one in the roster`; `--pr 18308` (an issue number, not a PR) → exit 3 (HTTP 404) | | `--self-test` | 99 cases pass, offline (the roster's truth on the live workflows and its audit driven red six ways; the judge on the measured 39-run objectstack-ai#18315 head and on fixtures for 0 / 4 / 3; read classification; argv; the real CLI on payload files incl. `--json`; the structural pins) | | SKILL.md ratchet | `wc -l` 812 → 812; :629 112 B → 119 B; `check-skill-line-ratchet: SKILL.md is 812 lines (ceiling 812; headroom 0)` | ## Gates (local, at `7a1f99ea`) `node scripts/pm/dispatch-gates.mjs --commands .claude/skills/pm-dispatch/SKILL.md scripts/pm/check-expected-skips.mjs package.json` derived 45 commands; all 45 were run with the exit captured by redirect, and `--ran` reconciles: `✓ dispatch-gates --ran: 45 derived famil(ies) accounted for — 40 run, 5 NOT-MEASURED (5 DERIVED from a recorded exit 3)`. The five NOT MEASURED are the `dist/`-reading families on an unbuilt tree (`check:dts-closure`, `check:dual-build-cjs-loads`, `check:lean-entry-closure`, `check:sourcemap-no-sources-content`, `@objectstack/lint check:doc-formula-expressions` — each prints `PREREQUISITE NOT MET`); this diff touches no package, so no build closure is owed locally and CI runs them built. The `pnpm check:pm-dispatch-gates` battery was not derived, so it was not run. Named gates, verdict lines quoted: `check-skill-line-ratchet: SKILL.md is 812 lines (ceiling 812; headroom 0)` · `check-skill-id-lint: 27 file(s) clean` · `check-skill-frame-sync: the one declared copy of the decision frame is internally coherent` · `check-self-test-wired: every one of the 212 script(s) CI runs that ship a --self-test has that self-test run by CI` (the new script is not in that population — see Acceptance notes) · `check-nul-bytes: OK (scanned 8707 text file(s))` · `check-governed-prose: 2 instruction surface(s) name all 5 registered governed surfaces` · ESLint (`--no-inline-config`) on the new file: exit 0 · `check-governed-merges.mjs --test .claude/skills/pm-dispatch/SKILL.md`: **GOVERNED** (`.claude/**` ×1), exit 3 as designed. `check-clause2-carriers.mjs --pair` is run once this PR exists and its reading goes in the report comment. ## The one design choice, on the four axes: a roster declared in the check vs. deriving expectedness live from the workflows' `paths` filters - **实际业务需求** — the measured need is name-level: 31 landings this shift and the ten heads above were judged by "is this skipped name one that always skips?", and zero of them needed a diff-level answer. The diff-level question ("should `Build Core` have run on THIS diff?") is already answered for the required family by the platform: on `merge_group` ci.yml's `filter` widens every output to `'true'` (the `|| 'true'` half of the filter contract, now pinned by this check's self-test), so the family runs on the merged tree before `main` moves. A live derivation would answer a question nobody measured a need for, at the cost below. - **项目长远合理性** — a roster is a declaration that can rot; a live derivation is a second evaluator of the platform's own semantics (dorny/paths-filter's picomatch dialect, GitHub's expression language, matrix name templates, per-event runs) that can drift from the real evaluator. Both are drift; the roster's drift is made LOUD here (every row is pinned to its live job, name, `if:` and gate spelling — a rename or re-gate reddens CI), while an evaluator's drift is silent by construction (a wrong glob yields a confident "expected"). Contract-first: the workflow file is the contract, and the roster is a checked reading of it, not a copy of its path lists. - **防 AI 写代码犯错** — the roster makes the wrong move structurally hard: a new gated job's first skip is exit 4 until someone adds a row WITH its mechanism, and a row that names a job the tree does not gate is red. A live evaluator is where an AI would quietly mis-implement glob semantics and produce the false green this tree refuses everywhere else (the "could not read" ≠ "clean" class). The declared-vs-delivered line is kept: the check advertises the name question only, and says so in its header and report. - **创业阶段不扩散需求** — the roster is ~11 rows of data and one audit; live derivation is a YAML-expression evaluator with parity tests against GitHub. No pull exists for the latter; if a rostered required job is ever found skipped on a diff inside its filter, that measurement is the card that would justify it. **Recommendation: the roster in the check (implemented).** Should the seat prefer live derivation, nothing here blocks it — the roster rows already carry `workflow`, `job` and the gate's outputs, which is the input a derivation would start from. ## Acceptance notes - **Self-test wiring.** `check:pm-expected-skips` exists in `package.json` (mirroring the report-only siblings), but no workflow names it and lint.yml was outside this card's file surface, so `check-self-test-wired` (correctly) does not count it and CI does not run its 99 cases. The completion is one lint.yml step beside the other `check:pm-*` steps (`run: pnpm check:pm-expected-skips`); left to the seat — 承接者:the skills seat, on this PR or a sibling. Noted, not filed. - **:629's floor clause dropped for the byte ceiling** (「required 集是队列强制的地板」); AGENTS.md §7 carries the fact. Noted, not filed. - **Exit 4 judges skips only.** Other conclusions on the head (`failure`, `cancelled`, `neutral`, …) are printed loudly under `other conclusions` and do not move this check's exit; the bar's success half is read from the same listing. A malformed `--head` (non-hex) is a usage error (exit 2), a well-formed sha the API cannot resolve is exit 3. Noted, not filed. - **The card's five-name family was a subset.** The measured recurring family is eleven names (six ci.yml `filter`-gated jobs the card did not list, including two REQUIRED contexts); the card's citation of a "platform-readings discipline (a skip is not a pass)" has no verbatim carrier — the nearest lines are AGENTS.md §7 (「Green means the gate-carrying jobs' conclusion is success」) and `references/review-checklist.md:43`. Recorded in the report, no card. - objectstack-ai#18349 is not addressed here; it holds :513 / :523 of the same file (region-level parallel). `origin/main` did not move under this branch after cut (`ceb6b5fb`). ## 维护者速读(草稿) **改了什么**:入队资格这一行改成「每个 check 为 success 或预期 skip」,并新增一个只读的检查脚本 `scripts/pm/check-expected-skips.mjs`:给它一个 PR 号或提交 SHA,它读出该提交上所有 check,凡是 `skipped` 的都对照脚本内声明的「预期 skip 名单」(11 个名字,每个带一句为什么会 skip 的机制),名单外的 skip 会被点名并退出码 4;读不到就退出码 3,绝不当作通过。 **为什么改**:原来的「每一个 check 全绿」在本仓库任何一个 PR 上都做不到——路径过滤的 job 本来就以 `skipped` 结束,实测最近十次落地每次都有 8–19 个 skip。席位一直靠「记得哪些通常会 skip」在判断,而真正要分辨的是「预期 skip」与「本该跑却没跑」。现在名单是机器可读的,并且自测会把名单逐条对照真实 workflow 文件校验(job 存在、名字一致、带条件、条件拼写一致),名单不会悄悄过期。 **风险与代价(含回滚)**:规则层只改一行(≤120 B、行数 812 不变);脚本只读不写、不接入任何门禁,CI 不因它变红。名单是名字层面的判断,不回答「这个 diff 是否本该触发某个 job」——必查项由合并队列在合并树上全量重跑兜底,这一点写在脚本头部。回滚 = revert 本 PR。 **席位意见**:(留空,席位定稿) **你要做的**:本 PR 触及 `.claude/**`(规则层),需要你的 APPROVED;之后由席位落地。是否把该脚本的自测接进 lint.yml(一行 `pnpm check:pm-expected-skips`)由席位决定,本 PR 未动 lint.yml。 --- _Generated by [Claude Code](https://claude.ai/code/session_01HZfg2AwVX191qCizp88gQr)_ Co-authored-by: Claude <noreply@anthropic.com>

claude added 4 commits September 15, 2026 18:56

github-actions Bot added the size/m label Sep 15, 2026

claude Bot added the skip-changeset PR has no user-facing published change; bypasses the changeset gate label Sep 15, 2026

claude Bot marked this pull request as ready for review September 15, 2026 19:46

claude Bot added this pull request to the merge queue Sep 15, 2026

Merged via the queue into main with commit a09725d Sep 15, 2026
39 checks passed

claude Bot deleted the claude/issue-18324-seat-legs-window-population branch September 15, 2026 20:04

os-elon-musk mentioned this pull request Sep 16, 2026

[finding] check-half-states.mjs --help prints no usage and silently runs the full sweep — argv is never validated, so a mistyped --repo reads the wrong repo and looks successful #18369

Closed

Navigation Menu

fix(pm): the half-state patrol's seat legs read the triage post and the newest page — H44 reaches a vacant or Routine seat, H32 / H38 take their marker from the last page - #18332

fix(pm): the half-state patrol's seat legs read the triage post and the newest page — H44 reaches a vacant or Routine seat, H32 / H38 take their marker from the last page#18332
claude[bot] merged 4 commits into
mainfrom
claude/issue-18324-seat-legs-window-population

claude Bot commented Sep 15, 2026

Uh oh!

claude Bot commented Sep 15, 2026

Uh oh!

claude Bot commented Sep 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

claude Bot commented Sep 15, 2026

1 — H44's seat leg could not reach the triage post it was written for

The design choice, on the four axes

2 — H32 and H38 read a seat post's OLDEST comment page

Reverse verification

Gates

Acceptance notes

Uh oh!

claude Bot commented Sep 15, 2026

Contract review

① Derived judgments

② Semver level

③ Boundary flags

Uh oh!

claude Bot commented Sep 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant