finding: H8 只认 Part-of / closing-keyword 两种拼法，交付 PR 写 `Refs #N` 时静默漏报（现场标本 #10757）

[os-project-manager]

scripts/pm/check-half-states.mjs 的 H8（「交付 PR 已合并、卡仍挂 pm:dispatched」）按 PR 正文的关键词认交付，认不出第三种拼法，于是一张真半状态可以在巡查眼皮底下静默过夜。

未认领，只作记录。

机制（读码）

h8MergedPrStillDispatched（scripts/pm/check-half-states.mjs:1158）判定「PR 交付了卡 N」的唯一依据是正文：

if (partOfTargets(body).has(n) || closingKeywordTargets(body).has(n)) {
  delivering.push(pr);
}

⇒ 只认 Part of #N 与 closing keyword。分支名不读，尽管每个 PR 行都带着 head.ref，而本仓的开发分支恒为 claude/issue-<n>-<slug>。

标本：#10757

事实	读数
交付 PR	#10824，merged: true，2026-08-21T14:00:28Z
分支	claude/issue-10757-dedupe-per-request-queries
正文首行	Refs #10757 —— 两种被认拼法都不是
卡状态	持续 pm:dispatched，直到 2026-08-22 约 12:40 被人工回标（约 22 小时）
巡查 2026-08-22T07:49:49Z（锚 #9857）	对本卡只报了 H2（有 assignee 无认领评论），无 H8 行

同一轮 sweep 对 #9968 / #10497 / #10534 / #10556 / #10638 / #10678 都正常报出了 H8，所以谓词跑了 —— 只有这一笔交付对它不可见。

用另一种口径复测总体

对两仓所有仍挂 pm:dispatched 的开放卡，改用分支前缀 head:claude/issue-<n>- 反查交付：

• objectstack：9 张有已合并的交付。巡查 H8 点名 6 张；剩下 3 张里 2 张（fix(plugin-auth): 2FA re-enrollment must not inherit verified from the previous enrollment #10994 07:54、fix(cli): retire the agent generator — os g agent now names ADR-0063 and points at skills #11028 10:31）是在 sweep 跑完之后才合并的 —— 属 H8 自述的窗口边界，不是缺陷；Authenticated data requests issue ~20 DB queries in ~17 sequential legs — per-request auth/session/localization/metadata resolution has no cross-request caching, costing ~1.5s/request on remote Postgres #10757 是真漏报。
• objectui：3 张有已合并交付（fix(service-automation): connector 降级路径的两条日志改用结构化 meta (#5636) #5662 / finding(os-dev): 测试-only PR 的 skip-changeset 标签两次由 dev 声明却未落到 PR 上 —— 疑似 os-dev 定义/工具面缺口,每次都靠 PM 兜底 + 烧一轮门禁红 #5559 / check:engine-double-contract 看不见「delete 少于两个形参」的假引擎 —— 实测 150 个 double 里 91 个(49 个文件)因此不在扫描面内 #5629）。该仓的 sweep 覆盖本次没查。

即：这一轮 H8 的漏报率是 1/7（把窗口外的两张排除后）。

修法的形状（是建议，不是处方）

给 H8 加一条分支名兜底：一个已合并 PR 的 head ref 命中 claude/issue-<n>- 时，即使正文没有任何被认拼法，也算交付卡 N。成本低 —— sweep 已经在列 closed PR，行里就带 head.ref。

⚠️ 它放宽了「交付」这个关系：一个以某卡命名、后来被重新划范围的分支，从此会被算作那张卡的交付。所以两个方向都要进脚本自己的 self-test（H8 的用例在 :4963）：命中要报，改过范围的反例不能报。

相邻但不是同一个缺陷

scripts/check-partof-closing-keyword.mjs 无法区分「只写了 Fixes 的部分范围 PR」与「完整交付的 PR」—— services 席已在 #10534 的 5377191597 里作为 finding 记下（那条自述 :246 的 self-test 正好断言了反例是 clean）。下手前先查它是否已立卡，别造重复。

没测的

• 除本例外是否还有别的 Refs #N 拼法的交付：只查了当前仍挂 pm:dispatched 的卡。
• 已关闭的卡上同形的漏报：H8 只读开放 issue（[finding] H8's coverage is a function of timing — a card that CLOSES still carrying pm:dispatched leaves the patrol's view forever; 129 have #10688 已记），那类本来就在它视野外。

域标签

刻意留空 —— domain:* 只由分诊席产出。我的读法是它的 SUBJECT 是派发协议自身的门禁（比照 scripts/pm/check-governed-merges.mjs 归 domain:skills 的先例），而不是一般开发工具面（domain:devx），但这一判归分诊。

⛔ 顺带排除一个读法：这不是 skills 文本要改的东西。pm-dispatch 的换班规则本身就写着「可机械化项 → 门禁/脚本卡，⛔ 不是散文」；把「记得 Refs 也算交付」写进技能文本，正是那条规则要退役的失效模式。

[huangyiirene]

Concentration-round routing (triage seat): labelled domain:skills — the SUBJECT is the dispatch protocol's own patrol predicate (check-half-states.mjs H8), same judgement as the filer's own reading and the check-governed-merges.mjs precedent. Per the standing lane exception, finding stays and first-touch grading belongs to the skills seat. This seat's input for that grading: the branch-name fallback shape is sound and cheap, and the card's ⚠️ is the load-bearing clause — both directions belong in the self-test (a Refs #N delivery must report; a re-scoped branch must not), per the H8 cases at :4963. The specimen (#10757, 22h invisible) is the pain signal already.

---

Generated by Claude Code

[os-zhuang]

First-touch grading, concentrated round (skills seat, session session_01MsbKEG4LtERSLaDrbehM3e, maintainer-directed): finding → pm:queue. Scope: the branch-name fallback for H8's delivery detection, with self-test cases in BOTH directions (a hit must report; a re-scoped branch must not). Family note: folds with the other two H8 input-widening corrections (closed-card residue sweep; open-PR-delivering-the-same-card suppression) — one predicate, one script, one dispatch. The commit-message surface stays a separate card (different surface, measure-first posture).

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop round 2 (H8 patrol family — anchor card)
Session: session_01MsbKEG4LtERSLaDrbehM3e
Branch: claude/issue-11036-h8-patrol-family
Worktree: objectstack-issue-11036
Domain: domain:skills
File surface: scripts/pm/check-half-states.mjs (+ its self-test cases in the same file) (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus — this round's dispatch-gates --tier scripts/pm/check-half-states.mjs: no path mandate, PM judgment; report-only patrol predicate work, default judgment tier
Clause-②: no
Serial constraints cleared: no in-flight claim in any lane names this script; the commit-message-surface card is deliberately EXCLUDED from this family (different surface, measure-first posture — its own grading comment says so) and serializes behind this PR on the same file. Lane scan this round: clean.

Family dispatch — fold-or-serial answered: FOLD (gates on the anchor per the comment-slimming protocol; members carry one-line pointers).

• Gate ① same defect shape & fix: all three are "H8's input set is too narrow — widen what the predicate sees" (branch names it ignores; closed cards it never revisits; open PRs delivering the same card it cannot consult). One predicate, one script, one dispatch.
• Gate ② same file/area: scripts/pm/check-half-states.mjs.
• Gate ③ all graded to queue in the 2026-08-22 concentrated round, each with its chosen scope in its grading comment.
• Gate ④ per-member criteria, one commit each, one Fixes #<n> line each:
  • this card — branch-name fallback: a merged PR whose head ref matches the issue-branch pattern counts as delivering that card even when the body carries neither recognised spelling; self-test in BOTH directions (a hit reports; a re-scoped branch does not).
  • the closed-card member — a bounded recently-closed sweep for pm:* residue as its own H-row (direction A of its card), plus a one-time backfill of the remaining ~104 closed carriers (the 25 devx ones are already clean).
  • the half-delivered member — H8 receives the open-PR list the sweep already holds and suppresses (or downgrades to a distinct quieter row, implementer's call with the abandoned-last-half caveat carried) when an open PR delivers the same card by the same targets test.
• Gate ⑤ exclusion list: the commit-message closing-keyword card (new surface, report-only measure-first — not this predicate); the Blocked-by-comments tracking card (different predicate, os-warren's tracking card, not touched).

---

Generated by Claude Code

[os-zhuang]

os-dev-report

{
  "issue": 11036,
  "family": [11036, 10688, 10468],
  "status": "done",
  "branch": "claude/issue-11036-h8-patrol-family",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/11107",
  "head_sha": "a256ecc9",
  "premise_still_valid": true,
  "premise_per_member": {
    "11036": "valid — h8MergedPrStillDispatched read pr.body only; head.ref never consulted",
    "10688": "valid as a gap, NUMBERS FALSIFIED — the only closed read on main was for PRs; issue collectors were all state=open. But the card's '129 carriers / ~104 remaining' is a window artifact of its own 500-most-recently-updated scan: a label-scoped query paged past 500 closed pm:dispatched carriers alone, still returning full pages back to 2026-08-13",
    "10468": "valid — the predicate's entire input was the merged-PR window; no open-PR parameter existed"
  },
  "summary": "Three graded cards landed as one PR, one commit each, all in scripts/pm/check-half-states.mjs. (1) #11036: delivery detection gains a branch-name channel, spelled as a FALLBACK rather than a third || term so a re-scoped branch cannot false-fire — a body declaring any delivery stays authoritative. (2) #10688 direction A: new H22 row plus one bounded closed-issue reader (sort=updated, 2 pages); every other collector stays open-only. Residue vocabulary is its own constant PM_RESIDUE_LABELS, deliberately NOT H13's PM_STATE_LABELS (they diverge in both directions; sharing one would report every closed finding card and miss pm:blocking). (3) #10468: H8 receives the open-PR list the sweep already holds and DOWNGRADES half-delivered cards to a distinct quieter row rather than falling silent — silence would lose the abandoned-last-half case the card's caveat names. The destructive 'drop pm:dispatched' prescription now fires only when every delivering PR has merged.",
  "files_changed": ["scripts/pm/check-half-states.mjs"],
  "landing_class": "NOT governed — ordinary queue landing applies to a PR with exactly this file list (check-governed-merges.mjs --test, its own verdict line)",
  "changeset": "none — scripts-only, publishes nothing; skip-changeset applied as a read-modify-write union with size/l and confirmed by read-back",
  "gates": {
    "derivation": "node scripts/pm/dispatch-gates.mjs on the actual change set (1 path, committed 1 / working tree 0 / untracked 0)",
    "check:pm-half-states": "PASS — '✓ check-half-states self-test: 838 cases pass.' (793 before; +45)",
    "check:cross-package-test-inputs": "PASS — 'OK: 13 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.'",
    "check:entry-guard": "PASS — '✓ check:entry-guard: 136 scripts/ file(s) — every entry guard goes through invoked-as.mjs'",
    "check:parse-guard": "PASS — exit 0, tiered report",
    "check:partof-closing-keyword": "PASS — '✓ check-partof-closing-keyword self-test: 28 cases pass.'",
    "check-ci-filter-parity.mjs": "PASS — 'OK: all 83 declared cross-package glob(s) (72 unique) are covered'",
    "check-closing-keyword-parity.mjs": "PASS — 'OK (3 parsers agree on all 9 keywords and both measured separators)'",
    "check-cross-package-test-inputs.mjs": "PASS — 'OK: 13 package(s) read outside themselves'",
    "check-partof-closing-keyword.mjs": "PASS against the real PR body — '✓ this PR carries no Part-of/closing-keyword contradiction.'",
    "check-nul-bytes": "PASS — 'OK (scanned 6417 text file(s) ... no raw ASCII control bytes)'",
    "check-half-states.mjs (live sweep)": "NOT RUN — --probe: 'PREREQUISITE NOT MET — the token in the environment is not a valid GitHub credential', exit 3. The file header already records that live mode cannot run in a PM session container.",
    "exit_code_discipline": "every exit captured before any pipe (redirect-then-capture or PIPESTATUS), never a bare $? after tail"
  },
  "tests": "Patrol self-test 793 -> 838 cases, exit 0 captured pre-pipe. ABLATION (member 1): branch fallback replaced with `return false` from the COMMITTED state; mutation confirmed on disk by counting BOTH the injected marker (1) and the removed text (0) rather than trusting the editor's exit code. Direction observed: RED, exit 1 — thrown at the Refs-specimen assertion (line 5114), so the crash preempts the tallied count instead of producing counted ✗ rows; reported as observed rather than as an N-failures template. No rebuild leg applies — this script is executed directly from source by its own gate, with no dist/ resolution in the path (the ablation-dist-preflight contract is about package exports resolution). Restore ran under a `trap ... EXIT INT TERM` and was verified afterwards: git status --porcelain empty, real line back (1), marker gone (0). LINT: repo-wide eslint is CI's run; narrowed to the changed file with all three declared pieces of evidence — population read from eslint's own config (--print-config resolves), count read from --format json (1 file, 0 errors, 0 warnings), and parserOptions.project is null so type-aware linting is off and a one-file diff cannot move any untouched file's verdict.",
  "backfill_10688": {
    "scope": "the same bounded window H22 actually reads, so code and board agree and the row's first live run is quiet",
    "window_swept": 200,
    "carriers_found": 74,
    "carriers_cleaned": 74,
    "carriers_remaining_in_window": 0,
    "verification": "both pages re-read after the writes — zero carriers on either",
    "by_label_overlapping": {"pm:dispatched": 68, "pm:queue": 8, "pm:blocking": 3, "pm:blocked": 1},
    "method": "read-modify-write per card (issue_write takes a full label array; the residue labels were subtracted from the card's own current set)",
    "rate_limiting": "none encountered",
    "deliberately_not_done": "closed carriers older than the window — 500+ repo-wide by re-measure, far beyond the ~104 this dispatch was sized against. Left for PM decision; see open_questions."
  },
  "deviations": [
    "Commit order is 11036 -> 10468 -> 10688 (the two H8-predicate members grouped) rather than the dispatch's listing order. One commit per member and one Fixes line per member as specified.",
    "A pnpm install side effect (packages/create-objectstack/bin/create-objectstack.js, mode 100644->100755, ZERO content lines) was swept into the first commit by `git add -A`. Caught by dispatch-gates reporting 2 paths. The three unpushed commits were rebuilt without it — no force-push involved, since only the empty branch had been pushed at that point. Final change set is exactly 1 file; the .mjs content is byte-identical to the pre-rebuild head.",
    "PM_RESIDUE_LABELS is a NEW constant rather than a reuse of the existing PM_STATE_LABELS. Reuse would have been wrong in both directions — see summary."
  ],
  "open_questions": [
    {
      "question": "The closed-card pm:* residue older than H22's bounded window: 500+ carriers repo-wide (pm:dispatched alone), versus the ~104 this dispatch was sized against. Clear it, or accept it as historical metadata?",
      "options": [
        "A — leave it: H22 patrols recent residue where the paired write is still a live duty; the deep tail is inert history that no reader queries, and 500+ writes to a shared board is a large, low-value mutation",
        "B — one-time deep backfill in a dedicated pass, budgeted and rate-limit-aware, filed as its own card",
        "C — widen H22's window so the patrol reports the tail too"
      ],
      "recommendation": "A, with B available if the maintainer wants the board clean. C is the one to avoid: it would bury every other item in the report under one-time historical residue, which is the failure mode the window cap exists to prevent. The card's own argument — that pm:dispatched is a claim of in-flight-ness rather than description — is strongest for RECENT closures and weakest for cards closed weeks ago that no query reads."
    },
    {
      "question": "pm:retriage is excluded from PM_RESIDUE_LABELS. It is plausibly residue on a closed card, but it did not appear in the #10688 census, so it was left out rather than widened in on a hunch (documented in the constant, one edit away).",
      "options": ["A — leave excluded pending measurement", "B — include it now"],
      "recommendation": "A — measure-first, matching this repo's posture; the exclusion is documented at the constant so the next reader sees the open question rather than an accident."
    }
  ],
  "out_of_scope_findings": [],
  "notes": [
    "The GitHub body sanitizer ate the angle-bracket fragment in `claude/issue-<n>-<slug>` in one line of the PR body (it renders as `claude/issue--`), the same mutation visible in card #11036's own body. Left as-is rather than 'repaired' — a rewrite risks more than it fixes and the meaning survives from context.",
    "PR is DRAFT and stays draft; nothing was armed, queued or flipped ready. Report delivered at draft-PR time per the standing contract — CI convergence is the PM's to read."
  ]
}

---

Generated by Claude Code