Repository navigation
[finding] the merge-queue guard (check-governed-queue-guard.mjs, merge_group leg) reads the PATH register only — a PR over 5,000 changed lines that a seat enqueues still merges; the size limb #19012 adds to the seat-side pre-check never reaches the queue #19036
Description
Activity
Lane first-touch grading (skills seat,
session_01BTeBejoPUvRHN8WdAJC6oF) · 2026-09-18T13:07Z — the skills lane grades its own findings (lanes/skills.md).- Class (b): a declared contract the queue cannot hold — the seat-side pre-check (PR feat(pm): a PR over 5,000 changed lines lands only by a human merge — size predicate in check-governed-merges --test, the same reading in dispatch-gates, one rule line in SKILL.md and landing-operations #19033) refuses a PR over 5,000 changed lines; the merge-queue guard's
merge_groupleg still callstestVerdict(paths)with no size, so an enqueued oversized PR merges. Reproducible from the guard's self-test (it never hands the predicate a size). - Type Task ·
priority:p1·pm:queue. p1: the maintainer's ruling is inert at the one place that decides a merge until this lands; the case it was ruled for (PR feat(spec): pin every export by its .d.ts declaration text, and retire the 27 signature hashes #18971) went through that exact leg. SERIAL behind PR feat(pm): a PR over 5,000 changed lines lands only by a human merge — size predicate in check-governed-merges --test, the same reading in dispatch-gates, one rule line in SKILL.md and landing-operations #19033 (the guard imports the size-awaretestVerdict; both files arescripts/pm/**). Deliverable: the leg reads the PR'sadditions/deletionsoff the read it already makes and refuses onlandsByHumanMerge; the post-merge sweep lists oversized landings; a pin per side.
Generated by Claude Code
- Class (b): a declared contract the queue cannot hold — the seat-side pre-check (PR feat(pm): a PR over 5,000 changed lines lands only by a human merge — size predicate in check-governed-merges --test, the same reading in dispatch-gates, one rule line in SKILL.md and landing-operations #19033) refuses a PR over 5,000 changed lines; the merge-queue guard's
Claim: PM loop round 1 (skills seat, this seat's R1, wave 2)
Session:session_01W5y9kRg1YtYaMQYExVLRc2
Branch:claude/issue-19036-queue-guard-size-limb
Worktree:objectstack-issue-19036
Domain:domain:skills
Seat:domain:skills#1
File surface:scripts/pm/check-governed-queue-guard.mjs(themerge_groupleg —decomposeGovernedWork:840,guardVerdict:1008,runGuard:1412, thetestVerdict(row.paths)call at :1807,makePullReader:1946, the self-test from :2262 — line numbers atec00b53, anchor on content) andscripts/pm/check-governed-merges.mjs(the post-merge listing inrenderReport:3088 and the entries it renders;testVerdict:1405 /sizeVerdict:1431 /landsByHumanMerge:1452 are the IMPORTED predicate, ⛔ not re-implemented; the proxy-plan region :2684 landed by PR #19170 is not this card's);.github/workflows/governed-surface-guard.yml⛔ untouched — if the leg needs a permission or an input the workflow does not pass, stop and report (workflow files are human-merge)
Container & model:M,mode:subagent,model: fable—dispatch-gates --tier --repo objectstack-ai/objectstackon the two files atec00b53: 「no path-derived mandate … floor sonnet · default opus · ceiling fable」; the seat's per-card call: this is the one leg that decides a merge, the same arbiter policy this seat applies to the ownership reader.
Clause-②: no
Thread-read: 5730428148
Ruling-ref: the maintainer's 2026-09-18 ruling on #19012 (「修改代码量超过某个行数（比如5000）就应该人工审核」), landed seat-side by PR #19033 (merged 2026-09-19T01:05Z); this card carries it to the queue leg — no new ruling; the lane's first-touch grading 5730428148 (p1 · Task) is the spec.
Serial constraints cleared: PR #19170 (#18989, the proxy-plan region ofcheck-governed-merges.mjs) MERGED 2026-09-19T04:48Z — the SERIAL fence this card waited behind is down; PR #19033 MERGED, so the size-awaretestVerdict(paths, { size })is onorigin/mainec00b53; 0 of 21 open PRs touch either file (every open PR's file list enumerated at 2026-09-19T04:53Z, 361 rows; positive control on the same enumeration:scripts/pm/check-clause2-carriers.mjs1 — PR #19169);git ls-remote --heads origin | grep -iE 'issue-19036'→ 0 heads at 2026-09-19T04:57Z.skip-changeset(scripts/pm/**).Design reading from
origin/mainec00b53(a reading for the dev, ⛔ not an instruction):runGuardreadsGET /pulls/N(makePullReader→sha,body,headRef) only for rowsdecomposeGovernedWorkclasses as governed; a group whose rows hit no register path returnsguardVerdictearly withapiCalls: 0— so the size reading cannot ride the existing read for the case the card names (an oversized PR with NO governed path) without extending which rows are read.check-governed-queue-guard.mjs --self-test: 261 cases atec00b53.
Generated by Claude Code
- added a commit that references this issue
on Sep 19, 2026 os-dev-report
{ "issue": 19036, "status": "done", "branch": "claude/issue-19036-queue-guard-size-limb", "pr": "https://github.com/objectstack-ai/objectstack/pull/19175", "session": "session_01W5y9kRg1YtYaMQYExVLRc2", "premise_still_valid": true, "summary": "Premise re-verified on origin/main e8667ee (later merged c229223; neither file moved): runGuard called testVerdict with no size and decomposeGovernedWork dropped every ungoverned row before any read, so an oversized PR with no governed path (PR #18971's shape) reached main through the merge_group leg. Queue guard: a fourth leg (runSizeGuard / sizeGuardVerdict / renderSizeVerdict) reads every queued PR's additions/deletions off the same pull object the head read uses (makePullReader grew `size` via the sibling's pullSizeFrom; no second endpoint, no new workflow scope), judges it through the IMPORTED predicate — testVerdict([], { size }) + landsByHumanMerge; this file declares no threshold and spells no comparison, pinned against its own source — refuses on EXIT_REFUSED_OVERSIZED = 8 with the two numbers, the threshold, the limb and the human-merge remedy printed, fails CLOSED on an unreadable size with EXIT_REFUSED_SIZE_UNREADABLE = 9, stays silent and byte-identical on the pull_request leg, and combines the three legs through a pure, pinned groupExitCode (governed > size > carrier; consequence pinned: a group naming no PR now exits 9 rather than the carrier's 7). Post-merge sweep: classifyCommit is landsByHumanMerge(testVerdict(paths, { size })); the size is read LOCALLY by commitChanges (one `git diff-tree --numstat --no-renames -m --first-parent` per mainline commit, replacing commitPaths' --name-only with a byte-identical path list), so an oversized landing with no governed path is an entry on the size limb alone — counted apart in the head, a ⛔ SIZE row with the numbers, the same attribution column, GitHub's pair printed beside the landed number only when it differs. PM mechanism assumption 'the sweep already reads each merged PR' FALSIFIED: the attribution GET is spent only on rows already classified governed, so no API read could have made an ungoverned oversized landing an entry — hence the local numstat route (the same source --branch already uses). Assignee was set (os-tesla) at dispatch; the newest Claim: names this branch; the workflow file is untouched; skip-changeset (scripts/pm/** publishes nothing).", "tests": "node scripts/pm/check-governed-queue-guard.mjs --self-test → exit 0 · `✓ check-governed-queue-guard self-test: 296 cases pass` (baseline at e8667ee: 261). | node scripts/pm/check-governed-merges.mjs --self-test → exit 0 · `✓ check-governed-merges --self-test: 435 assertions` (baseline: 410); both run in the worktree after pnpm install, on the final head 5c7caff. | eslint (narrowed, measured): `npx eslint --no-inline-config --format json` on the two changed files → exit 0, 2 files, 0 errors, 0 warnings; population: eslint.config.mjs `**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}` block covers scripts/pm/*.mjs and --print-config resolves a config (parser typescript-eslint/parser); count read from the JSON output (2); invariance: parserOptions.project and projectService both absent, so no type-aware linting and this diff cannot move an untouched file. `pnpm lint` repo-wide is CI’s run. | control-character self-scan of both files (grep -naP over the control range): no hits; pnpm check:nul-bytes → exit 0. | The pull_request early-warning leg: unchanged renderer path, renderSizeVerdict returns the empty string there (pinned) and a throwing spy proves zero pull reads.", "gates": "Derivation: `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands` in the worktree at 5c7caff → 33 commands, identical to the derivation at e8667ee/3c7f5ec and to the dispatch’s list. | Batch on the final head 5c7caff after the ablation restore was proven (exit codes captured after redirection): 32 of 33 run, ALL exit 0 — check-ci-filter-parity 0; check-closing-keyword-parity 0 (+ --self-test 0, 40 assertions); check-comment-mask-corpus 0 (6896 files, 0 disagree); check-declaration-mirrors 0 (+ --self-test 0, 29 cases); check-scripts-symbol-anchors 0 (3524 anchors resolve; + --self-test 0); check-self-test-wired 0 (214 scripts; + --self-test 0); check-self-test-workflow-commands 0 (+ --self-test 0); check-skills-token-ratchet 0 (34 files within ceilings; + --self-test 0, 65 cases); check-whole-set-label-write 0 (0 violations; + --self-test 0); bare-root-worklist --self-test 0 (81 rows); check-governed-queue-guard --self-test 0 (296 cases); check:agent-test-spelling 0; check:bash32-floor 0; check:cli-command-ids 0; check:closing-target-claim 0 (105 cases); check:cross-package-test-inputs 0; check:driver-memory-census 0; check:entry-guard 0 (265 files); check:nul-bytes 0 (8986 files); check:parse-guard 0 (264 files; self-test 46 cases); check:pm-governed-merges 0 (435 assertions); check:pnpm-filter-targets 0; check:ratchet-remedy-authority 0; check:refd-timer-probe 0; check:watch-hint-literal 0. Full table with each gate’s own verdict line is in the PR body. | Reconciliation: `dispatch-gates.mjs --repo objectstack-ai/objectstack --ran` over a record whose every line carries `:: exit N` → `33 derived, 32 run, 0 NOT-MEASURED, 1 UNRUN` — the unrun family being pnpm check:pm-dispatch-gates, which runs only under the shared verify lock (≈1,000 s): | pnpm check:pm-dispatch-gates run #1 (slot issue-19036, started 05:31:37Z on 3c7f5ec, held the lock 1062 s): `✓ dispatch-gates self-test: 1866 cases pass` · `os-verify-lock: VERDICT command-exit 0`. Caveat: it overlapped ablation #2’s ~90 s mutation window and dispatch-gates.mjs statically imports sizeVerdict from the sibling; the inverted comparison flips BOTH directions (over reads under, under reads over), so it can only have turned a green case red, never a red one green — the 0 is therefore not a false green from the overlap. | pnpm check:pm-dispatch-gates run #2 (slot issue-19036-b, on the final head 5c7caff — owed because the merged origin/main range e8667ee..c229223 touched scripts/pm/dispatch-gates.mjs itself, PR #19168; started after ablation #3’s restore was proven; held the lock 1014 s, waited 504 s): `✓ dispatch-gates self-test: 1866 cases pass` · `os-verify-lock: VERDICT command-exit 0`. With this line added to the coded record the re-reconciliation reads `✓ dispatch-gates --ran: 33 derived famil(ies) accounted for — 33 run, 0 NOT-MEASURED` (a DERIVED zero: every family recorded an exit code, none of them 3). The PR body, written once at open time, records this family as NOT MEASURED then; this comment supersedes that line. CI on the PR head at report time: 33 check-runs on 5c7caff — 18 success, 11 skipped, 4 in_progress (Lint & Repo Gates among them; Governed Surface Queue Guard success — my own guard’s pull_request leg ran on this PR and passed; Check Changeset success with skip-changeset). CI convergence is the PM’s wait, not deferred for here.", "self_test_counts": { "check-governed-queue-guard": { "before": 261, "after": 296 }, "check-governed-merges": { "before": 410, "after": 435 }, "battery_rosters": "guard +1 battery (floor 21 → 22), merges +1 battery (floor 29 → 30)" }, "ablation": "One leg per side, the comparison inverted in the SIBLING (scripts/pm/check-governed-merges.mjs sizeVerdict: `exceeds: changedLines > HUMAN_MERGE_LINE_THRESHOLD,` → less-than), through scripts/ablation-replace.mjs in WRAP mode against the committed head 5c7caff: anchor hit x1, blob 6e1112bcd55e → c7a42160aabd, on-disk counts inside the window replacement 1 / original 0; guard self-test under mutation exit 1 `14 of 296 case(s) failed` (all in the #19036 battery: threshold-plus-one-is-OVERSIZED, one-under-is-WITHIN, an-OVERSIZED-queued-PR-REFUSES-with-code-8, #18971-replay, governed-AND-oversized, approval-lifts-NOTHING, pure-regeneration-lifts-NOTHING, …); governed-merges self-test under mutation exit 1 `30 failure(s)`, 0 TypeErrors (the SIZE battery, the new #19036 battery, the real-fixture sweep pins, plus two #13307 live-mirror pins seeing a phantom oversized row — the expected direction); restore: blob after restore 6e1112bcd55e == HEAD blob, `git diff HEAD` empty, `git status --porcelain` empty, anchor count back to 1. No dist involved (plain .mjs), so no build leg. Run history: run 1 on 3c7f5ec — merges leg exited 1 by a TypeError in my new battery (a pin dereferenced the fixture that classifies to null under the mutation) — fixed in 28faa51 so a red case is a NAMED one; run 2 ran against that fix UNCOMMITTED and the tool's restore-to-HEAD discarded it (caught by the pre/post blob compare 6e1112… → 859965…), re-applied and committed; run 3 is the record above.", "deviations": [ "Exit-code precedence governed > size > carrier (the PM's 'pick the one already highest' for governed vs size; size above carrier because its remedy is the same human terminal as Tier H): consequence, a merge group naming NO pull request now exits on the size leg's 9 instead of the carrier's 7 — both blocks still print their own refusal; pinned in the guard self-test and stated in the header.", "The sweep's size source is the LANDED diff read locally (git diff-tree --numstat --no-renames, first parent) rather than GitHub's additions/deletions, because the PM's assumption that the sweep already reads every merged PR was false (it reads only classified entries); GitHub's pair is captured off the attribution GET and printed beside the landed number when it differs. The listing is decided on the landed number, which counts a rename as delete+add and so never reads under GitHub's.", "The first locked run of `pnpm check:pm-dispatch-gates` (started on 3c7f5ec at 05:31:37Z) overlapped ablation #2's ~90 s mutation window; dispatch-gates.mjs statically imports sizeVerdict from the sibling, so a CHILD process spawned in that window could have read the inverted comparison. A second locked run on the final head 5c7caff was queued (slot issue-19036-b); its result is reported under `gates`.", "`ablation-replace.mjs` restores to HEAD by design: an ablation run against an uncommitted edit silently discards that edit on restore (caught here by a blob compare, re-applied, committed). Noted as a usage lesson, not a tool defect — the tool's header says 'commit first'." ], "files_changed": [ "scripts/pm/check-governed-queue-guard.mjs", "scripts/pm/check-governed-merges.mjs" ], "mcp_calls": "0 — no MCP GitHub tool was called (reads and writes all through curl / node fetch against the REST proxy with GITHUB_TOKEN)", "api_writes": "6 successful REST-proxy writes, 1 failed attempt, 0 MCP — git push ×3 to refs/heads/claude/issue-19036-queue-guard-size-limb (the empty write-route probe; 3c7f5ec; 5c7caff, each with the pre-push hook’s ✓ check:commit-card-trailers line); POST /repos/objectstack-ai/objectstack/pulls ×1 (curl, 201 → draft #19175, body read back: identical to the sent body except the platform trimmed the final newline; Fixes line, Clause-② line and session-URL footer intact); POST /repos/objectstack-ai/objectstack/issues/19175/labels ×1 through scripts/pm/label-write.mjs with NODE_OPTIONS=--use-env-proxy (HTTP 200, read-back matches: size/l, skip-changeset — the label is on the PR, where Check Changeset reads it; the card carries the PM’s labels untouched); POST /repos/objectstack-ai/objectstack/issues/19036/comments ×1 (this os-dev-report comment, curl-equivalent node fetch with --use-env-proxy, read back to the tail). The failed attempt: one POST /pulls from node fetch WITHOUT the env proxy answered 401 Bad credentials and created nothing (GET /pulls?head=… counted 0 before the curl POST) — the sibling’s documented #9642 shape, not a token problem. No assignee write, no PATCH, no PUT.", "open_questions": [ { "question": "Should an authorized APPROVED review by an account in GOVERNED_APPROVERS lift the SIZE limb at the queue the way it lifts a Tier H path? The landed predicate (PR #19033) says an oversized PR 'lands only by a human merge'; this PR implements exactly that (exit 8 stands even on a cleared governed leg) and the rendering says so. Not blocking: the maintainer's own direct merge is unaffected, and the case is rare (an approved AND oversized PR enqueued by a seat).", "options": [ "A — keep human merge only (as landed and as implemented): the ruling said 人工审核 and PR #19033 read it as the human-merge terminal; no new policy.", "B — let an authorized approval lift the size limb (one line in the sibling's landsByHumanMerge or a guard-side check), so ruling C's seat landing applies to oversized PRs too." ], "recommendation": "A, because 实际业务需求: the only measured case (#18971) had no approval at all; 长远合理性: the number's policy lives in ONE place (the sibling) and the queue only reads it; 防 AI 犯错: a size limb that an approval lifts re-opens the exact ride-through the sha-unpin already accepted for paths; 创业阶段不扩散: widening is a one-line maintainer decision when a real case asks for it." } ], "out_of_scope_findings": [ "noted, not filed: the pull_request event payload carries additions/deletions, so a size EARLY WARNING on the PR leg would cost zero reads; not taken (the ruling is about the landing, the seat-side pre-check already refuses before arming, the PR leg's byte-identity is a standing constraint). 承接者: the skills seat / a maintainer one-liner.", "noted, not filed: the carrier leg and the size leg each read GET /pulls/{n} once per queued PR — the same endpoint twice; a shared per-run pull read would halve it, kept separate so each leg's refusal and count stay separable in a log; groups are small. 承接者:无.", "noted, not filed: no governed reference text enumerates the guard's exit table (grep over .claude/skills/pm-dispatch/references/** and SKILL.md for exit 6/7/EXIT_REFUSED_CARRIER: 0 hits), so codes 8/9 leave no Tier S doc stale. 承接者:无." ] }
Generated by Claude Code
ACCEPT — in-seat review of PR #19175 (head
5c7caff7, report 5739835485) by thedomain:skillsseat,session_01W5y9kRg1YtYaMQYExVLRc2· 2026-09-19T06:11Z. Verified against GitHub and the fetched branch, ⛔ not against the report.- PR shape: draft, base
main, first lineFixes #19036,Clause-②: noat line start, one session-URL footer, no model identifier; labelssize/l(labeler) ·skip-changeset(dev, read back). No closing keyword beside any other card number. Fact layer (scripts/pm/**) — no 速读 owed. - Scope = the claim (5739519973): exactly
scripts/pm/check-governed-queue-guard.mjs(+642 / −25) andscripts/pm/check-governed-merges.mjs(+284 / −25); two commits plus a merge oforigin/mainc229223, trailer pairs model-free;.github/workflows/governed-surface-guard.ymluntouched; the proxy-plan region (PR fix(pm): the proxy re-exec guard is the caller's name, and it speaks when it suppresses #19170's) not touched. - Done-when met (lane grading 5730428148): the
merge_groupleg reads every queued PR'sadditions/deletionsoff the pull object the head read already fetches (makePullReadergrewsizevia the sibling'spullSizeFrom), judges through the IMPORTEDtestVerdict([], { size })+landsByHumanMerge(the guard declares no threshold, pinned), refuses onEXIT_REFUSED_OVERSIZED = 8with the numbers, the threshold and the human-merge remedy, fails CLOSED on an unreadable size (EXIT_REFUSED_SIZE_UNREADABLE = 9), keeps thepull_requestleg byte-identical, and combines the three legs through the puregroupExitCode(governed > size > carrier); the post-merge sweep lists an oversized landing with no governed path (classifyCommit=landsByHumanMerge(testVerdict(paths, { size })), size read locally by onegit diff-tree --numstatper mainline commit) with a⛔ SIZE:row counted apart; a pin per side (the feat(spec): pin every export by its .d.ts declaration text, and retire the 27 signature hashes #18971 replay refused at 8; exactly-at-threshold WITHIN on both sides; a real fixture sweep lists PR fix(metadata-protocol): seed-loader 中「计为错误」的失败一律记 error,不再自相矛盾地记 warn (#4729) #5001 and notobjectstack build/validate从不按 PageSchema 解析页面元数据:ADR-0089 D3a 早就该拒绝的键一路通过,#4001 的「三个示例应用 validate 全过」对 page 面是空证 #5000). - PM assumption corrected by measurement, recorded in the PR body: the sweep did NOT already read every merged PR (attribution is fetched only for classified entries) — the local
--numstatroute is the right correction (zero API; the source--branchalready uses). The other three assumptions held (one pull read per queued PR; fail-closed on an unreadable size; precedence with the governed code on top). - Measured by the dev, checked by the seat in the diff: self-tests 261 → 296 and 410 → 435 (battery rosters +1 each); ablation of the comparison in the SIBLING reds 14 / 296 and 30 assertions, 0 TypeErrors, restored byte-identical; 33 gates derived at the merged head, 33 run, all exit 0 (
--ranreconciled;check:pm-dispatch-gates1866 cases run twice, the second on the final head); eslint on the two files 0 / 0. CI on the head: 23 success · 11 rostered skips ·Lint & Repo Gatesin progress at this writing — read again before any landing act. - Deviations (4) accepted in the review record on the PR: the precedence consequence (a group naming no PR exits 9 instead of 7 — both blocks print; the workflow reads non-zero, not a code); the local size source; the overlapped first long-gate run, re-run on the final head; the ablation-vs-uncommitted-fix lesson.
- Open question carried to the round report, not implemented: whether an authorized APPROVED should lift the size limb at the queue. As landed (PR feat(pm): a PR over 5,000 changed lines lands only by a human merge — size predicate in check-governed-merges --test, the same reading in dispatch-gates, one rule line in SKILL.md and landing-operations #19033) and as implemented, only a human MERGE does; widening is a gate weakening on the human floor and a maintainer one-liner in the sibling. The dev recommends A (keep); the seat agrees and reports it.
- Contract review record (the lane's,
Clause-②: noincluded) on the PR thread:Served-tier: CONTRACT_REVIEW_TIER, head5c7caff7, PASS. Landing = this seat's act once every check on the head issuccessor a rostered skip:--pair 191750, ready through.../ccr/ready_for_review, auto-merge SQUASH through.../ccr/auto_merge; MERGED read frommerged_atandorigin/mainby content; residue at the landing.
Generated by Claude Code
- PR shape: draft, base
Landed — PR #19175 MERGED at 2026-09-19T06:47Z (squash
30288daonorigin/main; read back by content:EXIT_REFUSED_OVERSIZEDinorigin/main:scripts/pm/check-governed-queue-guard.mjs,export function commitChangesinorigin/main:scripts/pm/check-governed-merges.mjs).domain:skillsseat,session_01W5y9kRg1YtYaMQYExVLRc2· 2026-09-19T07:02Z. From this merge the merge-queue guard refuses a queued pull request over the human-merge line (exit 8) or one whose size it cannot read (exit 9), onmerge_grouponly, and the post-merge sweep lists an oversized landing with no governed path on a⛔ SIZErow. Residue in this same act:pm:dispatchedoff (closed by keyword), assignee off. Report-only item carried to the round report: whether an authorized APPROVED should lift the size limb at the queue (as landed: only a human merge; recommendation A, keep).
Generated by Claude Code
- added 4 commits that reference this issue
on Sep 28, 2026
Filed by the
domain:skillsexecution seat (session_01BTeBejoPUvRHN8WdAJC6oF, seat post #7623) at 2026-09-18T12:52Z, from the #19012 dev'sout_of_scope_findingson PR #19033 (report 5730187995), the class decided by the seat as the dev asked. Labelsdomain:skills·pm:queueset by the seat (its own lane:scripts/pm/**/ governed text); priority left to triage.Dedupe words:
queue guard size threshold·merge_group additions deletions·check-governed-queue-guard 5000·human merge line count queue. Dedupe reading: the shift's corpus and every card since — #19012 (the rule and the seat-side predicate) is the only card naming the threshold; none names the queue guard.Class (b) — the queue cannot yet hold the contract the landing rule declares
PR #19033 (#19012, the maintainer's 2026-09-18 ruling 「修改代码量超过某个行数（比如5000）就应该人工审核」) gives
check-governed-merges.mjs --test / --pr / --brancha SIZE limb:additions + deletions > HUMAN_MERGE_LINE_THRESHOLD(5000) lands only by a human merge, generated files included. The seat-side pre-check refuses; the queue does not:scripts/pm/check-governed-queue-guard.mjs'smerge_groupleg callstestVerdict(paths)with no size, so a PR over 5,000 changed lines that a seat enqueues (skipping the pre-check, or from a session whose tool predates the rule) merges through the queue exactly as PR #18971 did. Repro: the guard's self-test importstestVerdictand never hands it a size.What is asked (⛔ not asserted — triage grades)
The
merge_groupleg reads the PR'sadditions/deletions(the same pull-request read the guard already makes for the file list) and passes the size totestVerdict, refusing the group onlandsByHumanMerge(verdict); a self-test pin per side. Sibling: the post-merge sweep (the same file's default mode) lists governed-surface merges only, so an oversized PR that slipped through is also invisible to the audit half — the same fix covers it. Refs: #19012 / PR #19033.Generated by Claude Code