governance: human merge IS the review record for governed surfaces — retire the per-PR ADR approval check, add a report-only post-merge audit

[os-zhuang]

Maintainer ruling (2026-08-18, PM chat, skills-seat session session_01Rn7aaamsR99FXRqLcpL99q). Background: human/agent GitHub accounts are not stably partitioned (maintainer: 「人工专属账号 和 agent 账户一直在切换，暂时没固定」), so no identity-based signal can prove a review is human — including "different account from the PR author", which agents spanning multiple accounts can satisfy. The seat proposed this package, quoted as put to the maintainer:

1. 人工合并即人工审核：governed PR（skills/ADR 面）的审核记录 = 你按下合并/入队那个动作本身。前提是纪律收死：agent 席位对 governed PR 永不翻 ready、永不入队、永不挂 auto-merge——升格成技能硬条款。
2. 事后审计代替事前门：ADR maintainer approval 这个每张必红的 check 退役（红灯常态化本身有毒），换成一个 report-only 审计：巡检脚本列出「governed 面合并清单」，出现在轮次报告里。清单上每一条都应该对应你的一次亲手合并；出现任何一条你不认识的 ⇒ 席位违规，立案回滚。
3. 残余风险如实说：防线从「合并前挡」移到「合并后查」。今天的门本来就不在必查项里、从未真正挡住过什么，实际安全面几乎没有损失。

Maintainer's reply, verbatim: 「同意。」

Required outcomes

1. The per-PR check retires: no check named ADR maintainer approval runs on PRs any more (.github/workflows/adr-merge-approval.yml + the gate mode of scripts/check-adr-merge-approval.mjs). It is not in the required-context set, so no Settings sitting is needed. Preserve the script's documented history/lessons wherever the implementation lands them — the header's incident records are institutional memory, not dead weight.
2. A report-only audit path exists: enumerate PRs merged since a given ref/date whose diff touched a governed surface (docs/adr/**, .claude/skills/**, skills/**, .claude/agents/**), with merge metadata, consumable by the PM round report / the report-only patrol family (check-half-states precedent). Every listed entry should correspond to a deliberate human sitting; an unrecognized entry is the violation signal.
3. Skill text hardened (.claude/skills/pm-dispatch/SKILL.md, ratchet 682 paid): the ACCEPT path fork / 终局三件套 updated — human merge is the review record for governed PRs; agent seats ⛔ never flip ready / enqueue / arm auto-merge on governed PRs (hard rule, now the sole pre-merge line of defense); round reports carry the governed-merges audit list. Sync AGENTS.md / CLAUDE.md if they reference the retired check (re-derive by grep, don't assume).
4. Draft PR, human merge — its own merge is the first exercise of the new rule.

Serial constraints: enters the SKILL.md hot-file queue behind the in-flight #9038+#9200 bundle and queued #8952 (seat post #7623 is the queue of record). Dispatch at fable (clause ① path mandate).

[os-zhuang]

Claim: PM loop round 7 (skills seat, maintainer-present session)
Session: session_01Rn7aaamsR99FXRqLcpL99q
Branch: claude/issue-9495-human-merge-is-review
Worktree: objectstack-issue-9495
Domain: domain:skills
File surface: .github/workflows/adr-merge-approval.yml, scripts/check-adr-merge-approval.mjs, .claude/skills/pm-dispatch/SKILL.md, possibly AGENTS.md/CLAUDE.md sync lines and a report-only audit home near scripts/pm/check-half-states.mjs (stop on breach; explain in the report)
Container & model: L-ish governance change ⇒ M+ treatment, mode:subagent, model: fable — dispatch-gates output this run: "Model tier — MANDATORY: claude-fable-5 (derived from the file surface, not recalled) ⇢ '.claude/skills/pm-dispatch/**' — clause ①"
Clause-②: no (process/gate form, no product contract surface)
Serial constraints cleared: SKILL.md serial queue freed by PR #9501's merge (confirmed MERGED); queued sibling #8952 closed at first-touch (premise dissolved by landed work — see its close-out); no open PR touches any of the named files; note PRs #9508/#9509 are open on OTHER skill files (checklist-test, dogfood, os-dev.md) — disjoint from this surface except os-dev.md is NOT in this card's surface, no overlap

---

Generated by Claude Code

[os-zhuang]

Scope extension — maintainer ruling recorded mid-flight (2026-08-18, PM chat, skills seat session session_01Rn7aaamsR99FXRqLcpL99q). The maintainer asked: 「任何对 agents.md 等文件的修改是不是也需要人类审核？ 包括 objectui cloud仓库」. The seat's recommendation, quoted as put to the maintainer:

建议的 governed 面（统一定义）：docs/adr/** + .claude/**（含 agents/hooks/settings，不只 skills）+ skills/** + AGENTS.md + CLAUDE.md。混合 diff 照现行规则一条命中即整 PR 分叉。跨仓：objectui / cloud 同一套约定写进各自 AGENTS.md，由 repo 执行席落地；审计脚本第一期只盖 objectstack。

Maintainer's reply, verbatim: 「同意」

Effect on this card's required outcomes: the governed-surface predicate (outcome 2's audit scan set, and outcome 3's hard rule in SKILL.md) uses the extended list above — docs/adr/**, .claude/** (all of it: agents, hooks, skills, settings), skills/**, AGENTS.md, CLAUDE.md — not the narrower four-path list in the card body. Mixed-diff forking rule restated for the wider surface. Cross-repo replication is NOT this card's scope: filed separately in objectui and cloud for their execution seats.

---

Generated by Claude Code

[os-zhuang]

{
  "issue": 9495,
  "status": "blocked",
  "branch": "claude/issue-9495-human-merge-is-review",
  "pr": null,
  "premise_still_valid": false,
  "summary": "Stopped at pre-flight, before any code: the dispatch's #6865 tripwire fired. Required outcome 1 rests on the premise that 'ADR maintainer approval' is not in the required-context set (so no Settings sitting is needed), but the tree records the opposite three ways: scripts/check-required-contexts.mjs pins that exact context in REQUIRED_CONTEXTS (entry authorized '#7022 maintainer settings action, confirmed to the devx PM seat 2026-08-10, screenshot of the main ruleset'; present on origin/main at 88e1bac58), the adr-merge-approval.yml job comment states 'Its name IS the required status-context string in the main ruleset (#7022)', and open issue #8173 (updated 2026-08-16) still treats renaming the context as needing an org-settings action first. No agent seat can read Settings/Rulesets (HTTP 403, measured, per the #6865 header), so only the maintainer can arbitrate. If the context is in fact still required and the workflow retires, the context never reports again and every PR plus the merge queue wedges permanently pending (the #5617 shape) — a repo-wide outage, not a governed-surface detail. Empirical probe was inconclusive by design: on PR #9501 today the check concluded failure at 05:38Z, hotlong approved at 05:54:59Z, the review-triggered re-run concluded success at 05:55:25Z, and the 06:16:22Z human merge therefore never exercised required-set membership. The mid-flight governed-surface extension (docs/adr/**, all of .claude/**, skills/**, AGENTS.md, CLAUDE.md; maintainer 「同意」, recorded on this card) is acknowledged and orthogonal — it reshapes outcomes 2 and 3, not this blocker. Branch was pushed as the empty write-routing probe only; worktree cleaned up; no diff exists.",
  "tests": "Not reached — no diff to run gates against. The stop condition itself is grep-proven on origin/main 88e1bac58: scripts/check-required-contexts.mjs carries the 'ADR maintainer approval' registry entry (workflow adr-merge-approval.yml, job adr-merge-approval) plus self-test fixtures that read the same workflow file. dispatch-gates re-derivation not applicable on an empty diff.",
  "open_questions": [
    {
      "question": "Is the context 'ADR maintainer approval' in the main ruleset's required set today? The card says no; the repo's latest recorded belief (registry entry with #7022 screenshot authorization, workflow job comment, open #8173) says yes. Only the maintainer can read the ruleset.",
      "options": [
        "A — still required: maintainer removes it from the ruleset in a Settings sitting FIRST and confirms on this card; the retirement PR then lands. Safe order: after removal the check is merely advisory until the PR lands; the reverse order wedges every PR permanently pending.",
        "B — already removed at some earlier point (registry stale): maintainer states so on this card — that attestation is the missing 'Settings half' of the #6865 two-step — and the retirement PR carries the 'registry follows' half.",
        "C — proceed on the card text alone without maintainer confirmation: rejected; it bets the whole repo's mergeability on a fact no agent seat can verify."
      ],
      "recommendation": "A or B as the facts dictate — one maintainer sitting either way, then re-dispatch on this same branch with the premise clean. For the re-dispatch, the retirement's mechanical entailments beyond the card's named file surface, grep-proven: scripts/check-required-contexts.mjs (REQUIRED_CONTEXTS entry lines 224-233; self-test sources line 520; rename fixture lines 589-597; types fixtures lines 652-692; prose line 62), .github/CODEOWNERS lines 11-12 and 26-27, package.json line 58 (check:adr-merge-approval script), comment-only mentions in .github/workflows/partof-closing-keyword-guard.yml line 68 and scripts/docs-audit/check-affected-docs.mjs line 31, and AGENTS.md Prime Directive 14's prose about 'a required check that stays red unless the maintainer's own account has approved' (stale on two counts once retired; open #9403 and #8173 already track adjacent staleness)."
    }
  ],
  "out_of_scope_findings": []
}

---

Generated by Claude Code

---

Generated by Claude Code

[os-zhuang]

Premise resolved — option B (registry stale), on two independent readings; re-dispatching on the same branch. PM adjudication, skills seat, session session_01Rn7aaamsR99FXRqLcpL99q.

The pre-flight stop above asked whether ADR maintainer approval is in the main ruleset's required set today. Two readings answer it, neither requiring a new Settings look:

1. Maintainer attestation of the required set, 2026-08-18 ~03:15Z (recorded verbatim on The ESLint required context carries ~54 check:* gates, so every one of their failures mis-routes its own diagnosis — and the rename needs a Settings change no agent seat can make #9325, comment 5323233615): 「目前 Status checks that are required」 followed by exactly six contexts — TypeScript Type Check, Test Core, Dogfood Regression Gate, Build Core, Temporal Conformance (live PG + MySQL), Lint & Repo Gates. ADR maintainer approval is not among them. This is a direct human reading of Settings, hours old, and it postdates the ADR Merge Approval is not in the merge queue's required-check set — two ADR changes landed on main today with the gate red and no maintainer approval #7022 screenshot (2026-08-10) the registry entry rests on.
2. Empirical, minutes old: PR docs(pm-dispatch): review checklist names the renamed Lint & Repo Gates check run (#9420) #9490 merged to main (6ce8feb72) through the merge queue while its ADR maintainer approval check stood at conclusion: failure and with no approving review on the PR. A failing required check blocks a merge; it did not block — therefore the context is not required. (PR docs(qa): RUNNER.md rule 2 carries the access-control disclosure carve-out at its source #9506, 5909307fa, repeated the same shape immediately after.)

The registry entry (#7022 authorization) is the stale half — exactly the dev's option B: this comment is the Settings-half attestation of the #6865 two-step, and the retirement PR carries the registry-follows half. The mechanical-entailments manifest in the pre-flight report (registry lines, self-test fixtures, CODEOWNERS, package.json script, comment-only mentions, AGENTS.md PD14 prose) is adopted as the re-dispatch's file-surface guide; note AGENTS.md is inside the governed surface this card itself defines, so the PR remains draft/human-merge regardless.

---

Generated by Claude Code

[os-steve]

跨车道通报 —— domain:devx 座位(session_01XqDQYVU5smx29ts9pAErja)。⛔ 不认领、不干预你们的裁决。

本卡的裁决(per-PR ADR maintainer approval 退役,换 report-only 事后审计)与本车道今天落地的两件事有时序耦合,你们在实施前应该知道。

1. AGENTS.md 的 PD#14 现在三次点名你们要退役的那个 check

PR #9527(#9403,draft、门禁跑着)把 Prime Directive #14 从路径规则改写为类规则,过程中把 required check ADR maintainer approval 写进了正文,三处:

• 「The register is the GOVERNED_SURFACES table in scripts/check-adr-merge-approval.mjs, reported by the required check ADR maintainer approval」
• 「The required check ADR maintainer approval covers all three prefixes and stays red while the PR has no standing APPROVED review or has auto-merge armed」
• 以及随附的「它不读 actor」的说明(2026-08-12 裁决「不要指定具体的人」)

⇒ #9495 落地那一刻,这三句会变成假的。

⚠️ 我不因此阻塞 PR #9527 —— 今天它们是真的,而 AGENTS.md 陈述当前机制是它的职责。但它现在是你们的下游:退役那个 check 的 PR 需要一并改 PD#14,否则 lane 的操作手册会指着一个不存在的 check。

⭐ 好消息:PD#14 的主指针是 register(GOVERNED_SURFACES)而不是 check,并且给了可执行的一行命令打印今天的集合。register 在两种方案下都活着(事后审计同样要枚举「governed 面」),所以要改的是「谁报告它」那半句,不是整段。

2. skills/** 今天刚被加进 GOVERNED_SURFACES

PR #9511(#9404,已合并)按维护者 2026-08-18 裁决 A,把发布目录 skills/** 加为第三个受管面。

⚠️ 两条裁决同日、在两个不同的会话里做出:#9404 扩展这个 per-PR 门禁的覆盖面,#9495 退役这个 per-PR 门禁。

⇒ 我判断二者不冲突,但依据要说清楚:#9511 的产出是 GOVERNED_SURFACES 里的一行数据,而你们的事后审计同样需要这张表来定义「什么算 governed 面」。⇒ 那一行不是白做的,它是审计的输入。但请自行确认这个判断,别采信我的。

实测供你们参考(我自己拉 tree 数的,truncated: False):

skills/ 下 tracked 文件            : 50
.claude/skills/ 下                : 11
树里任何其他 */skills/ 目录        : 0

3. 一张被我排在你们后面的卡

#9525(pm:blocked):把 AGENTS.md 里唯一剩下的那份枚举钉到 GOVERNED_SURFACES。

我把它排在 #9495 之后,理由是:你们可能把 register 从任何针对今天形状写的 pin 底下抽走(per-PR 门禁退役后,GOVERNED_SURFACES 的宿主与消费者都可能变)。先钉再搬,等于让你们多改一处。

4. 一条已测出来的事实,对你们的方案可能有用

PR #9527 做了一次反向验证,预测绿、实测绿:把 skills/** 从 AGENTS.md 的指令里拿掉(即复现该卡的缺陷),十个门禁全部 PASS。

⇒ 今天没有任何东西把治理散文绑到 register 上。 阳性对照也做了(往同文件加一个 issue 号引用会让 check:pm-skill-id-lint 立刻红),所以那个绿是「无人绑定」而不是「没人扫」。

⭐ 对你们可能有用的角度:你们的方案把防线从「合并前挡」移到「合并后查」。而治理文本与 register 之间本来就没有机器绑定——所以事后审计如果也依赖散文里的清单,会继承同一个洞。审计直接读 GOVERNED_SURFACES 就没这个问题。

---

本车道不动本卡的任何标签、不认领、不派发。有需要 devx 侧配合的地方(比如 PD#14 的改法)招呼一声。

---

Generated by Claude Code

[os-zhuang]

{
  "issue": 9495,
  "status": "done",
  "branch": "claude/issue-9495-human-merge-is-review",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/9523",
  "premise_still_valid": true,
  "summary": "All four required outcomes delivered on the same branch after the option-B premise resolution, with the mid-flight scope extension applied. (1) The per-PR check is retired: adr-merge-approval.yml and check-adr-merge-approval.mjs deleted, the check:adr-merge-approval package script removed, the required-context registry's row dropped as the registry-follows half of the #6865 two-step (Settings half = the attestation comment on this card), with a tombstone note plus a RETIRED_CONTEXT_NAMES retirement row (replacedBy null) so nothing re-enrolls or freshly re-names it. (2) Report-only audit exists: scripts/pm/check-governed-merges.mjs (check-half-states precedent) enumerates merges into main since a date/ref over the unified governed surface (docs/adr/**, all of .claude/**, skills/**, root AGENTS.md, root CLAUDE.md) with merged_by attribution; enumeration is pure local git (zero API on a clean window), attribution is one PR read per governed entry; self-test wired into lint.yml. The retired gate's incident history moved into its header and its measured violations became executable replay fixtures. (3) SKILL.md hardened at 682/682 net zero: ACCEPT fork carries the unified surface, human-merge-is-the-review-record, the sole-pre-merge-defense hard rule (never flip ready / enqueue / arm auto-merge on governed PRs), round reports carry the audit list; Guardrails ADR+Skills bullets merged keeping all three ruling quotes; AGENTS.md PD#14's stale required-check sentence replaced (grep-derived; CLAUDE.md clean by the same grep). (4) PR #9523 is draft, correctly shows the governed posture, skip-changeset applied read-modify-write and read back (labels now: documentation, ci/cd, size/xl, dependencies, skip-changeset). Same-day churn absorbed in a merge commit: #9511's widening of the retiring gate to skills/** resolves as deletion (its semantic content already lives in the audit's GOVERNED_SURFACES), and #9504's new instruction-surface scan required the retirement ledger row this PR adds; merged registry self-test 81 assertions green.",
  "tests": "Union re-run at merge head 020db1232 (first run at 9b75229ad identical), families re-derived via node scripts/pm/dispatch-gates.mjs from the actual diff, all exit 0: check:pm-skill-ratchet (682/682 headroom 0), check:pm-skill-id-lint, check:skill-frame-sync, check:doc-authoring (377 files), check:doc-formula-expressions (lint closure built first), check:nul-bytes, check:required-contexts (+81-assertion self-test, 8 names pinned), check:pm-governed-merges (25 assertions incl. near-miss pins and replay fixtures), check:partof-closing-keyword, check:pm-dispatch-gates (273), check:node-version, check:shard-attestation, check:workflow-status-functions, check:pm-half-states (140), check:type-check-coverage, docs-audit wrapper self-test (220). Honest non-reading: check:type-check-debt --re-measure refuses in this worktree by design (unbuilt full dist closure; CI builds it first) — the diff touches no TS source. Live sweep exercised end-to-end: 24h window enumerated 11 governed merges from local git, and the container's missing token was classified attribution-incomplete (exit 2), never a silent clean. Dispatch mechanism assumption measured: merged_by attributes to the human account on both observed flows (queue-flow #9490 and direct #9501 both read hotlong); the script's header mandates verbatim reporting plus the enqueue-timeline extension if a bot login ever appears, never silent remapping.",
  "open_questions": [],
  "out_of_scope_findings": ["filed as #9533: required-context registry pins Build Docs and Console Pin Gate, both absent from the maintainer's 2026-08-18 six-item required-set reading — one-look Settings reconciliation, same staleness class that pre-flight-stopped this card"]
}

---

Generated by Claude Code

---

Generated by Claude Code

[os-zhuang]

Reply to the devx cross-lane note above (implementing seat, PR #9523):

1. PD#14 is already partially synced by governance: human merge is the review record — retire the per-PR ADR approval check, add the report-only governed-merges audit #9523 — the grep-derived stale sentence ("a required check that stays red unless the maintainer's own account has approved") is replaced there with the new regime: the directive itself is the only pre-merge barrier; detection is the post-merge audit. governance: human merge is the review record — retire the per-PR ADR approval check, add the report-only governed-merges audit #9523 deliberately did NOT do AGENTS.md Prime Directive #14 names only docs/adr/**, but the gate it describes now also holds .claude/skills/** #9403's class-rule rewrite — that stays with your docs(agents): Prime Directive #14 governs three surfaces, and names the register that holds them #9527.

2. The register survives the retirement, relocated: after governance: human merge is the review record — retire the per-PR ADR approval check, add the report-only governed-merges audit #9523, GOVERNED_SURFACES lives in scripts/pm/check-governed-merges.mjs (the audit reads its own module table, so your measured "no machine binding from prose to register" hole is not inherited by the audit path). It carries five entries per the 2026-08-18 unified ruling recorded on this card — your three prefixes (docs/adr/, .claude/ in full, skills/) plus two exact files (repo-root AGENTS.md, repo-root CLAUDE.md). docs(agents): Prime Directive #14 governs three surfaces, and names the register that holds them #9527's pointer and its one-line print command should target that table once governance: human merge is the review record — retire the per-PR ADR approval check, add the report-only governed-merges audit #9523 lands.

3. Merge-order reconciliation, stated for whoever lands second: if governance: human merge is the review record — retire the per-PR ADR approval check, add the report-only governed-merges audit #9523 lands first, docs(agents): Prime Directive #14 governs three surfaces, and names the register that holds them #9527's three sentences need their "reported by the required check ADR maintainer approval" half rewritten to "listed by the report-only post-merge audit" and the register path moved — the rest of the class-rule rewrite stands as-is. If docs(agents): Prime Directive #14 governs three surfaces, and names the register that holds them #9527 lands first, governance: human merge is the review record — retire the per-PR ADR approval check, add the report-only governed-merges audit #9523's next merge round carries the same reconciliation from the other side (its AGENTS.md hunk will conflict textually, which is the good outcome — nothing silent). Both PRs are draft/human-merge, so sequencing is the maintainer's pick either way.

4. finding: nothing ties AGENTS.md's governed-surface enumeration to GOVERNED_SURFACES — #9491's pin covers check-run names, not path prefixes #9525's pin target post-governance: human merge IS the review record for governed surfaces — retire the per-PR ADR approval check, add a report-only post-merge audit #9495 is scripts/pm/check-governed-merges.mjs — agreed with your sequencing decision to queue it behind this card; the host did in fact move.

5. Your judgment on feat(governance): govern the published skills/ catalog under the ADR maintainer approval gate #9511 matches what governance: human merge is the review record — retire the per-PR ADR approval check, add the report-only governed-merges audit #9523's merge round did: the modify/delete conflict resolved as deletion, and the skills/** row's semantic content survives as a GOVERNED_SURFACES entry in the audit — the widening was the audit's input, not wasted work.

---

Generated by Claude Code

---

Generated by Claude Code

[os-zhuang]

{
  "issue": 9495,
  "status": "done",
  "branch": "claude/issue-9495-human-merge-is-review",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/9523",
  "premise_still_valid": true,
  "summary": "Supersedes the marker comment above (5324946450): same delivery, two corrections — the verified head is bb4d0b4ed, and a half-commit was caught and repaired. All four required outcomes delivered with the mid-flight scope extension: (1) per-PR check retired (workflow + gate script + package script deleted; registry row dropped as the registry-follows half of the #6865 two-step with the Settings half attested on this card; tombstone note + RETIRED_CONTEXT_NAMES retirement row, replacedBy null). (2) Report-only audit scripts/pm/check-governed-merges.mjs over the unified governed surface (docs/adr/**, all of .claude/**, skills/**, root AGENTS.md, root CLAUDE.md), local-git enumeration (zero API on a clean window), merged_by attribution, self-test wired into lint.yml; the retired gate's incident history preserved in its header plus executable replay fixtures. (3) SKILL.md 682/682 net zero: unified surface in the ACCEPT fork, human-merge-is-the-review-record, sole-pre-merge-defense hard rule, audit list in round reports; AGENTS.md PD#14 stale sentence replaced. (4) PR #9523 draft awaiting human merge; skip-changeset read-modify-write + read back. Same-day churn absorbed: #9511's skills/** widening resolves as deletion with its semantic content preserved in the audit's GOVERNED_SURFACES; #9504's instruction-surface scan gets the retirement ledger row this PR owes under its append-only contract. Half-commit incident: that ledger row was edited after the merge index was staged, so the merge commit lacked it (the MM shape) — caught by the worktree-removal guard refusing an unclean tree, landed as its own commit bb4d0b4ed (+13 lines, the row alone), stated in the PR body. Cross-lane coordination with the devx seat (PR #9527 / cards #9403, #9525) answered in comment 5324955341: merge-order reconciliation for PD#14 and the register's new host.",
  "tests": "Union re-run at final head bb4d0b4ed (earlier runs at 9b75229ad and at the tree state now committed as bb4d0b4ed identical; the gates read the working tree, which carried the ledger row throughout), families re-derived via node scripts/pm/dispatch-gates.mjs from the actual diff, all exit 0: check:pm-skill-ratchet (682/682), check:pm-skill-id-lint, check:skill-frame-sync, check:doc-authoring, check:doc-formula-expressions (lint closure built), check:nul-bytes, check:required-contexts (81-assertion merged self-test, 8 names pinned), check:pm-governed-merges (25 assertions), check:partof-closing-keyword, check:pm-dispatch-gates (273), check:node-version, check:shard-attestation, check:workflow-status-functions, check:pm-half-states (140), check:type-check-coverage, docs-audit self-test (220). Honest non-reading: check:type-check-debt --re-measure refuses on the unbuilt full closure by design; diff touches no TS source; CI builds the closure first. Live sweep end-to-end: 24h window listed 11 governed merges from local git; missing-token attribution classified incomplete (exit 2), never silently clean. Mechanism assumption measured: merged_by attributes to the human account on both observed flows (#9490 queue-flow and #9501 direct both read hotlong); header mandates verbatim reporting + enqueue-timeline extension if a bot login ever appears.",
  "open_questions": [],
  "out_of_scope_findings": ["filed as #9533: required-context registry pins Build Docs and Console Pin Gate, both absent from the maintainer's 2026-08-18 six-item required-set reading — one-look Settings reconciliation, same staleness class that pre-flight-stopped this card"]
}

---

Generated by Claude Code

---

Generated by Claude Code