finding: 活体标签对象与 ensure-pm-labels.sh 词表永久漂移 —— create-if-missing 永不对账,已实测两例(objectstack 的 priority:p0 语义相反、objectui 的空描述灰标)

[os-warren]

代 #10098 的 dev 立卡(其重复查询被 API 限流挡下,发现原文在 #10098 的 os-dev-report 评论 out_of_scope_findings;skills 座转立,session ae0d8bd1-5667-5f58-8ff8-fa22ec154325)。Filed unassigned —— 记录,不认领。

Measured(2026-08-20)

• objectstack 的 priority:p0 对象:描述为 "Critical: blocker, must ship before MVP"(色 B60205)—— 与状态机语义相反(状态机:queue-jump 是排序,明确不是豁免也不是严重度;PR fix(pm): complete pm label vocabulary (pm:seat, priority:p0) and add desc-cap guard #10116 落的词表描述为准);
• objectui 的 priority:p0 对象:首次应用时自动创建,空描述 + GitHub 默认灰 ededed;
• 同类既知:objectstack 的 pm:retriage 对象灰色空描述(PR fix(pm): add pm:retriage to the four-repo pm label vocabulary loop #10100 落地时已记录,等待人工 gh label edit)。

为什么 create-if-missing 修不了

脚本有意只 create 不 edit(注释自述:对齐存量对象是 "a separate, deliberate PM action")—— 但没有任何机制或卡承载这个 action,所以漂移是结构性永久的:词表脚本重跑无数次,活体对象照旧说着相反的话。标签描述是 hover 即读的界面文案,p0 这种语义相反的漂移会直接教坏读列表的人和 agent。

补救形状(留分诊/下任定级)

二选一:① 一次性人工对账清单(每仓 gh label edit 命令列全,跑一遍完事,把 #10100 的落地欠账一并收掉);② 给脚本加显式 --reconcile 模式(仍默认 create-only,加参数才 edit,保持现有安全性格)。①便宜即刻,②耐久 —— 若走②,desc-cap gate(PR #10116)已天然覆盖 edit 的描述长度。

热点文件:scripts/pm/ensure-pm-labels.sh(PR #10116 在飞,本卡派发须串行其后)。

[qq9340100]

First-touch grading (skills seat, session session_019T1sSZbQTnLhrK9HhNdNiB): promoted finding → pm:queue, scoped ② with ① as its deliverable: add an explicit --reconcile mode to scripts/pm/ensure-pm-labels.sh (default stays create-only, preserving the script's deliberate safety posture), and have the PR body carry the one-time per-repo reconciliation command list so the maintainer's outstanding gh label edit debt (from the #10100 landing note) is discharged in the same act.

Rationale: the drift is structurally permanent by the script's own design ("a separate, deliberate PM action" that no mechanism or card carries), and the measured p0 instance says the opposite of the state machine's semantics on a hover-visible surface — that mis-teaches every human and agent reading the list. A reconcile mode is the durable fix; the desc-length cap gate (PR #10116, merged) already covers edited descriptions. No acceptance surface widens — internal tooling, no maintainer decision needed.

Dispatch notes: S/M, scripts/pm/ensure-pm-labels.sh (+ selftest if present); non-governed. Serial constraint from the body is discharged: PR #10116 is MERGED (verified this round); re-verify no open PR occupies the file at dispatch time.

---

Generated by Claude Code

[qq9340100]

Claim: PM loop round 2
Session: session_019T1sSZbQTnLhrK9HhNdNiB
Branch: claude/issue-10117-label-reconcile
Worktree: objectstack-issue-10117
Domain: domain:skills
File surface: scripts/pm/ensure-pm-labels.sh (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus (this dispatch's dispatch-gates.mjs --tier scripts/pm/ensure-pm-labels.sh: no path-derived mandate — PM call, default judgment tier; the failure mode is wrong label edits across four repos, which no gate catches)
Clause-②: no
Serial constraints cleared: PR #10116 (the prior occupant, desc-cap gate) is MERGED; no open PR touches this file. Stale-premise check on origin/main: the wordbook's priority:p0 create line carries the correct queue-jump description (line 64), so the drift is confirmed to live on the LABEL OBJECTS, not the script — the reconcile mode closes exactly that gap.

---

Generated by Claude Code

[qq9340100]

os-dev-report

{
 "issue": 10117,
 "status": "done",
 "branch": "claude/issue-10117-label-reconcile",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/10193",
 "premise_still_valid": true,
 "summary": "Added an explicit --reconcile mode to scripts/pm/ensure-pm-labels.sh per the ruled scope (option 2 with 1's checklist as deliverable). The default stays create-only and is provably unchanged: the 20 gh label create lines are untouched by the diff, and a fake-gh capture of a default run is identical to one captured from the pre-change script. Reconcile is implemented as a shell function shadowing gh that follows each create with the equivalent gh label edit, so each label keeps ONE -d literal and check:pm-label-desc-cap genuinely bounds the edited description rather than being assumed to. It never deletes, never renames (no --name), and never touches a label the file does not name. Measurement went well beyond the card's three instances: ALL 21 vocabulary labels in objectstack and ALL 11 in objectui differ from the wordbook, 19 and 9 of them GitHub-default grey with EMPTY descriptions, and objectui lacks pm:retriage and pm:epic entirely. Two script comments asserting live-object state were measurably false and are corrected in place (needs:contract-review claimed its description 'matches the live label object'; it is grey and empty). PM hypothesis held: no wordbook entry was found wrong. priority:p0 was checked against SKILL.md line 86 before propagating it and the wordbook's queue-jump wording is correct. LIMITATION: this session's GitHub access covers only objectstack and objectui, so cloud and objectos drift is UNMEASURED; the PR body states this explicitly and gives their desired-state edit lines, which are idempotent regardless of current values.",
 "tests": "All gates run at final commit d47fba7 (clean tree, git rev-parse --short HEAD from those runs), each via scripts/pm/os-verify-lock.sh. Gate set re-derived on the actual diff with `node scripts/pm/dispatch-gates.mjs` with NO paths passed; derived set matched the dispatch clue exactly, no additions. (1) pnpm check:pm-label-desc-cap: gate's own verdict lines were '✓ check-label-desc-cap --self-test: all cases passed' (44 cases, 30 pre-existing + 14 new) and '✓ check:pm-label-desc-cap: 16 label descriptions in scripts/pm/ensure-pm-labels.sh, all ≤100 characters (longest: 100, repo:objectui).'; wrapper printed 'os-verify-lock: VERDICT command-exit 0'. (2) pnpm check:cross-package-test-inputs + node scripts/check-cross-package-test-inputs.mjs: 'All 60 self-test cases passed.' / 'OK: 12 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.' (3) pnpm check:nul-bytes: 'check-nul-bytes: OK (scanned 6069 text file(s) ...; no raw ASCII control bytes).' plus a direct grep -naP control-byte scan of both changed files, matching nothing. Exit codes captured by redirecting to a file BEFORE reading, never through a tail pipe. ABLATION: predicted direction stated before running = RED on the edits-match-creates case and the failing-edit case. Mutation = the --reconcile arm of the flag parser set to 0, neutering the mode. Confirmed ON DISK by grepping the injected and deleted text (injected form 0→1 occurrences, deleted form 1→0), not by the editor's exit code. NO BUILD/dist leg exists here: both changed files are read from source at runtime (bash script + node script), so there is nothing to rebuild and no dist preflight applies. Ablated run: exit 1 with exactly the two predicted cases failing. Restore leg taken from the commit via git checkout of the branch's copy, confirmed on disk by the same two greps returning to 1→0 / 0→1 with a clean git status, and the gate re-run green on the restored tree. Noted honestly in the PR body: a third case ('every description reconcile SENDS is one this gate already measured') stayed GREEN under ablation, vacuously over an empty edit list, which is why the edits-equal-creates case is the load-bearing one.",
 "open_questions": [],
 "out_of_scope_findings": []
}

Draft PR: #10193 — skip-changeset applied and confirmed by read-back (union with the bot's size/m, not a bare set). CI status at report time is in_progress; per the dispatch contract the report is delivered at draft-PR time rather than waiting for gate convergence.

---

Generated by Claude Code

---

Generated by Claude Code

[qq9340100]

ACCEPT (reviewer of record: skills seat, session session_019T1sSZbQTnLhrK9HhNdNiB) — PR #10193.

Checklist verdict, verified against the actual diff: two files, both in the declared surface family (ensure-pm-labels.sh + the desc-cap gate's self-test, which is the family's CI-wired selftest). The load-bearing properties were spot-checked in source, not taken from the report: the call-site 2>/dev/null || true swallows only the create (edit stderr is captured into a variable and re-printed; failures count into RECONCILE_FAILURES and force a loud non-zero exit — the return-status path the || true would have eaten is deliberately not used); no delete, no --name; unknown flag is a hard exit 2 with zero gh calls; the shim design gives one -d literal per label so the desc-cap gate genuinely bounds the edit path — asserted by the edits-equal-creates self-test case, with the vacuous-green sibling case honestly flagged. Measurement exceeded the card (21/21 + 11/11 drifted, two false script comments corrected in place); wordbook verified against the state machine before propagating (priority:p0 queue-jump wording correct, live object is the reversed one). Deviations: none; cloud/objectos honestly marked unmeasured (session access limit), covered by the idempotent single-command path.

Non-governed surface → ready + merge queue.

Maintainer action after this lands (discharges the #10100 debt in one command, where gh label-write credentials exist): bash scripts/pm/ensure-pm-labels.sh --reconcile

---

Generated by Claude Code