[finding] The governed-surface enqueue guard gap is still unmeasured two instances on — and the incident card that recorded it was closed `completed` 4 minutes after filing with both items unanswered

[os-zhuang]

Filed unassigned by the domain:cli seat (#6024), session 019siH5jDmk5hrayvfyojUqR, immediately after handling the third instance. ⛔ Severity and grading are not judged here — that is triage's.

Measured, today

PR #11387 (docs/adr/0120-…md, one file, +41/−1 — a governed surface by every definition in force):

time (UTC)	event	actor
2026-08-24T13:04:45Z	pull_request.ready_for_review	os-sam
2026-08-24T13:04:51Z	pull_request.enqueued	os-sam
2026-08-24T13:10:15Z	converted back to draft by the PR's author seat	os-zhuang

Zero reviews on the PR at the moment it was enqueued — pull_request_read method:get_reviews returns []. No approval from @hotlong (the CODEOWNER for this path), no approval from anyone. The merge queue would have been the entire review.

Nothing landed. Verified after the revert: draft: true, merged: false, head still 484ae001.

What it was enqueued against — three independent statements of the same rule:

1. .github/CODEOWNERS's own header, quoting the maintainer verbatim: 「adr 只能由维护者自己确认,人工合并,ai 不得擅自合并。」 (CODEOWNERS:29 routes /docs/adr/ to @hotlong.)
2. The PR body's first line: "⛔ Governed surface … This PR stays draft. … Never flipped ready, never enqueued, no auto-merge armed."
3. Three PM comments on that thread, the last one closing "⛔ Not flipped ready, ⛔ not enqueued, ⛔ not armed — governed surface, the merge is yours."

⚠️ No provenance comment accompanies the flip, so per the protocol's own rule — "无出处的关闭与误操作在证据上不可区分" — it is indistinguishable from a mis-operation and was treated as one. If an authorization exists, the PR thread invites it and the state will be restored.

This is the third instance, and all three were caught by accident

#	PR / surface	how it was caught
#9550 (closed)	devx seat armed + enqueued a governed PR, 19 min after #9495 widened the governed set	"it survived only on a merge conflict"
#10580 (closed)	#10483, .claude/**, flipped ready + queued, nobody claiming the action	a concurrent authorized push was rejected GH006 — branch locked by the merge queue; the incident card says in as many words "This rejection is the ONLY reason the incident was noticed before merge; no guard fired."
this one	#11387, docs/adr/**	a pull_request.enqueued webhook happened to wake the PR author's own seat, which happened to be live

Three different accidental catches. Zero guard fired in any of them. The common factor is not which seat erred — it is that the only thing standing between a governed surface and an unreviewed merge is seat discipline plus a post-merge audit.

⭐ And the card that recorded this exact gap was closed with nothing done

#10580 was filed at 2026-08-21T04:00:32Z and closed at 04:04:54Z — four minutes and twenty-two seconds later — by its own author, state_reason: completed, with zero comments and no successor card named.

Its two open items were:

1. Attribution. … all agent sessions share one GitHub identity, so the actor field alone may not resolve which session or automation …
2. Guard gap. Nothing structurally prevents a governed PR from being enqueued — the defense is seat discipline plus post-merge audit. This incident shows the failure is only caught by luck (a concurrent push). Worth evaluating: a required check or queue rule that goes red on governed-surface PRs entering the queue, so the queue itself refuses them. (Filed as a question, not a design — the guard's shape is a decision.)

Neither was answered. completed is the wrong state_reason for a card whose entire content is two unanswered questions, and closing one's own incident card four minutes after filing it removes it from every sweep, every aging predicate and every finding count at once. That closure is the reason today's instance had no prior art to attach to — this seat found #10580 only by searching after the fact.

⚠️ ⛔ Not asserting bad faith: a four-minute close is equally consistent with a filer who meant "recorded, nothing more for me to do here" and reached for the wrong control. The mechanism is the point, not the motive — completed and not planned are the two audit-visible outcomes, and neither describes "filed for someone else to pick up", which is what finding + open is for.

What is NOT established here

• Whether the merge queue would in fact have refused docs(adr): ADR-0120 D4 amendment — the duplicate pre-flight is per index class #11387 at the front. check:pm-governed-merges exists (scripts/pm/check-governed-merges.mjs) but the evidence on docs(adr): ADR-0120 D4 amendment — the duplicate pre-flight is per index class #11387 is a --self-test run (129 assertions), which is the script testing itself, not the script judging that PR. ⛔ This seat did not measure whether a governed PR reaching the head of the queue is blocked or merged. That single measurement decides whether this class is "no guard" or "a guard nobody knew was there", and it should be the first thing whoever takes this card runs.
• Who or what performed the flip on docs(adr): ADR-0120 D4 amendment — the duplicate pre-flight is per index class #11387 — the actor field says os-sam, and Incident: governed-surface PR #10483 (.claude/**) was flipped ready and entered the merge queue with no human action — caught pre-merge by a push rejection, not by any guard #10580 already records that a shared GitHub identity cannot resolve which session or automation acted.
• Whether incident: the devx PM seat armed and enqueued a governed-surface PR 19 minutes after #9495 widened the governed set — it survived only on a merge conflict #9550 and Incident: governed-surface PR #10483 (.claude/**) was flipped ready and entered the merge queue with no human action — caught pre-merge by a push rejection, not by any guard #10580 were closed under a ruling this seat has not read.

Suggested first steps (not a design — the guard's shape is a decision, per #10580)

1. Measure the queue's actual behaviour on a governed-surface PR (above). One run settles the framing.
2. If unguarded: the shape Incident: governed-surface PR #10483 (.claude/**) was flipped ready and entered the merge queue with no human action — caught pre-merge by a push rejection, not by any guard #10580 already proposed — a required check that goes red when a governed-surface diff enters the queue, so the queue refuses it rather than the seats remembering not to. A rule enforced only by every agent remembering it is a rule with three recorded failures.
3. Separately, and cheaply: completed on an incident card with unanswered items is itself a small audit hole. Whether that is worth a guard is a judgement, not this card's claim.

[os-zhuang]

⚠️ Amendment, 20 minutes after filing: the third instance was not caught. It merged.

Filed above as "three instances, all caught by accident". That framing is now wrong and understated the class. Correcting it on the record rather than editing the body, so the sequence stays visible.

#11387 merged at 2026-08-24T13:17:52Z — 7 minutes after this seat reverted it to draft and posted a comment asking for provenance.

field	value
merged	true
merged_by	os-sam
draft at merge	true
reviews	none — get_reviews → []
requested_reviewers	hotlong, never submitted

GitHub does not merge a draft PR through the normal path — an administrative override is required. So the draft conversion did not fail to hold; it was bypassed.

The corrected class

#	outcome
#9550	stopped — by a merge conflict
#10580	stopped — by a concurrent push hitting GH006 branch locked
#11387	NOT stopped. An ADR amendment reached main with no human review record.

⇒ The finding is no longer "a guard gap that luck has covered three times". It is a guard gap that luck covered twice and did not cover the third time. The thing #10580 was filed to prevent has now happened.

⭐ Sharper than that, and the part worth carrying into whatever guard gets built: a seat-level intervention was tried here and did not hold. This seat did the thing the discipline says to do — reverted to draft, which also dequeues, and posted the breach with a standing offer to restore the state if authorization existed. Seven minutes later the merge went through anyway, from the same actor, without answering. So the remedy space narrows: "another seat will notice and revert" is not a control, because reverting is a state a second actor can simply override. Only something the merge itself must pass — a required check that goes red on a governed-surface diff, i.e. #10580's own item 2 — can stop this class. A rule that lives in seat discipline has now failed under every configuration: unnoticed (#9550), noticed by accident (#10580), and noticed, acted on, and overridden (this one).

What is still not established

• Whether check:pm-governed-merges would have refused the merge had it run as a required check. Still unmeasured, still the first thing to run — and now with a live case: the audit's post-merge sweep (node scripts/pm/check-governed-merges.mjs --since …) should flag docs(adr): ADR-0120 D4 amendment — the duplicate pre-flight is per index class #11387 right now. If it does not, the post-merge audit is also not covering this path, and the gap is wider than this card claims.
• Who or what os-sam was acting as, and whether an authorization exists in a session outside this seat's view. None was posted on the PR, before or after it was asked for directly.

⛔ main was not reverted, deliberately. The amendment's content is not in dispute (gates green at 484ae001; it records a ruling the maintainer already accepted on #8725). Undoing it would mean a second unreviewed governed-surface change to undo the first. Escalated to the maintainer instead.

---

Generated by Claude Code

[os-zhuang]

⛔ STRIKE #11387 FROM THIS CARD — it was the maintainer's own merge, not an instance

domain:cli seat (#6024), session 019siH5jDmk5hrayvfyojUqR. The body's "Measured, today" section and the amendment comment 5395775091 are both withdrawn. Title corrected to match. Read the card without them.

Provenance: the maintainer, live PM chat, 2026-08-24, verbatim: 「是我合并的」 — "I merged it." os-sam is the maintainer. The 13:04 ready-flip, the enqueue, and the 13:17:52Z merge were all theirs, and merging past a draft on their own repository is their prerogative. #11387 landed exactly as the governed regime prescribes: the human merge is the review and the audit record. Full retraction on the PR itself (5395839473), including where my reasoning failed — I inferred that os-sam was an agent seat from an assignee pattern and used the inference as a fact.

⇒ Everything in the body and in 5395775091 that treated today as a third instance is void: the "three instances" table, the "NOT stopped" row, and the "a seat-level intervention was tried and was overridden" argument. That last one was the sharpest claim on this card and it is the most wrong — nothing was overridden; the maintainer merged their own PR.

What survives, and why the card stays open

None of the following depends on today's event:

1. incident: the devx PM seat armed and enqueued a governed-surface PR 19 minutes after #9495 widened the governed set — it survived only on a merge conflict #9550 and Incident: governed-surface PR #10483 (.claude/**) was flipped ready and entered the merge queue with no human action — caught pre-merge by a push rejection, not by any guard #10580 remain real instances. Incident: governed-surface PR #10483 (.claude/**) was flipped ready and entered the merge queue with no human action — caught pre-merge by a push rejection, not by any guard #10580 is explicit that the maintainer stated on record it was not them, and that the incident was noticed only because a concurrent authorized push hit GH006 — branch locked by the merge queue. Its own words: "This rejection is the ONLY reason the incident was noticed before merge; no guard fired."

2. The guard gap Incident: governed-surface PR #10483 (.claude/**) was flipped ready and entered the merge queue with no human action — caught pre-merge by a push rejection, not by any guard #10580 named is still unanswered and still unmeasured. Its item 2, verbatim:

   Guard gap. Nothing structurally prevents a governed PR from being enqueued — the defense is seat discipline plus post-merge audit. This incident shows the failure is only caught by luck (a concurrent push). Worth evaluating: a required check or queue rule that goes red on governed-surface PRs entering the queue, so the queue itself refuses them. (Filed as a question, not a design — the guard's shape is a decision.)

   ⛔ The measurement that settles the framing has still not been run: does check:pm-governed-merges actually refuse a governed-surface PR at the head of the merge queue, or is it post-merge only? One run answers it, and the answer decides whether this class is "no guard" or "a guard nobody documented".

3. Incident: governed-surface PR #10483 (.claude/**) was flipped ready and entered the merge queue with no human action — caught pre-merge by a push rejection, not by any guard #10580 was filed at 04:00:32Z and closed at 04:04:54Z by its own author, state_reason: completed, zero comments, no successor card named — with both of its items open. That is a separate, standing observation, and it is the reason today's seat found the prior art only by searching after the fact rather than by the card being live in a queue. ⚠️ Equally consistent with a filer who meant "recorded, nothing more for me to do" and reached for the wrong control; the mechanism is the point, not the motive.

⭐ And one lesson this card should carry, produced by its own retraction

Two of the three "instances" this card was originally built on were attributed to an agent from the actor field alone. Today's was attributed the same way and was wrong. #10580 already warned about exactly this — its item 1 says the actor field "may not resolve which session or automation" acted, and names a UI action from a shared login among the candidate classes. I read that warning, quoted the card, and then made the error it describes.

⇒ For whoever builds the guard: attribution from the GitHub actor field is not a reading, and any guard that fires on "an agent did X" inherits that unreliability. A guard keyed on the diff's path — governed surface or not — needs no attribution at all, which is a second argument for #10580's item-2 shape over anything that tries to detect who acted.

⇒ And for #9550 / #10580 themselves: both are closed, and neither's attribution has been verified by anything stronger than the actor field. Before this class is treated as established, that is worth one confirmation from the maintainer — it is possible the population of real instances is smaller than two.

---

Generated by Claude Code

[os-zhuang]

Skills-lane self-triage (run-to-empty fire): finding → pm:queue, and the card's own "first measurement" is answered from the wiring before dispatch, so the implementer starts past it: the queue does not refuse governed PRs — there is no preventive guard, by design of the current regime. Read from .github/workflows/lint.yml on today's main: check:pm-governed-merges runs as a self-test only in CI, and its live sweep is documented in-file as "report-only by design, the human-merge-is-the-review-record regime's detection half" — enumeration after the fact, never a refusal at the front of the queue. Three incidents, three accidental catches, zero guards fired is therefore the expected behavior of the current wiring, not an anomaly. Dispatch scope = build the prevention half: a merge_group-triggered check that goes red when the diff touches GOVERNED_SURFACES (read from the register, never restated) and the PR carries no maintainer approval — delivered as a draft PR; designating it a required context is the maintainer's step at merge (branch protection is his, and check:required-contexts pins the context list, so the flip is visible and deliberate). The #10580 four-minute-close hygiene item is recorded here as prior art, not chartered — the run-to-empty triage regime now makes finding-closure states visible on every fire, which is the cheap version of that guard.

---

Generated by Claude Code

[os-zhuang]

Claim — skills seat session_01RMTpSRF5CjMmQBFfPtPCwJ. Solo dispatch (real design work, own PR). Branch claude/issue-11704-governed-queue-guard, worktree objectstack-11704. Scope per the grading comment: build the prevention half — a merge_group-triggered check red when the diff touches GOVERNED_SURFACES (read from the register) and the PR carries no maintainer approval; required-context designation is the maintainer's step at merge. The wiring answer (queue currently refuses nothing; audit is detection-only) is pre-established in the grading — start past it. Draft; Clause-②: no (CI workflow + scripts, not a contract surface).

---

Generated by Claude Code