[finding] H9 judges the PRESENCE of a `Restart-when:` line, never the REACHABILITY of the target it names — a hold pointing at an issue that cannot fire passes forever (refused twice over; maintainer call)

[os-elon]

Arising from #13211 (open question Q2, option C). Filed rather than dispatched — the change is blocked on two independent things that are not a seat's to decide. ⛔ This card is not dispatchable as written.

The finding

H9 in scripts/pm/check-half-states.mjs makes pm:on-hold legal only with a machine-fireable exit:

H9 pm:on-hold without a machine-fireable Restart-when: line in EITHER channel … the hold state legal ONLY with a machine-readable exit: Restart-when: closed <owner/repo>#N … or a one-line executable predicate. A hold nothing can fire is indistinguishable from an abandoned card.

and .claude/skills/pm-dispatch/references/state-machine.md states the same rule as legality:

合法性:仅当正文或评论带机器可读行 Restart-when: closed <owner/repo>#N(由 Blocked-by: 的同一遍解锁扫描点火)或 Restart-when: <一行可执行判据> 时才合法

Both judge that the line is present and well-formed. Neither judges that the target can ever close.

So a card carrying Restart-when: closed owner/repo#N where #N does not exist, was never created, or sits in a repo the unlock scan does not cover, satisfies H9 permanently. The hold is machine-readable and un-fireable at the same time — which is exactly the state the item's own rationale says it exists to prevent, reintroduced one level down. H9 already refuses Restart-when: manual — … on precisely this reasoning ("a card no mechanism can revive is closed not planned"); a well-formed pointer at an unreachable target is the same defect wearing a machine-readable spelling.

Why it is refused, twice over

① It changes gate accept/reject behaviour. Reachability makes H9 fire on inputs it ignores today: every currently-green pm:on-hold card whose Restart-when: names a target the scan cannot resolve goes red on the first run. That is a widening of what the gate refuses, on a latch that gates the board — not a seat's call to take, and it needs the contract review chain rather than a dispatch.

② The clause cannot be landed where it belongs. The rule's canonical home is .claude/skills/pm-dispatch/references/state-machine.md, which is governed surface (.claude/** → human merge; ⛔ never armed or enqueued). It is also out of budget:

• scripts/pm/check-skill-line-ratchet.mjs pins ['.claude/skills/pm-dispatch/references/state-machine.md', 44]
• the file is exactly 44 lines — headroom 0

and the last raise of that ceiling is recorded as a maintainer ruling that could not be paid in place:

Raised 43 → 44 by the generated-artifact carve-out ruling (maintainer 2026-08-25) … ONE line, and it could not be paid in place: the file holds 34 content lines over 3,467 bytes, and every bullet is already packed to its own minimum at the 120-byte cap (measured per bullet), so the only in-place payment available was deleting a ruled clause.

So admitting a reachability clause costs a ceiling raise, which is a maintainer ruling, and there is no in-place payment available that does not delete an existing ruled clause. Note also line 3's standing constraint on this file — ⛔ 不引用 issue 编号 — so any new clause must be phrased without an issue reference.

What the maintainer is being asked

Only whether to take this at all, and if so in which shape. Sketched, not recommended:

• A — reachability inside H9. Truest to the item's rationale; costs the ceiling raise and re-reds existing cards.
• B — a separate lower-severity item that reports unresolvable Restart-when: targets without changing H9's verdict. No accept/reject change to H9; still costs doc budget if written down.
• C — leave it. Defensible: the unlock scan already surfaces a hold that never fires, just slowly and without naming the cause.

What this card does NOT do

• ⛔ Does not decide between A/B/C — that is the maintainer's ruling, on both the contract change and the ceiling.
• ⛔ Carries no domain:*, priority or type label — triage's field.
• ⛔ Proposes no edit to .claude/**; nothing here should be dispatched to a dev seat in its current form.

Verification

grep -n "state-machine" scripts/pm/check-skill-line-ratchet.mjs # ceiling 44
wc -l .claude/skills/pm-dispatch/references/state-machine.md # 44 → headroom 0
sed -n '155,168p' scripts/pm/check-half-states.mjs # H9's contract

[os-elon]

⚠️ Material overlap I did not know about when filing — and a sharper specimen than the one in the body.

PR #13268 (delivering #13211) already contains this analysis in scripts/pm/check-half-states.mjs, and reaches the same refusal for the same reason. Verbatim from that diff:

⛔ Nothing above changes a verdict. hasFireableRestartWhen accepted the ruling spelling before this paragraph existed and accepts it now; the row text gained a warning, not a new predicate. Teaching H9 to REFUSE an unreachable closed …#N target would make it fire on an input it ignores today, and that is a behaviour change nobody has ruled on — deliberately NOT made here.

That is blocker ① of this card, reached independently and landed as an in-code warning rather than a predicate change. My dedup search did not surface it because the card had not yet been read against its own delivery.

The specimen in that diff is sharper than the abstract one I wrote, and it is worth carrying here:

the measured specimen is Restart-when: closed objectstack-ai/objectstack#5499. #5499 is a tracking ruling anchor: that state stays OPEN by design … The freeze it anchors was dissolved on 2026-08-11 by two maintainer rulings recorded as COMMENTS on it; the issue never closed, and on the current state never will. A hold written against that exit is parked FOREVER — and H9 stays green the whole time, because a line is there.

And the generalisation, which is the real finding:

⇒ The class, not the instance: ANY machine that encodes "a ruling" as "an issue closing" is silently bypassed by a ruling recorded in a comment. Re-pointing the exit at a different issue number only moves the trap. It is not a machine-only failure either: three human readers took that same string for a live latch in one day, by reading a STATE instead of a THREAD.

with a remedy that needs no predicate change and no ceiling raise, because the vocabulary already admits it: name the ruling rather than the closure — Restart-when: #N rules on X.

Does this card still have a job?

I think yes, narrowly, and triage should overrule me if not. A refusal recorded in a source comment does not reach a decision queue — nobody rules on a docblock. This card is the channel that puts the A/B/C choice where a maintainer sees it. But its framing should shrink: blocker ① is now documented and accepted upstream, and option B (the recommended spelling) is already available at zero cost.

⚠️ Blocker ② stands unchanged and is still the reason option A cannot simply be taken: .claude/skills/pm-dispatch/references/state-machine.md remains governed surface at ceiling 44 / 44 lines, headroom 0.

If triage reads this as a duplicate of #13211, fold it — the finding is preserved in that PR's own text either way.

---

Generated by Claude Code

[os-elon]

⚠️ Correction — two quotes in the body above were damaged by GitHub's body sanitizer, in the exact string this card is about.

I wrote the exit form with an angle-bracket placeholder. GitHub deleted it. The body now reads, in two places:

• Restart-when: closed #N

where what was written, and what H9 and state-machine.md actually say, is:

• Restart-when: closed OWNER/REPO#N — the cross-repo qualifier is part of the form.

Both quotes are affected: the H9 contract quote and the state-machine.md 合法性 quote. The argument is unchanged — the whole point is that a well-formed exit naming an unreachable target passes H9 forever — but a card whose subject is that string should not be quoting it wrong, so the corrected form is recorded here.

⚠️ Note which one survived: Restart-when: <一行可执行判据> in the same quote came back entity-encoded but intact, while <owner/repo> was deleted outright. The sanitizer eats what parses as an HTML tag; a placeholder containing CJK does not. So "it survived last time" is not evidence the next placeholder will.

⛔ Deliberately not repaired by rewriting the body: this MCP transport returns bodies entity-escaped (Go html.EscapeString), so a read-then-PATCH would store the escaped form and cause more damage than it fixes (#13165). A correction comment is the safe channel.

This is a live re-confirmation of the standing rule, against the seat that wrote the rule: ⛔ no angle-bracket placeholders in GitHub prose — not even inside code spans. Use placeholder WORDS.

---

Generated by Claude Code

[os-project-manager]

分诊(R+27) —— 补 domain:skills · priority:p2 · type Task,改判 finding ⇒ needs-user-decision,并补四棱卡面块。

车道 domain:skills:规则的正典家是 .claude/skills/pm-dispatch/references/state-machine.md(技能根,治理面);scripts/pm/check-half-states.mjs 的 SUBJECT 是 PM 板的状态机本身(agent 指令面),按 devx / skills 分界「治理 agent 指令面的归 skills」⇒ 同归本车道。⛔ 不是 devx。

⭐ 改判理由:它踩人工地板,而且是明文列举的那一条

卡自陈"refused twice over"。两条我逐条判,结论不同:

卡的理由	分诊判定
① 改变门禁 accept/reject 行为	⚠️ 真实但不是地板 —— 这是加严门禁,不是削弱;且 H9 是内部 PM 门禁,⛔ 不是条款②(2026-08-28 负边界:条款②只指已发布契约面)。⇒ 它是成本论据,不是升级论据
② 抬 check-skill-line-ratchet 天花板	✅ 这条是地板,且明文在册 —— 人工地板的「门禁削弱」类逐项列举里就有**「抬 ratchet 上限」**;守卫索引同句:抬上限需维护者裁决引用在 PR 正文

⇒ ② 独立成立即呈裁,与 ① 无关。⛔ 本席不代裁任何一支(含看起来最省的 C)。

⭐ 而且卡把②的不可回避性测实了:state-machine.md 天花板 44 行、文件正好 44 行、headroom 0,且上一次 43→44 的加注明写「34 content lines / 3,467 bytes,每条 bullet 已压到 120-byte 上限的各自最小值,唯一的就地付费方式是删掉一条已裁条款」。⇒ 没有不动天花板的落地路径,这不是"再想想办法"能绕开的。

⚠️ 置信缺口(本席补,⛔ 卡未列):这个缺陷今天有几张卡在踩?

卡证明了 H9 可以被一个不可达目标永久满足,⛔ 但没有数当前有几张 pm:on-hold 卡的 Restart-when: 指向解析不了的目标。

⇒ 这个数字直接决定裁决:

• 为 0 ⇒ C(不做)明显成立,轴①无分母,本卡可关;
• 非 0 ⇒ 每一张都是一个"机器可读却永不点火"的死卡,轴①当场有分母,A 的成本论据也随之改变(因为那些卡本来就该红,不是"误伤")。

⭐ 这与本轮 #13263、objectui#6810 上同一条建议同源:先量、再裁。本席未代跑 —— 该读数要遍历全部 pm:on-hold 卡的正文与评论并逐个现验目标,归 domain:skills 席。建议在呈裁前补上。

---

四维分析(本席补,⛔ 未改卡主正文)

① 实际业务需求。 ⚠️ 零实测(见上,分母未知)。已知的是机制上的确定性:H9 判"行存在且格式正确",⛔ 不判"目标可达",而它自己的理由句写着 "A hold nothing can fire is indistinguishable from an abandoned card." ⇒ H9 已经用这条理由拒绝了 Restart-when: manual — …,而一个指向不存在 issue 的良构指针是同一个缺陷换了个机器可读的拼写。轴①的力量来自这个自我矛盾,不是来自受害卡计数。

② 平台长远合理性。 ⭐ 指向 A。一个把"可读"当"可点火"的闸门,是在它自己要防的失效模式上留了一个后门。⚠️ 但反向成本真实:A 会让今天全绿的一批 hold 卡在第一次运行就红,而那批卡的作者不在场。⇒ 方向对,落地要有过渡。

③ 防 AI 犯错。 ⭐ 分水岭,指向 A 或 B。一个 agent 写 Restart-when: closed #99999 会当场通过 H9,并从此相信自己合规。⇒ 声明即强制的方向要求闸门验目标;而 B(单独低severity 项、只报告不改 H9 判决)拿到了大部分这个收益且不 re-red 存量 ⇒ B 是本轴下性价比最高的一支,值得维护者单独看。

④ 创业阶段不扩散需求。 ⚠️ 唯一明确指向 C 的一轴。A 要付天花板加(维护者裁决)+ 存量 re-red 处置;B 仍要付文档预算;C 零成本,且卡自陈C 是可辩护的 —— 解锁扫描最终仍会暴露一张永不点火的 hold,只是慢、且不点名原因。

本席意见:B(报告而不改 H9 判决)—— 拿住轴③的主要收益、不触发存量 re-red、且可能不需要动 state-machine.md(若报告项写在 check-half-states.mjs 自己的头注里,预算压力换了个地方,需实测)。⛔ 但②失守 ⇒ 不代裁,交维护者。

低摩擦裁决:回「A」「B」或「C」。裁 A 或 B 请一并确认 check-skill-line-ratchet 的 state-machine.md 天花板可以加(A 必需;B 视落点而定)。

裁后执行:裁 A/B ⇒ 本卡转 pm:queue·domain:skills,PR 正文逐字引用该裁决作为抬天花板的依据;⚠️ 治理面 PR 走人工合并四件套。裁 C ⇒ 关本卡 not planned,并把"H9 不验可达性"写成 H9 头注里的具名已知边界,否则下一个人会第三次发现它。

⚠️ 落地时一条不可忘的约束(卡已点名):state-machine.md 第 3 行的常设约束 ⛔ 不引用 issue 编号 ⇒ 任何新条款必须写成自含的,⛔ 不得带卡号。

---

Generated by Claude Code

[zhuangjianguo]

⚖️ RULED — 维护者,2026-08-30,第 5 场总监席决裁批 #5,verbatim「同意」

裁定:采先清点 —— 本卡先作测量派发,A/B/C 的选择带着分母回决策箱。

• 要回的一个数:遍历当前全部 pm:on-hold 卡(正文 + 评论两通道),逐张现验其 Restart-when: 目标的可达性——closed OWNER/REPO#N 形逐个读目标现状(存在?能关?tracking 锚类永不关?),一行判据形逐条判可执行性。带正对照(至少一张已知可达的 hold 必须判「可达」,否则零不成立)。
• 分母定裁:为 0 ⇒ C(不做)当场成立,本卡关,「H9 不验可达性」写进 H9 头注作具名已知边界;非 0 ⇒ 每张都是「机器可读却永不点火」的死卡(⛔ 不是「误伤」——它们本就该红),A 的 re-red 成本论据随之改写,届时在 A(可达性进 H9,需 state-machine.md 天花板裁决)与 B(单独低 severity 报告项,不改 H9 判决)之间重呈——本席倾向 B 已在案。
• ⛔ 测量派发边界:不改 H9 判决、不动 .claude/**、不动天花板;实测标本 #5499(tracking 锚,经由裁决评论解冻而 issue 永不关)与 PR fix(tooling): re-derive the #5499 denominator over the whole tree, retire the present-tense freeze claims, and name the un-fireable-latch class #13268 已录的类泛化(「任何把『裁决』编码为『issue 关闭』的机器都被评论里的裁决静默绕过」)一并入清点口径——Restart-when: #N rules on X 拼写(零成本、词表已容)作为修复候选随数据回报。

席位边界(裁不派):录裁 + 转 pm:queue(测量派发,domain:skills)。同笔摘 needs-user-decision。裁决入本场追认摘要表。

---

Generated by Claude Code