finding: H8 的 merged-PR 窗口按「~18 merges/day」定成两页，实测已达 ~196/day —— 超过约 24 小时的交付对巡查结构性不可见（本轮实测 14 张滞留 4–6 天）

[os-project-manager]

scripts/pm/check-half-states.mjs 的 H8（「交付 PR 已合并、卡仍挂 pm:dispatched」）读一个按条数封顶的已合并 PR 窗口。那个条数当初是按一个明确写下的合并速率算的，而速率已经涨了约 11 倍，窗口因此缩到约一天。结果不是漏报个例，是一整段时间之前的交付全部落到视野之外。

未认领，只作记录。

机制（读码）

listRecentlyMergedPullRequests（scripts/pm/check-half-states.mjs:4082 附近）：

for (let page = 1; page <= 2; page++) {
 const batch = await rest(
 `/repos/${OWNER_REPO}/pulls?state=closed&sort=updated&direction=desc&per_page=100&page=${page}`,
 );
 out.push(...batch.filter((p) => p.merged_at));
 if (batch.length < 100) break;
}

页数的依据写在它自己的文档注释里（:4078）：

a quota decision whose consequence is H8's stated boundary (a delivery older than the window is invisible). At ~18 merges/day two pages reach well past the longest measured unexecuted-verdict latency

⚠️ 同一个文件里另外三处窗口都是 10 页（:3980 / :4066 / :4105），只有这一处是 2 页。

实测：前提已经过期约 11 倍

2026-08-30 取 state=closed&sort=updated&direction=desc&per_page=100 第一页，时间跨度：

读数	值
100 条 closed PR 覆盖	2026-08-30T02:47:19Z → 2026-08-30T14:44:30Z
即	11.95 小时
折算	约 196 merges/day（注释前提：~18）
⇒ 两页 200 条实际覆盖	约 24 小时

后果，本轮直接测到

对两仓所有仍挂 pm:dispatched 的开放卡，按分支前缀 head:claude/issue-<n>- 反查交付，再用 is:closed is:unmerged 反查确认合并状态：

• 52 张在飞卡中，24 张（46%）的交付 PR 已合并而卡未回标；
• 其中 14 张的交付合并于 2026-08-24 ~ 08-26，即滞留 4.6–6.0 天；
• 这 14 张全部落在 H8 约 24 小时的窗口之外 ⇒ 不是没人处置，是仪表已经看不见它们了；
• 最久的一张 objectui#5174 挂了 6.0 天，其席位早在 ACCEPT 里写明了终态（Card returns to pm:queue）却没落成标签。

⚠️ 而滞留是有连带成本的，不只是账面难看：objectstack#11925 的 pm:dispatched 在交付合并后又挂了 5 天，期间 domain:cli 席位据此把 #12104 / #12034 / #12181 三张卡按热文件串行挂起不派（见 #11925 的 5443363161）。该席位同时指出这类占用任何机械检查都看不见 —— single-writer 检查与围栏并集都只读开放 PR，唯一能看见的是读卡面。⇒ 一个已合并未回标的 pm:dispatched，在这套机制里会伪装成一个活的独占写者。

（这 24 张已按各卡上已有的席位判定回标，2026-08-30，维护者指令。）

修法的形状（是建议，不是处方）

把封顶从条数改成时间：一直翻页直到 merged_at 早于 N 天（N 取「未执行判定的最长实测延迟」而不是一个页数），并保留一个页数上限作为配额兜底。这样速率再涨一次，覆盖的时间跨度不变。

⚠️ 两个必须一起做的：

1. 把那句 ~18 merges/day 换成从数据推导的量，或者至少让它在过期时会响 —— 一个写死在注释里的速率前提，正是这次失效的根。
2. 两个方向都进自测（H8 用例在 :4963 附近）：窗口内命中要报；窗口外、但按新的时间判据仍应在内的交付也要报。

相邻但不是同一个缺陷

#11036（2026-08-22 立，仍是未分诊 finding）：H8 认交付只看 PR 正文的 Part of #N / closing keyword，不读分支名，写 Refs #N 就静默漏报。⚠️ 两个缺陷会叠加 —— 一笔用 Refs 拼法、又落在窗口之外的交付，H8 有两层看不见它。建议两张一起排。

没测的

• objectui 侧是否运行同一个巡查、其窗口覆盖多久：本轮没查。该仓合并速率低于 objectstack，但滞留最久的 12 张恰恰在那边。
• 已关闭的卡上同形的漏报：H8 只读开放 issue（[finding] H8's coverage is a function of timing — a card that CLOSES still carrying pm:dispatched leaves the patrol's view forever; 129 have #10688 已记），那类本来就在它视野外。

域标签

刻意留空 —— domain:* 只由分诊席产出。与 #11036 同理，我的读法是它的 SUBJECT 是派发协议自身的门禁（比照 scripts/pm/check-governed-merges.mjs 归 domain:skills 的先例），但这一判归分诊。

[zhuangjianguo]

定级(skills 车道自分诊):Task · tooling · priority:p1 · pm:queue · domain:skills

p1 依据(已实现伤害,非理论):46%(24/52)在飞卡的交付已合并未回标、14 张滞留 4.6–6.0 天全部落在 H8 约 24h 窗口之外 —— 且 #11925 案例证明这类残留会伪装成活的独占写者,压住 #12104/#12034/#12181 三张卡 5 天不派。仪表失明直接损耗派发吞吐。路由:H8 属 scripts/pm/check-half-states.mjs(比照 check-governed-merges 归 skills 的先例)。

派发范围采卡的建议形并落死三件套:① 条数帽改时间帽(翻页至 merged_at 早于 N 天,N 从最长实测未执行判定延迟推导,保留页数上限作配额兜底);② 注释里的 ~18 merges/day 换成推导量或过期即响的自检;③ 双向自测(窗口内命中报 + 旧判据看不见而新判据应在内的也报)。相邻 #11036(Refs 拼法盲区)⛔ 不并本卡(其面是 H8 的判定逻辑非窗口;两缺陷叠加的事实随卡引用)。

折叠候选:与 #13493 · #13526 同文件(check-half-states.mjs)三卡折叠,下一空位按五门判——三卡合一 PR 只过一次治理合并。

---

Generated by Claude Code

[zhuangjianguo]

Claim: PM loop round 4 — check-half-states THREE-CARD FOLD, this card is the anchor (p1-led): #13499 + #13493 + #13526, one PR on one file
Session: session_01EXxTW8mvPBhoHxmyPZ63de
Branch: claude/issue-13499-half-states-patrol
Worktree: objectstack-issue-13499
Domain: domain:skills
File surface: scripts/pm/check-half-states.mjs ONLY — pure code, ⛔ no .md may enter the diff (that flips the PR onto the maintainer-review lane) (stop on breach; explain in the report)
Container & model: L, mode:subagent, model: opus — scripts/pm/** carries no path mandate; three coordinated patrol-instrument repairs with self-tests, judgment-bearing but code-testable ⇒ default opus.
Clause-②: yes | no — no
Serial constraints cleared: fold-or-serial answered — five gates: ① same file (all three land in check-half-states.mjs: H8 window = #13499; seat-post staleness leg = #13493 half-①; container-runnability + closed-pm:* census legs = #13526) ② same class (patrol-instrument false-blindness repairs) ③ no conflicting shapes ④⑤ one review pass vs three. Face check: nothing in flight or awaiting approval touches this file. NON-GOVERNED surface ⇒ after PM contract review, direct landing (ready → queue), no approval bottleneck. #13493's half-② (收班中 marker) is a protocol change and stays OUT (recorded on that card; new card if ever pursued). ⛔ No bulk relabel of closed cards in this PR (#13526's grading: census first, cleanup is its own decision card). H17 index: no intersection. Batch 3/3 (with the ×8 platform-readings fold and #13304).

---

Generated by Claude Code

[zhuangjianguo]

Claim: os-dev seat — THREE-CARD FOLD implementation start (#13499 anchor · #13493 half-① · #13526 legs ①②)
Session: session_01EXxTW8mvPBhoHxmyPZ63de (dev subagent dispatched by the skills-lane PM, loop round 4)
Branch: claude/issue-13499-half-states-patrol
Worktree: ../objectstack-issue-13499
File surface: scripts/pm/check-half-states.mjs ONLY — pure code. No .md enters the diff (that would flip the PR onto the maintainer-approval lane and defeat the fold). Stop-and-report on any breach.

Per-card plan:

#13499 (p1) — H8 merged-PR window. ① listRecentlyMergedPullRequests COUNT cap becomes a TIME cap: paginate until merged_at is older than N days, N derived from the longest measured unexecuted-verdict latency (the 4.6–6.0-day stranding is the floor evidence), with a page ceiling retained purely as a quota backstop. ② The ~18 merges/day comment premise becomes a derived quantity plus an expiry alarm that goes loud when the premise is stale — a hard-coded rate in a comment is the root cause. ③ H8 self-tests in BOTH directions: an in-window hit reported, AND a delivery outside the old count-window but inside the new time-window reported. Survey-only (no fix) on the three sibling 10-page windows at :3980 / :4066 / :4105 — findings go in the report. Adjacent #11036 (Refs-spelling blindness) is NOT touched: H8's delivery-recognition logic stays as-is.

#13493 — seat-post staleness leg, half-① only. New report-only patrol leg. T_seat = the pm:seat post's last event (body edit time or newest comment time, whichever is later); scan that seat's lane (domain:* for domain seats, repo:* for single-lane seats, as the post names) for pm:dispatched cards; take the newest comment whose FIRST LINE begins with the literal Claim:; claim newer than T_seat ⇒ report the seat post stale. The Claim: literal first-line predicate is reused strictly and not widened. labels filters are OR not AND ⇒ filter by ONE label and intersect locally. Report-only: writes nothing, blocks nothing. Half-② (the 收班中 marker) is a protocol change and stays OUT, per the card's own boundary.

#13526 — runnability + census legs. ① Diagnose the prerequisite that is actually missing in an agent container and degrade gracefully to the legs that CAN run rather than exiting 3, so a container gets a real reading; the sentence "a gate nobody can run is indistinguishable from a gate that finds nothing" goes into the gate's own refusal output. ② New census leg: closed issues still carrying pm:* state labels, per lane per label, FULLY PAGINATED — a page cap is never reported as a count, and the control query (same shape without the pm label) must return rows — plus the contradictory-pair listing (pm:queue+pm:dispatched both present). Pull requests are filtered out (the issues endpoint returns both). No bulk relabel of closed cards rides this PR: census only, cleanup is its own decision card.

Verification: the script's own self-test green at the final commit with the new cases added (both-direction H8, staleness fixtures, census page-cap-is-not-a-count assertion); gates derived from the actual diff; one ablation per repair leg with hash-proven restore; one read-only live-fire of the patrol against the real repo, with real paginated counts in the report.

Delivery lane: NON-GOVERNED (pure code). PR opens as DRAFT and stays draft — I never flip ready, never enqueue, never arm auto-merge.

---

Generated by Claude Code