The half-states patrol's remaining COUNT-shaped windows carry the premise-rot H8 just shed — H22 worst (updated-ordered divisor), three bare 10-page caps state no coverage; H35 is the in-file precedent

[zhuangjianguo]

Filed by the skills lane seat from the survey PR #13601's report handed back (#13499 asked for the report; none of these were touched there — the fold's fence held). Same defect class the H8 repair just proved real with 14 measured strandings: a COUNT cap whose real coverage moves with the board's tempo while its reader assumes a time span.

The survey (at 9086f3ba9)

• CLOSED_ISSUE_WINDOW_PAGES = 4 (H22) — the worst: ordered by updated, so its rows are consumed by issue ACTIVITY rather than closures — a strictly more confusing divisor than H8's was, and H22's own docblock already records that surprise.
• COMMIT_WINDOW_PAGES = 3 (H23) — page cap, no coverage statement.
• Three bare 10-page caps in listIssues / listAllOpenIssues / listOpenPullRequests — reach moves with tempo, no coverage stated, no truncation announced.
• listRecentIssueEvents (H35) — ALREADY the target shape: time-bounded, page cap behind as quota backstop, reports truncation. The working precedent is in the same file, and H8's repair (PR fix(pm): time-cap H8's merged window, add the seat-staleness leg and the closed pm:* census #13601) now converges on it, so there are two precedents.

Shape of the fix (when dispatched)

Per window: convert the boundary to a time horizon derived from a measured need (H8's was worst-observed-latency + weekend), keep a page ceiling as a quota backstop that ANNOUNCES itself, and make every summary line state which of the two bound the pass. H22 additionally needs its divisor named honestly (activity-consumed, not closure-consumed). No shared helper is assumed — PR #13601's report measured that H22's divisor is a different quantity, so forcing one abstraction was rejected there; the dispatched dev re-derives whether one falls out.

File surface: scripts/pm/check-half-states.mjs — serial behind PR #13601's merge on this face.

Refs: #13499 (the proven instance + the survey's origin) · PR #13601 (the H8 conversion + H35 convergence) · #13597 value gate: mechanical premise-rot repair with a measured precedent, not prose.

Generated by Claude Code

[zhuangjianguo]

Claim: PM loop round 5 — dispatch on the check-half-states.mjs face freed by PR #13601's merge (03:27Z; this card was filed as next on that face)
Session: session_01EXxTW8mvPBhoHxmyPZ63de
Branch: claude/issue-13606-window-premise-rot
Worktree: objectstack-issue-13606
Domain: domain:skills
File surface: scripts/pm/check-half-states.mjs ONLY (self-test cases live inside the same file). Stop on breach; explain in the report.
Container & model: M, mode:subagent, model: opus — dispatch-gates --tier: scripts/pm/** carries no path mandate ⇒ PM judgment; multi-window horizon derivation on patrol code, judgment-bearing but non-governed ⇒ default opus.
Clause-②: yes | no — no (PM tooling; no contract accept/reject behavior)
Serial constraints cleared: PR #13601 MERGED 03:27Z — it was the sole holder of this face; nothing else in flight or queued touches this file. Non-governed pure code ⇒ direct-landing lane (contract-review-tier self-review by this seat on report, then ready + auto-merge). Line budget: n/a (code file, no line ratchet). H17: no intersection. Batch 1/3.

---

Generated by Claude Code

[zhuangjianguo]

Contract review PASS — direct landing arming (non-governed pure code)

Reviewed at head d440445c. Verified independently, not from the report: self-test re-run by this seat — ✓ check-half-states self-test: 1749 cases pass. (+64 over the merged baseline); one file, +685/−42, zero .md; mergedPageExhaustsWindow delegates to the new pageExhaustsWindow with #13601's direction pins untouched; the disclosure wording split is real and self-documented in place (「"boundary reached", NOT H8's "horizon reached"」 — preserving #13601's whole-line pin from being satisfied by a neighbouring clause, exactly the cannot-fail-check hazard this family is about).

The premise correction is accepted and is the review's highlight: the three bare 10-page caps were measured NOT to be recency windows (they page to exhaustion; none has ever hit its cap), and a copied time horizon would have dropped the OLDEST open rows — a 52.9-day-old open P0 invisible to the whole patrol. Applying the announce-the-ceiling half instead of the card's literal suggestion is premise_still_valid discipline working as designed; the card's survey line was wrong in a way only measurement could show. H22's 3-day closure horizon is bounded on both sides by measurement (floor: keep the 2-day coverage four pages delivered; ceiling: the ~347-row flood that disabled the row on the sibling install), the divisor is named honestly on the summary line (~188 updates/day vs ~11 closures/day), and the declared residual (the 3–8 day band visible to neither H22 nor H8, needing an H39-shaped count not a wider list) is the honest statement of what this does not fix. Live-fire delta (77→94 H22 rows, within 2 of the pre-code prediction; all other rows unchanged) closes the loop.

Landing: ready + auto-merge this stroke; the Fixes line retires this card on merge and pm:dispatched is stripped in the same sweep.

---

Generated by Claude Code

[claude]

os-dev-report

{
 "issue": 13606,
 "status": "done",
 "branch": "claude/issue-13606-window-premise-rot",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/13628",
 "premise_still_valid": {
 "H22 CLOSED_ISSUE_WINDOW_PAGES=4": "true, and worse than the card stated. Measured live 2026-08-31T03:36Z: 4 pages = 400 rows but only 226 cards (46% of the stream is PRs, filtered out AFTER paging). Rows are consumed by closed-issue UPDATE activity at ~188/day, not by closures at ~11/day — a 17.6x divisor confusion. The frontier is ragged, not merely short: 28 of 225 adjacent card pairs were out of closure order. Cost measured: 19 residue carriers closed within 3d missed, 40 within 4d, 265 within 7d.",
 "H23 COMMIT_WINDOW_PAGES=3": "true. The only docblock that DERIVED its cap from a measured rate, and it still drifted: same 3 pages bought 2.18d at the 2026-08-23 rate (137.5/day) and 2.73d at today's (109.9/day), +25% in 8 days.",
 "three bare 10-page caps (listIssues / listAllOpenIssues / listOpenPullRequests)": "FALSE for the time-horizon half; TRUE for the announce half. Measured: none of the three binds its cap (largest usage 4 of 10 pages; populations 91 / 354 / 21) and NONE is a recency window — each pages to EXHAUSTION, the 10 is a pure quota backstop. A created-time horizon there would DROP the oldest open rows, which is the population every predicate in this file exists for: an 8-day horizon discards 104 of 354 open cards (29%), the oldest open card being 76.9d old and the oldest open priority:p0 52.9d. So these three got the other half of the adjudicated shape — exhaustive paging kept, ceiling NAMED, truncation ANNOUNCED per listing. Reported as a deviation, not done silently."
 },
 "summary": "H22's closed-card window and H23's commit window are now TIME horizons (CLOSED_ISSUE_WINDOW_DAYS=3, COMMIT_WINDOW_DAYS=3) with announcing quota ceilings (12 each), converging on H8's and H35's shape. H22's divisor is named honestly in both its docblock and the summary line: rows are consumed by closed-issue UPDATE activity (~188/day, measured, pinned with its date) rather than closures (~11/day). Both horizons are derived from measured need, not guessed: H22's 3 days is bounded below by not regressing what 4 pages already delivered (2d of closures, complete) and above by the docblock's own anti-drowning argument in numbers (residue density 28-35%, so findings are linear in the horizon: 3d=96, 8d=370, against the ~347 flood that disabled this row on the sibling install); H23's 3 days is its own overlap argument (12 patrol cycles, past the ~9x it targeted). The three open listings keep exhaustive paging and gain the announcement they lacked. What fell out as shared is the DISCLOSURE (describeWindowBound), not the paging — the divisors and termination arguments genuinely differ, confirming #13601's pre-conversion measurement, but 'which of the two bounds ended this pass' is one question in every case.",
 "tests": "All at final commit d440445c (tree unchanged since; the gate union and the commit are the same tree). (1) File's own suite: 'check-half-states self-test: 1749 cases pass.' vs baseline origin/main 'check-half-states self-test: 1685 cases pass.' = +64 cases. (2) ABLATION, one per repair leg, predictions fixed in the harness BEFORE any leg ran; no build/dist step exists (node runs the script directly) so a mutation is live on disk, and the on-disk proof was still done unconditionally by RE-READING the file and counting the exact multi-line anchor (a first attempt using 'grep -cF' was itself wrong — a multi-line -F pattern is an OR of lines and read 3 where the truth was 0; it refused rather than proceeding, and was fixed). Leg A (H22 horizon removed) predicted RED, observed RED on 'a 4-day-old closure is outside' + 'a stale closure bumped by today's activity is NOT admitted'. Leg B (H23 horizon removed) predicted RED, observed RED. Leg C (disclosure never announces truncation) predicted RED, observed RED on 8 cases. Leg D (open-listing truncation not recorded) predicted RED, observed RED on 1 case — prediction OVERSTATED the radius: it also predicted the two open-summary cases, which correctly stayed green because they feed summaryLine a fixture and pin the renderer (leg C's job) rather than the recorder. Restore proven after EVERY leg: 'git diff HEAD' EMPTY and blob 109b59158c8075e6f147dc06fc927fa9a9fe7244 == HEAD blob. (3) GATES derived from the ACTUAL diff via 'node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack' (exit 0; 17 path-derived + 2 convention-triggered for editing a gate script): 16 ran and PASSED, each quoted by its own verdict line in the PR body — including 'dispatch-gates self-test: 1017 cases pass.', 'check-entry-guard self-test: 54 cases pass', 'check-bash32-floor self-test: 153 cases pass.', and bare-root-worklist 'OK self-test: 51 live row(s) ... none stale, none missing, none contradicted'. (4) TWO gates NOT MEASURED, reported as such rather than as pass or fail, in their own words: check-test-completeness 'PREREQUISITE NOT MET ... the local reading for this gate is NOT MEASURED. It is not a red' (exit 3, it grades a saved turbo test log only CI produces); check-partof-closing-keyword 'NOT WIRED — neither PR_BODY nor PR_NUMBER is set' — RE-RUN with PR_BODY set to the real PR body and it then PASSED: 'check:partof-closing-keyword: this PR carries no Part-of/closing-keyword contradiction.' (5) ESLint: repo-wide 'pnpm lint' (eslint . --no-inline-config) run IN FULL rather than narrowed, LINT_EXIT=0 — no narrowing justification needed because no narrowing was applied. (6) NUL: 'check-nul-bytes: OK (scanned 7541 text file(s) ... no raw ASCII control bytes)' plus a direct control-byte scan of the changed file, 0 hits. (7) LIVE FIRE (read-only) at d440445c, exit 0, new disclosures on the summary line: H22 'TIME cap of 3 day(s), read in 6 page(s) (boundary reached)' + the divisor sentence; H23 'TIME cap of 3 day(s), read in 4 page(s) (boundary reached)'; open listings 'EXHAUSTIVE listing, read in 12 page(s) (complete: paging reached the end of the stream, so this IS the whole population)'. Page costs match the derivation exactly (H22 predicted ~6 read 6; H23 predicted ~4 read 4), and H8's untouched clause still reads 'TIME cap of 8 day(s), read in 10 page(s) (horizon reached)'. (8) ANTI-DROWNING verified end-to-end on the live board, baseline vs branch: H22 rows 77 -> 94 against a pre-code measured prediction of 96 at a 3-day horizon; total findings 215 -> 233; every other row byte-identical (H30 23, H14 20, H9 18, H19 12, H5 10, H24 9), confirming the change is scoped to the windows.",
 "files_changed": [
 "scripts/pm/check-half-states.mjs"
 ],
 "changeset": "none — correct. scripts/pm/** is PM tooling that publishes nothing from any package, so the closed skip-changeset list applies. Label applied via the ADDITIVE POST /issues/13628/labels endpoint (never a whole-set PUT on a PR); read back: labels ['skip-changeset'], draft: True, state: open — the label write did NOT flip the PR ready.",
 "governed_surface_posture": {
 "state": "non-governed",
 "draft": "left DRAFT for the PM's contract-review-tier self-review, per the direct-landing lane. I did not flip ready, enqueue, or arm auto-merge.",
 "skills_surface": "no skills/** files in the diff, so the two-reading line-count report does not apply."
 },
 "deviations": [
 "THE ONE SUBSTANTIVE DEVIATION: the three bare 10-page caps did NOT become time horizons. Adjudication item 3 listed them for time-horizon conversion; live measurement falsified that premise (they are exhaustive inventories, not recency windows, and a created-time horizon would discard 29% of the open backlog including the oldest open priority:p0 at 52.9d). I implemented the adjudication's STATED PURPOSE for them — 'a page ceiling stays as a quota backstop that ANNOUNCES itself; the summary line states which of the two bound the pass' — and omitted only the clause the measurement contradicts. Evidence is in the PR body and in a docblock above listIssues. Flagging rather than assuming: if the PM wants the horizon anyway, it is a small change, but I recommend against it on the measurement.",
 "I touched ONE line of #13601's landed repair, against the 'do not re-do or undo any of it' instruction: mergedPageExhaustsWindow now delegates to the new generic pageExhaustsWindow. Same name, export, signature and byte-identical behaviour; #13601's own direction cases pin it unchanged and still pass. Done because H22's converted window needs that predicate EXACTLY (same ordering field, same selecting field, same monotonicity argument), so leaving H8 on a private copy would have made the second caller a hand-copy of the first — the failure mode the dispatch named. Trivially revertible if the PM disagrees.",
 "The shared helper says 'boundary reached' where H8 says 'horizon reached'. This is deliberate and load-bearing, not a style slip: #13601 pinned H8's truncated case with a WHOLE-LINE substring check, so reusing its phrase would have satisfied that check from a neighbouring clause and quietly retired it. Filed as #13629.",
 "Three pre-existing self-test cases were updated rather than left: two asserted the removed constants COMMIT_WINDOW_PAGES / CLOSED_ISSUE_WINDOW_PAGES (converted to history notes, following #13601's own pattern for MERGED_WINDOW_PAGES), and one ('summary: ...and states the window boundary') pinned the phrase 'invisible by design' that this conversion removes by design — it keeps its subject against the disclosure that replaced it."
 ],
 "mcp_calls": "0 — the whole run used the repo-scoped REST channel via curl (probed first: HTTP 200; gh is ABSENT in this container). Card body, comments, PR #13601's diff, all measurements, PR creation, the label write, the dedupe listing and the finding were all REST. No MCP GitHub tool was called.",
 "open_questions": [],
 "out_of_scope_findings": [
 "filed as #13629: check-half-states' per-window summary assertions match the WHOLE summary line, so a neighbouring window's clause can satisfy them — a check that cannot fail, in the file whose subject is refusing exactly that. Measured, not suspected: drafting the new disclosures with the parallel wording turned H8's negative case red immediately, and its POSITIVE case would keep passing even if H8's own disclosure were deleted. Unassigned, no labels, left for PM triage.",
 "not filed, environment observation only: this container sets GITHUB_TOKEN to the literal placeholder 'proxy-injected' (the real credential is injected by the outbound proxy), so the script's own TOKEN read sends 'Bearer proxy-injected' and gets HTTP 401. The live fire was run with 'env -u GITHUB_TOKEN -u GH_TOKEN'. Not a repo defect — probeTransport would classify it as a bad credential, which is correct — but it is the reason a naive live fire in an agent container fails, and worth knowing before someone reads that 401 as a broken gate."
 ]
}

Generated by Claude Code

---

Generated by Claude Code