You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
[finding] Dedup scans are OPEN-scoped, so a card ruled and CLOSED the same day is invisible to them — #13901 duplicated #13526/#13605 six hours after the ruling merged #13965
Filed by the os-dev seat working #13901, session session_01Pk26oZ12t5N1hwGW1m1MgC. Filed unassigned and ungraded — domain:*, priority and type are triage's field. Out-of-scope side finding: it is the mechanism that caused #13901's dispatch, not #13901's subject.
Measured specimen — one day, one population, three cards
filed 2026-08-31T16:38:45Z — same population, re-measured independently
open, dispatched
PR #13752 (the ruling's implementation) merged at 10:43:41Z. #13901 was filed ~6 hours later and dispatched to a dev seat, which spent a full cycle re-deriving numbers that #13605's title already carried.
The two measurements agree to within a day's drift, which is what makes the duplication unambiguous rather than arguable:
The filing seat's dedup declaration on #13901 was honest and self-limiting, verbatim: "Title-only scan of all 408 open issues in this repo", with search_issues unavailable on that channel and an explicit "⛔ Not a claim that no duplicate exists".
That scan could not have found #13526 or #13605by construction: both were already closed when it ran. The blind spot is not a broken query — the scan worked exactly as specified. The specification is what excludes the population.
⭐ And a card is at its MOST duplicable right after it closes. A finding filed, ruled and implemented within one day leaves a board on which the subject is freshly settled, freshly interesting, and freshly invisible to the next seat's dedup. The window in which duplication is most likely is precisely the window an open-scoped scan cannot see.
⚠️ Why this is likely to get WORSE, not better
Ruling 批 #13 (2026-08-31, on #13605) directed every pm:* label query to scope itself to open cards, and PR #13752 pinned that in pmLabelListingPath with self-test coverage. That ruling is correct and this finding does not question it: it is about state reads, where a closed card is archive.
But dedup is not a state read. It asks "has this subject been carded before", and the answer lives disproportionately in closed cards. ⇒ The repo now has a well-pinned, well-reasoned state=open convention whose rationale does not transfer to dedup, and nothing currently distinguishes the two uses.
⛔ Not claimed the filing seat erred. It declared its scope and its limits accurately; a procedure that fails when followed correctly is a defect in the procedure.
⛔ No remedy recommended. Plausible shapes exist (a closed-card pass over recent closures during dedup; a dedup channel that reads state=all with a recency bound) and each has a cost against the shared API pool that the 2026-08-16 pool ruling governs. ⛔ That is a decision, not an implementation detail.
⚠️Cross-repo NOT MEASURED. Only objectstack was read.
Dedup declaration for THIS card
Repo-scoped REST /search/issues is 403 on this seat (measured this run), so one targeted MCP search_issues was used. 21 results, control satisfied: #13901 itself returned, so the zero-adjacent rows are readings rather than a dead query. Two near-misses examined and rejected, both about the dedup channel failing rather than being scoped:
Filed by the
os-devseat working #13901, sessionsession_01Pk26oZ12t5N1hwGW1m1MgC. Filed unassigned and ungraded —domain:*, priority and type are triage's field. Out-of-scope side finding: it is the mechanism that caused #13901's dispatch, not #13901's subject.Measured specimen — one day, one population, three cards
[finding]the same closed-cardpm:*residue populationcompleteddecisioncard on it; maintainer ruled 批 #13 at 06:21:56ZcompletedPR #13752 (the ruling's implementation) merged at 10:43:41Z. #13901 was filed ~6 hours later and dispatched to a dev seat, which spent a full cycle re-deriving numbers that #13605's title already carried.
The two measurements agree to within a day's drift, which is what makes the duplication unambiguous rather than arguable:
pm:dispatchedpm:queueThe mechanism
The filing seat's dedup declaration on #13901 was honest and self-limiting, verbatim: "Title-only scan of all 408 open issues in this repo", with
search_issuesunavailable on that channel and an explicit "⛔ Not a claim that no duplicate exists".That scan could not have found #13526 or #13605by construction: both were already
closedwhen it ran. The blind spot is not a broken query — the scan worked exactly as specified. The specification is what excludes the population.⭐ And a card is at its MOST duplicable right after it closes. A finding filed, ruled and implemented within one day leaves a board on which the subject is freshly settled, freshly interesting, and freshly invisible to the next seat's dedup. The window in which duplication is most likely is precisely the window an open-scoped scan cannot see.
Ruling 批 #13 (2026-08-31, on #13605) directed every
pm:*label query to scope itself to open cards, and PR #13752 pinned that inpmLabelListingPathwith self-test coverage. That ruling is correct and this finding does not question it: it is about state reads, where a closed card is archive.But dedup is not a state read. It asks "has this subject been carded before", and the answer lives disproportionately in closed cards. ⇒ The repo now has a well-pinned, well-reasoned
state=openconvention whose rationale does not transfer to dedup, and nothing currently distinguishes the two uses.⛔ Not claimed
state=allwith a recency bound) and each has a cost against the shared API pool that the 2026-08-16 pool ruling governs. ⛔ That is a decision, not an implementation detail.Dedup declaration for THIS card
Repo-scoped REST
/search/issuesis 403 on this seat (measured this run), so one targeted MCPsearch_issueswas used. 21 results, control satisfied: #13901 itself returned, so the zero-adjacent rows are readings rather than a dead query. Two near-misses examined and rejected, both about the dedup channel failing rather than being scoped:search_issuesis returning FALSE ZEROS — reproduced on three seats across two repos, and it DEGRADED mid-session, so every dedup that rode on it passed vacuously #13326 — MCPsearch_issuesreturning false zeros (the tool returns nothing).Link: rel="next"cursor silently returns 102 of 287 open issues — the dedup channelreferences/rest-channel.mdprescribes #13900 — RESTLink: rel="next"truncating to 102 of 287 (the page cursor drops rows).Neither describes a scan that reads every row it asked for and is blind because it asked only for open ones.
Generated by Claude Code
Generated by Claude Code