incident: a self-declared P0-suspect sat 26h in the domain-without-pm-state half-state — both healing mechanisms existed and neither fired visibly

[os-support-ai]

Maintainer report (2026-08-19, PM chat, verbatim): 「项目经理等分诊,但是没有切换 label,导致挂了很久。」「我刚和他说了他才处理。」

Timeline, measured

A QA-wave card (data-integrity DELETE regression, body self-declaring "P0 checklist-item failure … priority label is triage's to set") was filed 2026-08-17T22:18Z, correctly left unlabelled for routing. It later acquired domain:engine-core (+bug, regression) without a paired pm-state label — the half-annotated shape the protocol says its own single-label writes produce by design. In that shape it was invisible to every seat's candidate query for ~26 hours, until the maintainer personally poked a seat at 2026-08-19T00:09Z (closed as duplicate — the underlying defect had meanwhile been handled elsewhere, which makes the hang pure waste, not lost coverage).

Why both existing defenses failed

1. Triage sweep disjunct ③ ("有 domain:* 无 pm-state") exists precisely to heal this shape, every round, hourly — and did not, for ~26h. Suspected mechanism: the per-round cap with 优先最新 ordering structurally starves OLD half-states — the longer a card hangs, the less likely the sweep reaches it. Aging inversion: the cap should prioritize the oldest (and any P0-suspect) half-states first, not last.
2. The emergency-triage channel (p0 嫌疑 ⇒ immediate fable triage subagent, no waiting for the Routine) had its trigger sitting in the card's own body — but the seat that saw the card "waited for triage" in session memory, leaving zero visible state. Waiting is a state; it must land on the card (a comment naming the awaited seat at minimum; for a P0-suspect, invoking the emergency channel is the mandated move, not an option).

Mechanizable directions (grading adopts all three as this card's scope)

• scripts/pm/check-half-states.mjs: add an age-alarm detector for domain-without-pm-state (report-only, per the family's convention), with a louder line when the card's body self-declares P0/data-integrity — half-states older than one sweep cycle are a defect of the healing loop, not inventory.
• references/dispatch-runbook.md (triage sweep discipline): the half-state disjuncts process oldest-first, P0-suspect first — 优先最新 applies to fresh intake only, never to the healing backlog.
• One protocol line at the 状态变更不过夜 clause: waiting on another seat is a state — it exists only if written on the card (who is awaited, since when); a P0-suspect wait ⇒ the emergency-triage channel is mandatory.

Graded at filing by the skills seat (own-lane exception): pm:queue, M (script detector + two ratcheted instruction lines; runbook 223/223 and SKILL.md-adjacent — payment owed). Serial: dispatch after the hanging SKILL.md/runbook traffic clears (#9769 in queue, the four-axis card behind it); next shift's first dispatch if tonight's wind-down closes first.

[os-warren]

Claim: PM loop round 1
Session: session_01AeA3nU1B5Q2pgxqxgUrexd
Branch: claude/issue-9800-half-state-age-alarm
Worktree: objectstack-issue-9800
Domain: domain:skills
File surface: scripts/pm/check-half-states.mjs, .claude/skills/pm-dispatch/references/dispatch-runbook.md, .claude/skills/pm-dispatch/SKILL.md (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: claude-fable-5 — mandatory per this dispatch's node scripts/pm/dispatch-gates.mjs --tier run: "Model tier — MANDATORY: claude-fable-5 (derived from the file surface, not recalled)" — runbook and SKILL.md both match .claude/skills/pm-dispatch/** (clause ①)
Clause-②: no
Serial constraints cleared: SKILL.md hot-file queue checked — #9315 (same-file SKILL.md, hold/unlock two-line rule) is deliberately held behind this card and will dispatch next round; #9769 (previous SKILL.md traffic named in this card's own serial note) MERGED 2026-08-18; no open PR touches any of the three files (open-PR list read this round). #8941 no longer implies a SKILL.md edit (re-graded to coordination/tracking this round — see its thread).

---

Generated by Claude Code

[os-warren]

{
 "issue": 9800,
 "status": "done",
 "branch": "claude/issue-9800-half-state-age-alarm",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/9842",
 "premise_still_valid": true,
 "summary": "All three graded directions implemented. (1) check-half-states.mjs gains H13: age-alarm for the domain-without-pm-state half-state, report-only, threshold constant DOMAIN_HALF_STATE_STALE_HOURS = 2 (one hourly sweep cycle survived, rationale in a comment at the constant), with a louder P0-SUSPECT line prescribing the emergency-triage channel when the card's own title/body self-declares P0/data-integrity (read through stripMarkdownCode). Delta vs the PM mechanism assumption: the shape was NOT among the existing checks and no existing listing could even fetch it (all are label-scoped, the shape is defined by label absence), so the change adds the sweep's only unscoped listing (listAllOpenIssues, 10-page cap, stated boundary). (2) dispatch-runbook.md gains the 半状态治愈积压排序 clause (disjuncts ②③ oldest-first, P0-suspect first; 优先最新 fresh intake only) in the 紧急卡 section, paid at the 223/223 ceiling by five genuine dedups of text restated elsewhere. (3) SKILL.md: sweep line now scopes 优先最新 to fresh intake, and the 状态变更不过夜 clause gains waiting-is-a-state (who is awaited, since when, on the card; P0-suspect wait mandates the emergency channel) — net 0 lines.",
 "tests": "node scripts/pm/check-half-states.mjs --self-test at d41e862b0: '✓ check-half-states self-test: 162 cases pass.' (exit 0, captured before any pipe; 22 new H13 cases). Reverse verification from the committed state, both restored via git checkout from the branch: adding pm:blocking to PM_STATE_LABELS reddened exactly 'H13: pm:blocking alone is NOT a state' (exit 1, 1 of 162); flipping the threshold boundary to strict-less-than reddened exactly 'H13: exactly at the threshold' (exit 1, 1 of 162). Plain-node scripts, no build step, so no dist rebuild applies to the ablation. Live sweep not runnable in this container: --probe exits 3 (proxy-placeholder token 401 + shared-egress anonymous quota exhausted), so the unscoped-listing wiring is verified structurally and by predicate self-tests; the next Routine fire exercises it live.",
 "open_questions": [],
 "out_of_scope_findings": []
}

Machine-checkable fields (all at head d41e862b0, each verdict from the gate's own printed line, exits captured before any pipe):

gates:

• check:pm-half-states (self-test): "✓ check-half-states self-test: 162 cases pass." — exit 0
• check:pm-skill-ratchet: "✓ .claude/skills/pm-dispatch/SKILL.md is 681 lines (ceiling 682; headroom 1)." · "✓ .claude/skills/pm-dispatch/references/dispatch-runbook.md is 223 lines (ceiling 223; headroom 0)." — exit 0 (self-test 12 cases pass)
• check:pm-skill-id-lint: "✓ check-skill-id-lint: 9 file(s) clean (pattern /#[0-9]{3,}/g)." — exit 0
• check:pm-governed-merges (self-test): "✓ check-governed-merges --self-test: 77 assertions" — exit 0
• check:partof-closing-keyword: "✓ check-partof-closing-keyword self-test: 28 cases pass." — exit 0
• check:nul-bytes: "check-nul-bytes: OK (scanned 6278 text file(s) … no raw ASCII control bytes)." — exit 0
• check:doc-authoring: "✓ doc authoring guard: 377 files clean — no bare metadata literals." — exit 0
• check:skill-frame-sync: "binding sentence present in all 4; 4 count mention(s) agree" — exit 0
• check:cross-package-test-inputs: "OK: 12 package(s) read outside themselves, all declared" — exit 0
• check:doc-formula-expressions (lint pkg, dependency closure built first): "✓ 22 record-scoped formula example(s) … judged clean" — exit 0
• node scripts/pm/dispatch-gates.mjs re-derived with no path arguments at head: family list identical to dispatch time, no additional families.

line_budget:

• .claude/skills/pm-dispatch/SKILL.md: before 681 / after 681 / ceiling 682
• .claude/skills/pm-dispatch/references/dispatch-runbook.md: before 223 / after 223 / ceiling 223

deviations:

• PM mechanism assumption falsified as invited: the domain-without-pm-state shape was not an existing check and was structurally invisible to every existing listing; implemented the detector plus the sweep's only unscoped listing and noted the delta (bigger gap than the card states).
• Live-mode run of the new listing is not possible in this container (probe exit 3); coverage is self-test plus structural mirror of the existing listing helpers.
• SKILL.md sat at 681/682 (headroom 1) on origin/main, not exactly at ceiling as graded; runbook was 223/223 as graded. Both files land at net 0 lines; content additions are paid by documented dedups (itemized in the PR body), not by re-wrap.
• skip-changeset applied and read back after the bot settle window: labels now [documentation (bot), skip-changeset].

files_changed:

• scripts/pm/check-half-states.mjs (+H13 predicate, constants, unscoped listing, sweep wiring, header doc, 22 self-test cases)
• .claude/skills/pm-dispatch/references/dispatch-runbook.md (net 0 lines)
• .claude/skills/pm-dispatch/SKILL.md (net 0 lines)

---

Generated by Claude Code

---

Generated by Claude Code

[os-warren]

ACCEPT — reviewed against GitHub, not the report. PR: #9842

• Diff verified by this seat's own fetch: exactly the three claimed files (+207/−33). All three graded directions delivered.
• PM mechanism assumption falsified and the falsification accepted as good delivery: the domain-without-pm-state shape was not merely un-alarmed — no existing listing could even fetch it (all label-scoped; the shape is label-absence). The delta (H13 + the sweep's only unscoped listing, 10-page cap stated) was invited by the dispatch and is bounded.
• H13 design spot-checked in source: PM_STATE_LABELS matches the protocol's state vocabulary with pm:blocking deliberately excluded (derived cache, not a state — consistent with SKILL.md); exemptions mirror the sweep's own exclusions (tracking/status:parked/qa-run); threshold constant carries its rationale.
• Ratchet payments audited line-by-line by this seat (the review obligation for paid cuts): the 2026-08-13 pm:blocking verbatim quote survives at runbook 全序 section line 8; the replay identity triple survives in the runbook's 通知重放去重 section; the three principle restatements cut from the runbook all have live homes in SKILL.md / os-dev.md. No content lost; net 0 on SKILL.md (681/682), runbook at 223/223.
• Reverse verification: two legs with predicted directions, each turning exactly one named self-test case red (1 of 162), restored after each. Self-test 162/162.
• Live-sweep probe exit 3 in this container class is the known limitation — it is also the standing evidence for the follow-up card giving this script a scheduled caller (check-half-states is a healing mechanism with no standing caller — eight malformed claims and an unenumerated two-lane backlog went unseen until the maintainer asked #9844 queues behind this PR).
• Governed surface (.claude/**) ⇒ terminal three-step: review recorded here; the PR stays draft, visibly awaiting the maintainer's merge (⛔ this seat will not flip ready / queue / auto-merge); the round report lists it under "awaiting a human merge".

---

Generated by Claude Code