patrol: two report-only predicates for the pm:blocking machinery — cache coherence both directions, and oldest-unclaimed-blocking age

[os-warren]

Maintainer ruling (2026-08-19, PM chat): the proposal was approved verbatim — 「同意」 — following two prompts in the same thread: 「当一个任务被更新为 blocked 的时候,阻塞他的issue 是不是应该同步更新为 blocking」 and 「然后车道项目经理应该优先处理 blocking」. The standing design stays (pm:blocking is a triage-sweep-derived cache off the Blocked-by: body index, single producer, ⛔ never hand-applied; the selection order already ranks it second only to p0). What this card adds is the always-on eyes on both halves of that design. Filed and graded by the skills seat (own-lane exception; session session_01AeA3nU1B5Q2pgxqxgUrexd).

Scope — scripts/pm/check-half-states.mjs, two new report-only predicates (anchor rows via the existing patrol)

1. pm:blocking cache coherence, both directions, derived from the same body reads the sweep already performs:
   • a card carrying pm:blocking with no open card's Blocked-by: line targeting it → stale cache row (the label is boosting a card nothing depends on — worse than absent, it lies with authority);
   • an open card targeted by ≥1 open card's body Blocked-by: line but not carrying pm:blocking → missing cache row (a real unblocker invisible to the selection order).
     Report-only: the fix stays the triage sweep's derivation pass, never this script.
2. Oldest unclaimed pm:blocking age: one summary row naming the oldest open, unassigned pm:blocking card and its age — selection-order compliance made visible (a lane that keeps letting blocking cards age past fresher picks now shows up on the anchor by name; nothing reddens, the maintainer and seats simply see it).

Conventions as established: exit-0 on completed sweep, findings are patrol input never gate verdicts, self-test cases per predicate (positive/negative shapes for each direction), thresholds as named constants with rationale comments.

Serial

check-half-states.mjs hot file: queues behind PR #9929 (H5 extraction fix, in the merge path) — dispatch after it lands and re-measure the file. Not a governed path. Graded pm:queue, S/M mechanical.

[os-warren]

Claim: session ae0d8bd1-5667-5f58-8ff8-fa22ec154325 · branch claude/issue-9935-blocking-patrol-predicates

串行前提已解除:PR #9929(H5 提取修复)于 2026-08-19T09:00:09Z 合并,check-half-states.mjs 热文件空闲。折叠检查:当前队列无第二张同文件卡(#9678 热文件是 check-required-contexts.mjs,且串行在 PR #9940 人工合并之后)→ 单卡派发。模型档:路径无强制(dispatch-gates --tier 实跑),卡内容为 report-only 谓词、不改合同行为 → opus(默认档)。

---

Generated by Claude Code

[os-warren]

{
 "issue": 9935,
 "status": "done",
 "branch": "claude/issue-9935-blocking-patrol-predicates",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/9945",
 "premise_still_valid": true,
 "summary": "Added H14 (pm:blocking cache coherence, both directions) and H15 (oldest unclaimed pm:blocking, one visibility row) to scripts/pm/check-half-states.mjs, both report-only, both surfaced through the existing patrol with no workflow change. H14 reads a new Blocked-by: reverse index built from the unscoped open-issue pass the sweep already fetches; H15 attaches its single summary row to the card it names so both renderers handle it as an ordinary row with zero renderer change. Neither predicate writes a label: every finding prescribes the triage sweep's derivation pass. Numbering follows the Hn scheme after H13; the header docblock, the prerequisite report's H1-H15 range and summaryLine's unscoped-pass wording were updated with them. Based on fresh origin/main (90417a808) with PR #9929's H5 extraction change present, and the file was re-measured as it now stands (2186 lines) before editing.",
 "tests": "All gates run at HEAD 2906b65b, the final commit, each quoting the gate's OWN verdict line (exit codes captured with no pipe in between). Gate set derived by `node scripts/pm/dispatch-gates.mjs` with no args off the real diff (1 path, merge base 90417a808), which named 6 families over 4 distinct commands. (1) `pnpm check:pm-half-states` -> `✓ check-half-states self-test: 273 cases pass.` — baseline on origin/main measured at 202, so +71 new cases. (2) `pnpm check:partof-closing-keyword` -> `✓ check-partof-closing-keyword self-test: 28 cases pass.` — also the import-compatibility witness, since it imports h7PartOfWithClosingKeyword from the edited file. (3) `pnpm check:cross-package-test-inputs` -> self-test `All 33 self-test cases passed.` plus real run `OK: 12 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.` (4) `pnpm check:nul-bytes` (dispatch-named for scripts/**) -> self-test `✓ check-nul-bytes --self-test: 75 assertions over a temp git repo (real scan() path)` plus real run `check-nul-bytes: OK (scanned 6312 text file(s) -- 6312 tracked, 0 untracked-not-ignored; skipped 5 binary; no raw ASCII control bytes).` A manual `grep -naP '[control-range]'` over the edited file was also clean. The 6th family, `node scripts/pm/check-half-states.mjs` from half-state-patrol.yml, is the LIVE sweep and could NOT be run here — see open_questions[1]; CI runs it on a runner. NO ablation rebuild leg applies and none is claimed: this script is executed directly from source with no dist/, so there is no stale artifact an ablation could read.",
 "reverse_verification": "Direction predicted in writing BEFORE running, on live-shaped cases for every direction of both predicates, then driven through the SHIPPED exported functions over a real 234-card census of this board (fetched via MCP, since the live sweep is blocked here). All five held, none half-right. R1 #7276 (carries pm:blocking, live index has no entry) predicted STALE finding -> observed STALE finding. R2 #9832 (targeted by #9650's line, no label) predicted MISSING finding naming #9650 -> observed exactly that. R3 #7917's `Blocked-by: objectstack-ai/objectui#4356` predicted to create NO local index entry for #4356 -> observed no entry, and local #4356 reads clean. R4 H15 over the live board predicted null (the board's only pm:blocking card, #7276, is assigned to os-project-manager — the card's own all-assigned negative, measured rather than invented) -> observed no row. R5 the same board with that assignee removed predicted a row at roughly 220h -> observed `open ~220h`. Cross-checked by a separate throwaway implementation written before the predicate, which independently agreed on 1 stale / 5 missing. Board-level result worth the PM's eye: 1 stale, 5 missing, and NOT ONE coherent pairing — the pm:blocking cache had drifted to 0% agreement with the index it is derived from. One self-test case failed honestly on the first run, and the failure was in the FIXTURE not the predicate: `H15: absent created_at` was green against a 3-day-old card because the fixture helper's `created = daysAgo(3)` default fills an undefined. Rebuilt longhand so it tests the absent field; the comment records why.",
 "gates_named_by_dispatch_not_run": ["node scripts/pm/check-half-states.mjs (live sweep) — transport unavailable in this container, see open_questions[1]"],
 "labels_read_back": ["size/m", "skip-changeset"],
 "files_changed": ["scripts/pm/check-half-states.mjs (+456/-3)"],
 "self_test_count": {"before": 202, "after": 273},
 "open_questions": [
 {
 "question": "Dispatch/standing-clause conflict on skip-changeset, flagged rather than silently resolved: the dispatch says 'the PM will set the label', while the standing os-dev clause says that for THIS repo applying it is the dev's step at PR creation (read-modify-write plus read-back). I followed the standing clause — applied it and read it back — because the changeset gate can otherwise red on a first CI round, and left the PR body's reasoning paragraph intact.",
 "options": ["A: leave as applied (label read back as size/m + skip-changeset)", "B: PM prefers to own the write — say so and I will not apply it on future cards"],
 "recommendation": "A, because the label is applied and verified by read-back, the reasoning is in the PR body for review, and removing it now would only re-open the changeset gate. Worth one line in the dispatch template either way so the next card has one answer."
 },
 {
 "question": "Out-of-scope but blocking a gate you asked for: check-half-states' own transport probe reports 'prerequisite met — the token authenticates' in this container, and the sweep then 403s on its first listing page. The agent proxy answers /rate_limit ITSELF with 200 and a 14871 quota while every real endpoint returns 403 'GitHub access is not enabled for this session'; the token is the proxy's 14-char placeholder. This is a FOURTH container class the file's classifier does not cover, and it inverts the #4690 principle inside the very thing built to enforce it. Filed as #9946, unassigned, no label, left for triage — not addressed in PR #9945 (different defect class from this card, so the bounded in-place exemption does not apply).",
 "options": ["A: probe a real endpoint (e.g. GET /repos/{owner}/{repo}) — correct here, costs one core call per run", "B: classify the proxy's distinctive 403 body — narrow, but pattern-matches a vendor string", "C: treat a proxy-prefixed 14-char token as disqualifying — cheapest, but contradicts the file's recorded decision that token shape must never gate the request"],
 "recommendation": "A, with the fourth container class added to the header enumeration and pinned in the self-test alongside the other three, which is how this file has recorded every prior transport surprise. C should not be taken without revisiting the recorded decision it contradicts."
 }
 ],
 "out_of_scope_findings": [
 "filed as #9946: check-half-states' transport probe greens a container where every real endpoint 403s — the agent proxy answers /rate_limit itself with a fabricated 14871 quota, so --probe says MET and the sweep cannot make one request"
 ]
}

---

Generated by Claude Code

[os-warren]

ACCEPT — PR #9945 复核通过,已 flip ready + 挂 auto-merge(显式 SQUASH;echo 回报 MERGE,按事实表 echo 双向不可靠,以队列分支核验为准,检查跑完后验)。

复核记录(session ae0d8bd1-5667-5f58-8ff8-fa22ec154325):

• 亲取 diff:H14 双向 + H15 单行皆 report-only,全 diff 零标签写入,每条 finding 文本都把补救指向分诊 sweep 推导趟 ✓。解析器首现有据(H4 只做存在性测试,查无第二解析器)✓。跨仓引用滤除 / 自引用滤除 / 只取行首引用串,三个判断各有正负测试钉住 ✓。双渲染器按普通行处理 + loudness 不越 P0-SUSPECT ✓。自测 202→273,门禁判定行逐字引用 ✓。反向验证五案全中、且用真实 234 卡普查驱动,另有独立丢弃实现交叉核对 ✓。fixture 缺陷(daysAgo 默认值填掉 undefined)如实记录并重写 ✓。
• Open question ①(skip-changeset 归属):裁 A — 标签已挂已读回,保持;常设条款(dev 在开 PR 时挂+读回)与我派发词的冲突,错在我的派发模板,已改口径:今后派发词写「按常设条款由 dev 挂并读回」。
• Open question ②(transport probe 假绿):方向意见已记到 check-half-states' transport probe greens a container where every real endpoint 403s — the agent proxy answers /rate_limit itself with a 14871 quota #9946,采 A。
• 看板级读数收下:pm:blocking 缓存与索引 0% 一致(1 stale / 5 missing)—— 单产者(分诊 sweep 推导趟)未在产出,已开请求卡给分诊道,验收判据 = 下一班巡逻(13:37Z 后)锚 [Half-state patrol] check-half-states live sweep — generated view (please pin) #9857 上 H14 归零。

---

Generated by Claude Code