feat(pm): H4/H14/blocking-index read comment-level Blocked-by lines

[os-warren]

Fixes#10061

The unlock scan and this patrol read issue bodies only, while seats deliberately park the Blocked-by: line in a comment — a body rewrite goes through the MCP escaping hazard (#8813) and is the riskier write. 26 of 40 blocked cards were body-clean at the 2026-08-19 census. Two measured consequences, both addressed here:

• H4 reported a duty as unmet that had in fact been met in the other channel.
• H14 reported Migrate the release toolchain to @changesets/cli v3 — one atomic PR carrying the bump, the pre-mode restructure, and the gates that model v2's semantics #9465 and impersonate_user and set_user_role still 403 every platform admin — neither route is safely raw-mountable, and each blocks for a different reason #9968 as stale caches while their dependents (release.yml restores the console dist from the same cache key but has no check:console-injection step — and its combined cache action saves even on failure #9709/[finding] cut-rc.yml's hotcrm smoke warning still tells the reader changeset pre exit re-arms that gate — release.yml records the keying was changed away from pre-exit #9828, finding: seven better-auth /admin/ routes refuse platform admins and have no ObjectStack consumer — decide whether they are capability or just vendor surface #9969/Every better-auth-native /admin/ route refuses ObjectStack platform admins — the vendor gates on the legacy user.role === 'admin' scalar ADR-0068 D2 stopped synthesizing #9652) stated the wait in comments — the gauge misplacement the request: run the pm:blocking derivation pass — cache measured at 0% coherence with the Blocked-by index (1 stale / 5 missing, 2026-08-19 census) #9948 ruling named on 2026-08-19 (「修量具而非追假 stale」).

What changed — scripts/pm/check-half-states.mjs

• H4 judges both channels. Either discharges the duty; the finding sentence names both so a reader knows which one to correct. It now returns null-or-sentence (the file's idiom for anything sentence-bearing) because it has more than one thing to say.
• buildBlockingIndex takes options.comments and unions comment-borne refs with body ones. Not a priority order: both are real edges, and a card naming one target in each channel is waiting on both. Cross-repo and self-reference filtering is applied identically whichever channel a ref arrived in.
• H14's two directions treat an incomplete index asymmetrically, on purpose. Stale is a claim about absent evidence, so it is suspended when any gated fetch failed (check:react-declaration-parity 是唯一没接进任何 workflow 的源码审计门禁,且无 MANIFEST 时静默 skip 退出 0 —— 它现在永远不可能红 #4690 — unreadable evidence is not absent evidence; the remedy it prescribes, dropping a label the selection order ranks second only to priority:p0, is destructive). Missing is a claim about evidence in hand — reading more sources can only add edges, never remove one — so it stays live regardless.
• Fetches are gated to body-clean pm:blocked / pm:blocking cards (needsBlockedByComments, exported for the same reason h17NeedsComments is) and share the existing commentCache, so a card costs one request across H2, H17 and this. Total failure rethrows as transport, reusing h16DetailPassUnreadable; a partial shortfall is a bounded gap the summary line states as a third read X of Y pair.
• H4's unreadable case fires where H14-stale goes quiet — a transport failure must not shrink the patrol below its pre-fallback reach, and H4's remedy ("add a line") is idempotent where H14-stale's is not.

Stated boundary — the read-closure cut-off is NOT implemented

The seat-post protocol's rule is 「只读晚于正文最后编辑时间的评论」 on the ground that 「两个时刻都是平台盖章的硬读数」. One of those two stamps does not exist in REST. A comment's created_at is on every row, but an issue's body-edit time is on no REST payload: the issues API carries created_at/updated_at only, body edit history lives behind GraphQL userContentEdits, and this file is REST-only by a standing operational note. The issue timeline endpoint does not record body edits either.

So the cut-off is omitted rather than implemented against a proxy. The one proxy in reach, updated_at, is worse than nothing: it bumps when a comment is posted, so "newer than the body's last edit" would be false for every comment ever written and the fallback would read nothing while looking like it read — an unfalsifiable check, the shape this file exists to catch.

Reading the whole first page instead errs in one direction and it is the safe one: extra evidence can only add edges, so it can clear an H4 row or an H14 stale row, and cannot invent a card's silence. Full direction analysis and the residual-cost argument sit at the predicates. This is a declared narrowing of the card's wording — flagged for the PM in the report's open_questions, with options.

Verification

Self-test 414 to 469 (pnpm check:pm-half-states), all green. Gate union re-derived from the real diff on the final commit 7ab290652 with node scripts/pm/dispatch-gates.mjs (no args) — 6 families, all run:

gate	verdict line
pnpm check:pm-half-states	check-half-states self-test: 469 cases pass.
pnpm check:partof-closing-keyword	check-partof-closing-keyword self-test: 28 cases pass.
pnpm check:cross-package-test-inputs	OK: 12 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
pnpm check:nul-bytes	check-nul-bytes: OK (scanned 6367 text file(s) ... no raw ASCII control bytes).
node scripts/pm/check-half-states.mjs (live sweep)	exit 3 — PREREQUISITE NOT MET, the classified transport verdict; this container has no GitHub credential, expected

The two node scripts/... rows in the derived list invoke the same scripts as their pnpm twins.

Reverse verification — directions predicted in writing, then observed

No build step is involved: node executes this script's source directly, nothing resolves through a package dist/. Each leg was ablated from the committed state and restored with git checkout (the restore leg re-verified: 469 pass, zero ABLATION markers left in the tree).

ablation	predicted	observed
index union reverted to body-only	red on the union-dependent rows; the two "reads STALE against a body-only index" pins stay green (they encode the pre-change behaviour deliberately)	held — exit 1. Probed directly: edges at #9465 = null, and #9465 reports pm:blocking carried while NO open card's Blocked-by line ... targets it — the measured false stale reproduced. Restored: edges = [9709,9828], row = clean
H4 ignores commentBodies	red on the H4 comment-channel rows only, body-channel rows unaffected — 8 named rows	held exactly — 8 of 469 case(s) failed, the 8 named ones
stale suspension removed	exactly one row	held — 1 of 469 case(s) failed, H14-A: stale is SUSPENDED when the index is known incomplete

The #9465/#9968 false-stale shapes are regression pins in the self-test, built from the real comment bodies on #9709/#9828/#9969/#9652, and each is pinned in both directions (stale against a body-only index, clean against the union).

Boundaries honoured: no seat-resume body rewrites, Restart-when:/Unlock-action: reading untouched, no cloud-repo backfill, no new labels, report-only discipline unchanged.

skip-changeset: this PR ships no user-visible change (a PM patrol script), so no changeset.

---

Generated by Claude Code