Widen the half-state patrol to the states the board actually produces: H24/H25/H26, sibling-repo adoption, and re-derived windows

[claude]

Fixes#11196
Fixes#11217
Fixes#11219
Fixes#11118

One family, one defect shape: the patrol's input set and predicate vocabulary were narrower than the states the board actually produces. Four graded cards, one commit each, all on scripts/pm/check-half-states.mjs and its workflow — the hot-file family dispatched as a fold rather than serialized.

commit	card	what lands
6bc3e47	#11196	H24 (pm:queue + assignee), the pm:awaiting-maintainer state, the paired-write remedy texts
5d86dc6	#11217	the sweeper/workflow pair parameterised for verbatim sibling-repo adoption
1604623	#11219	H26 — a block whose target can never close, plus the transitive-wait flag
02e2838	#11118	H8/H22/H23 window arithmetic re-derived against the measured merge rate

Report-only throughout: no predicate here is a gate, no row writes a label, and a completed sweep still exits 0 with 0 or 40 findings.

#11196 — the two-views contradiction, and the state that had nowhere to live

H24 fires on an open card carrying pm:queue with a non-empty assignee. The queue view reads it as dispatchable, the claim rule reads it as taken; both readers are right about the field they read, so the card is available to everyone and forbidden to everyone at once. Every adjacent row declined the shape — H1 wants no assignee, H2 wants a missing claim comment (the measured carriers had complete ones), H3 wants two labels while here the second half of the contradiction is a field — which is how 17 cards across three repos sat in it unreported. Those three adjacencies are pinned as self-test cases, not asserted.

The predicate is a pure intersection: no threshold, no timestamp, no identity test. Per the ruling of 2026-08-23 the rule lands first and any true-ownership exemption is an explicit marker later — so the row fires on a human assignment too, names the login so residue and ownership are separable by a reader, and states the asymmetric remedy (an agent may clear agent residue; ⛔ never a human's).

Paired writes (fix 2). The landing re-label (H8) and the unlock scan (H19) are the two rollback paths that never named the assignee drop; both remedy sentences now carry 「同笔摘 assignee」. H8's half-delivered branch deliberately does not — there the label and the claim are correct, and prescribing a drop would be the destructive write #10468 closed.

pm:awaiting-maintainer (fix 5) is implemented as a first-class state, spelling finalized as ruled:

• vocabulary entry in scripts/pm/ensure-pm-labels.sh (five-repo loop, 88-char description, consumers named in its comment block);
• H25 pins its mutual exclusions — pm:queue, pm:dispatched, pm:blocked, pm:on-hold, needs-user-decision — each with the specific lie it tells rather than a generic "these disagree";
• membership in H11's parked inventory (with the exit sentence this state actually has: no machine exit, by construction), H13's state vocabulary (or every carrier would become a standing H13 row two hours in) and H22's residue set;
• one label page in the sweep's listing loop, so a card carrying only this state is swept at all.

⛔ Deferred, declared not dropped: the SKILL.md state-model table row for the new label (protocol face, fable-mandatory, separate landing), and applying the label to specimen card #7276 — the seat's write at ACCEPT, never this PR's. The legacy cleanup ruled on the same day was already executed and is untouched here.

#11217 — the pair a sibling repo can adopt verbatim

Two hardcodings made "copy both files" unsafe, and both are gone:

• the swept repo resolves PM_SWEEP_REPO → GITHUB_REPOSITORY → default. A copy of the script in objectui, run with no override, used to sweep objectstack and write those findings into objectui's anchor: a fully green report about the wrong board. A malformed value is refused at the CLI (exit 2) instead of silently falling back — substituting a different board is the disease itself.
• the anchor issue comes from the repository variable HALF_STATE_ANCHOR_ISSUE, with 9857 kept only as a fallback guarded by the repository name. An install with no anchor configured fails loudly after the sweep (so the run summary still carries the findings) rather than rewriting whatever #9857 happens to be in that repo.

Per-repo installs, each with its own GITHUB_TOKEN, per the grading ruling — no matrix, no cross-repo credential. The accepted consequence (cross-repo Blocked-by: targets stay UNJUDGED per install) is stated in both headers; #11218's loudness half is not addressed here and stays open.

Objectstack leg unchanged — measured, not asserted. The old value was the literal 'objectstack-ai/objectstack'; the runner sets GITHUB_REPOSITORY (and now PM_SWEEP_REPO) to that same string, so every request path is byte-identical. Observed offline by stubbing globalThis.fetch and running the real CLI:

GITHUB_REPOSITORY=objectstack-ai/objectstack -> GET https://api.github.com/repos/objectstack-ai/objectstack
GITHUB_REPOSITORY=objectstack-ai/objectui -> GET https://api.github.com/repos/objectstack-ai/objectui
PM_SWEEP_REPO=…/cloud (override wins) -> GET https://api.github.com/repos/objectstack-ai/cloud
PM_SWEEP_REPO=objectui (malformed) -> refused, exit 2, no request made

Plus 20 self-test cases over resolveSweepRepo, including the objectstack runner's exact env shape and the empty-string case an unset Actions variable expands to.

⚠️ One YAML trap worth naming: in a >- folded scalar a more-indented continuation line keeps its newline literally, which would hand the expression parser a multi-line string. Measured on this very value and fixed by aligning the continuations; the comment above it says so.

#11219 — the block nothing can ever release

The unlock predicate is "the Blocked-by: target CLOSED", and pm:on-hold / needs-user-decision are by definition states a card sits in while open. Such a block is structurally indefinite, and the waiting card passes every existing check: line present (H4), target resolves and is open (H19), label correct. H9 — the nearest neighbour — audits the held card, not the waiting one. All six measured instances were found by a human reading; one repo's entire blocked inventory (2 of 2) waits on its single unanswered decision card.

A second leg on the same data flags a target that is itself pm:blocked: the measured chain was real one hop up and false two hops up, and a single-level predicate cannot see that. It names the hop rather than chasing it (a request per hop, and chains can cycle).

Quota-neutral, as the card asked: H19 already resolves every distinct target — from a listing in hand or with one GET — and a resolved target's labels rode in on a payload already paid for. The resolution rows simply stop discarding them. Not reported, deliberately: a target labelled pm:queue while titled [Decision] (one of the six) — a mislabelling, not a fact in the labels, and a title heuristic would make the sweeper guess at intent.

#11118 — window arithmetic re-derived, with the windows pinned as ISO instants

H8's docblock justified two pages with ~18 merges/day. Re-measured 2026-08-23T08:42:15Z against the live endpoints, windows pinned as full ISO instants per the card's approxidate warning:

window	reading	span	verdict
merge rate	300 commits, 2026-08-21T04:00:19Z … 2026-08-23T08:22:47Z	2.18 d	~137.5/day (300/300 carry the squash marker)
H8, 2 pages	200 closed PRs, 197 merged, oldest 2026-08-21T14:00:28Z	1.78 d	~7× tighter than its prose claimed
H8, 4 pages	400 rows, 397 merged, oldest 2026-08-20T09:41:02Z	2.96 d	widened
H22, 2 pages	200 closed issues, updated 2026-08-22T17:05:44Z … 08-23T08:39:14Z	0.65 d (~15.6 h)	~2.6 sweeps — thin
H22, 4 pages	400 rows, updated from 2026-08-21T15:44:49Z	1.70 d	widened
H23, 3 pages	300 commits, 2026-08-21T04:00:19Z … 08-23T08:22:47Z	2.18 d	unchanged, ~8.7 sweeps

H8 is widened rather than restated because its damage model is asymmetric: the residue it reports is the paired write nobody noticed, which correlates with age, so the population most likely to age out is the population the row exists for. H22's surprise is the divisor — ordered by updated, its rows are consumed by issue activity, not closures, and the rate is bursty in exactly the direction that ejects fresh residue while residue is produced fastest. Four pages restores what its own anti-drowning argument was choosing (a couple of days) without reopening the deep tail it refuses (500+ carriers spanning months). H23 kept its cap: it is the one window that derived its number from a measured rate, and the only one that survived a re-measure.

The derivation is now executable — windowCoverageDays, sweepOverlap, MEASURED_MERGES_PER_DAY, PATROL_CADENCE_HOURS — so a cap and the sentence justifying it cannot drift apart again. Cost: four extra requests per sweep, four sweeps a day, against a 15,000/h core quota.

Verification

Self-test: 879 → 997 cases pass, both directions pinned for every new predicate, every vocabulary membership, and each window constant (including the degenerate inputs that must answer "cannot divide" rather than Infinity). One pre-existing pin — H22's "the measured residue set is the five from the census" — failed on the new label and was updated deliberately, with the reason for the one non-census member written into it.

Live sweep not run, and it cannot be here: this container's GITHUB_TOKEN is the proxy's 14-character placeholder and the anonymous quota is spent, so --probe returns the classified PREREQUISITE NOT MET (exit 3) the file's own header documents. Self-test plus the offline fetch trace above is the verification surface; the workflow's pull_request trigger runs the real sweep on this PR against a runner where the transport prerequisite is met.

Gates derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack on the actual change set at 02e28386 (three-dot, merge-base 050d8d868) — 20 families named, each run with its exit code captured before any pipe:

cross-package-test-inputs EXIT=0 | OK: 14 package(s) read outside themselves, all declared…
entry-guard EXIT=0 | ✓ check:entry-guard: 138 scripts/ file(s) — every entry guard goes through invoked-as.mjs
node-version EXIT=0 | Node 22 is in maintenance; supported until 2027-04-30
parse-guard EXIT=0
pm-half-states EXIT=0 | ✓ check-half-states self-test: 997 cases pass.
pm-label-desc-cap EXIT=0 | ✓ 21 label descriptions … all ≤100 characters
pnpm-filter-targets EXIT=0 | ✓ 120/148 `--filter` occurrence(s) … resolve
required-contexts EXIT=0
shard-attestation EXIT=0 | ✓ 2 aggregate gate(s) count 3 declared leg(s)
workflow-status-functions EXIT=0 | OK (26 workflow file(s), 49 job(s) …)
aggregator-roster EXIT=0
ci-filter-parity EXIT=0 | OK: all 88 declared cross-package glob(s) … covered
closing-keyword-parity EXIT=0 | OK (3 parsers agree on all 9 keywords …)
step-collectors EXIT=0 | ✓ 358 `run:` steps across 26 workflow(s)
nul-bytes EXIT=0 | OK (scanned 6335 text file(s) … no raw ASCII control bytes)
partof-closing-keyword EXIT=0 | run with this PR body (see below)

pnpm lint (repo-wide eslint . --no-inline-config, not a narrowed subset): exit 0 in 78 s, no output. check:partof-closing-keyword needs a PR body to judge and was run against this one.

skip-changeset: nothing here is published — scripts/pm/** tooling and one workflow. No user-visible surface changes, so no changeset is owed.

---

Generated by Claude Code