fix(pm): window the governed-merge sweep on landing order, not committer dates (#12633)

[os-litant]

Fixes#12633

The merge queue writes a batch entry's commit when the batch is built, and main receives it when the batch lands. Those are not the same moment, so a governed landing can sit above another commit on main's first-parent chain — it landed later — while carrying an earlier committer date. git log --since=DATE cuts on committer date, so at a knife-edge boundary that landing is simply absent, with nothing in the output marking the gap; where it is the only governed landing in the window, the sweep prints ✅ clean window and exits 0 = "swept COMPLETELY", the one reading #4690 and #9902 say must never be producible.

Implements the route ruled on the card — B for --since-ref, A for --since. C (detect and refuse) and D (document) stay declined. The audit's report-only posture is unchanged, no judgment is weakened, and every pre-existing --self-test assertion is kept verbatim.

What changed — one file, scripts/pm/check-governed-merges.mjs

1. --since-ref is topological. The window is the first-parent range from the ref to origin/main; committer dates are not consulted at all, so no skew of any size can move the boundary. Multi-repo: a bare --since-ref is tried in every governed repo and used wherever it resolves, and --since-ref repoId=REF pins one repo (repeatable). A repo no ref resolves in falls back to the date window and its report line says so — one repo's ref silently dating four repos' windows is the same class of bug as the one being fixed. Recording the previous round's tip is the caller's obligation (this script keeps no state), so the PM assumption on the card is discharged by printing the line to use next round on every sweep: next round, exactly: --since-ref objectstack=SHA --since-ref objectui=SHA …. Bonus: for a topological window the Three seat-run tools ask windowed history questions with no shallow guard, so each answers plausibly and wrongly in an agent container #9902 horizon question answers itself — the ref being present in a checkout is necessary and sufficient for the range to be complete.
2. A bare --since is backed off by a declared budget, SKEW_BUDGET_SECONDS = 3600, and the report line states both boundaries and the back-off out loud, so a re-listed boundary entry reads as re-recognition rather than noise.
3. The date window is closed topologically, and refuses to read clean when it cannot prove it. The emitted set is every first-parent commit at or above the deepest commit dated inside the budgeted window — a chain prefix, so nothing is ever dropped for being dated below something that landed before it, whatever the budget is. The proof obligation is the other half: the walk must actually see a commit dated below the boundary, or that deepest commit cannot be shown to be the deepest one. When it cannot, the repo is WINDOW EDGE, the green tick is suppressed and the sweep exits 2.

Part 3 is an addition to the ruled route A, not a substitute for it, and it is why the card's invariant now holds mechanically rather than up to a constant: a governed entry at a skew boundary is either listed, or the sweep is INCOMPLETE — never clean-and-absent.

Why 3600 s, and why not 874 s

reading	measurement	source
largest build-to-land skew	1,939 s (PR #12443: committed 2026-08-26T05:00:49Z, merged 05:33:08Z)	card, two governed PRs of one batch
second of the same batch	1,495 s (PR #12440)	card
largest committer-date inversion on this mainline	874 s, 10 inversions in 3,613 first-parent pairs, median 539 s	re-measured on this tree 2026-08-27, git log --first-parent origin/main

The re-measurement reproduces the card exactly (10 / max 874 s / median 539 s; one extra pair because main advanced), and two of the ten inverted commits touch a governed surface. 3600 s is 1.86× the largest directly measured skew and 4.1× the largest inversion. It is deliberately not set to the measured maximum: a bound written exactly at today's worst case invalidates itself the first time a slower batch lands — the same trap as an upper bound pinned at the version that fixes it. The cost is re-listing whatever landed in the hour before the boundary; on the documented default (--since 24h) that widens the window by 4.2%, and consecutive default rounds already overlap by nearly a full day.

Before / after

Real history, the card's own probe (enumeration only — the sweep minus its attribution round-trips, which are one GET per entry and have nothing to do with the window):

BEFORE (origin/main)
--since 2026-08-14T05:55:02Z scanned=1720 governed_entries=190 01a7337fc0 listed? false
--since 2026-08-14T05:44:52Z scanned=1722 governed_entries=191 01a7337fc0 listed? true
AFTER (this branch)
--since 2026-08-14T05:55:02Z scanned=1726 governed_entries=193 01a7337fc0 listed? true
-> 01a7337fc0 PR #8620 surfaces: docs/adr/0029-kernel-object-ownership-and-platform-objects-decomposition.md
--since 2026-08-14T05:44:52Z scanned=1726 governed_entries=193 01a7337fc0 listed? true

The two boundaries that used to disagree by one governed ADR now return the identical list. The 190 → 193 growth is the hour of back-off plus the topological close, i.e. the re-listings named in the report line.

End to end, real exit codes, on a constructed QS-7 repo (a queue chain whose governed entry landed above the round tip while dated 874 s — the measured maximum — before it; subjects carry no PR number on purpose, so the run costs zero API lookups and the exit code under test is the window's). The BEFORE column is the pristine origin/main copy of the script run against the same repo:

BEFORE --since 2026-08-14T05:55:02Z exit 0
governed-merges sweep: 0 governed merge(s) …
✓ audited objectstack-ai/objectstack — … 0 mainline commit(s) in window; history complete clone
✅ clean window — no governed surface was merged in any governed repo.
AFTER --since 2026-08-14T05:55:02Z exit 0
governed-merges sweep: 1 governed merge(s) …
window: DATE boundary 2026-08-14T05:55:02.000Z, backed off by the 3600 s build-to-land
skew budget to 2026-08-14T04:55:02.000Z, then closed topologically down to the deepest commit
inside it (#12633). An entry you recognised last round may be RE-LISTED at the boundary —
that is RE-RECOGNITION, not noise; a dropped entry is never seen again.
• objectstack-ai/objectstack … docs(adr): kernel object ownership
surfaces: docs/adr/** ×1
- docs/adr/0029-kernel-object-ownership.md
AFTER --since-ref ROUND_TIP (route B) exit 0
window: TOPOLOGICAL — the first-parent range from the ref to origin/main, per repo (…).
Committer dates are not consulted, so no build-to-land skew of any size can move this boundary.
✓ audited … 1 mainline commit(s) in window; window topological from d865aeeef
• objectstack-ai/objectstack … docs(adr): kernel object ownership

The multi-repo half of route B, a ref that resolves in objectstack but not in the swept sibling — it falls back, names why, and still lists the governed entry:

 ✓ audited objectstack-ai/objectui — … window date (fell back — '98eec7e24…' does not resolve
in this checkout); history complete clone

Verification

Union re-run after the final commit, on fdff4bad1, one && chain under scripts/pm/os-verify-lock.sh so the verdict certifies all of it:

os-verify-lock: VERDICT command-exit 0 · held the lock 146s (2m26s) · waited 0s

covering check:pm-governed-merges, check:pm-governed-prose, check:pm-dispatch-gates, bare-root-worklist --self-test, check-governed-queue-guard --self-test, ci-failure --self-test, check:nul-bytes, check:agent-test-spelling, check:bash32-floor, check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check-ci-filter-parity, check-skills-token-ratchet, and whole-repo pnpm lint (no narrowing — eslint . --no-inline-config, 65 s). The gate family was derived from the diff by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, plus the two convention-triggered obligations it names for a gate-script edit, plus the three sibling scripts that import this module (check-governed-queue-guard, ci-failure, check-skills-token-ratchet) — an import is not a path literal, so the derivation cannot name them.

✓ check-governed-merges --self-test: 193 assertions

Baseline on this tree was 159, not the 157 the card recorded — main moved between the measurement and the dispatch; no pre-existing assertion was removed or weakened, and 34 were added. The new ones pin the QS-7 shape in both directions (the old bare cut drops the entry as a control; the budgeted window lists it), the topological close carrying an entry skewed past the budget, the unproven-boundary EDGE, the listed-or-INCOMPLETE invariant as a property over every fixture, the escalating floors (one walk in the ordinary case), per-repo --since-ref resolution with its named fallback, and the window words an operator actually reads.

Notes

• Not a governed surface.node scripts/pm/check-governed-merges.mjs --test scripts/pm/check-governed-merges.mjs → NOT governed, exit 0, derived from the register rather than recalled.
• WINDOW EDGE is a backstop and the header says so. On a complete clone the widened walk always reaches the root commit, so it cannot fire; on a shallow one the Three seat-run tools ask windowed history questions with no shallow guard, so each answers plausibly and wrongly in an agent container #9902 horizon guard classifies the repo UNAUDITED before enumeration begins. It is the mechanical statement of an invariant that otherwise rests entirely on a predicate living in another file, and it is exercised in --self-test rather than by a real sweep.
• Rider from the check-governed-merges: measure whether a governed-surface PR landing via a merge-queue batch is visible to the audit (#11831 ruling) #11996 close carried as the one-line header note it was ruled to be: queue-batch topology measured non-blind 2026-08-27 (six topologies plus a live batch replay), re-measure if the repo's merge method changes or the mainline-commits / commit-paths enumeration is reworked.
• No changeset, skip-changeset applied: this is a CI-internal script that publishes nothing — the textbook case .github/workflows/lint.yml names in its own prose.

---

Generated by Claude Code

[os-litant]

Fixes#12633

The merge queue writes a batch entry's commit when the batch is built, and main receives it when the batch lands. Those are not the same moment, so a governed landing can sit above another commit on main's first-parent chain — it landed later — while carrying an earlier committer date. git log --since=DATE cuts on committer date, so at a knife-edge boundary that landing is simply absent, with nothing in the output marking the gap; where it is the only governed landing in the window, the sweep prints ✅ clean window and exits 0 = "swept COMPLETELY", the one reading #4690 and #9902 say must never be producible.

Implements the route ruled on the card — B for --since-ref, A for --since. C (detect and refuse) and D (document) stay declined. The audit's report-only posture is unchanged, no judgment is weakened, and every pre-existing --self-test assertion is kept verbatim.

What changed — one file, scripts/pm/check-governed-merges.mjs

1. --since-ref is topological. The window is the first-parent range from the ref to origin/main; committer dates are not consulted at all, so no skew of any size can move the boundary. Multi-repo: a bare --since-ref is tried in every governed repo and used wherever it resolves, and --since-ref repoId=REF pins one repo (repeatable). A repo no ref resolves in falls back to the date window and its report line says so — one repo's ref silently dating four repos' windows is the same class of bug as the one being fixed. Recording the previous round's tip is the caller's obligation (this script keeps no state), so the PM assumption on the card is discharged by printing the line to use next round on every sweep: next round, exactly: --since-ref objectstack=SHA --since-ref objectui=SHA …. Bonus: for a topological window the Three seat-run tools ask windowed history questions with no shallow guard, so each answers plausibly and wrongly in an agent container #9902 horizon question answers itself — the ref being present in a checkout is necessary and sufficient for the range to be complete.
2. A bare --since is backed off by a declared budget, SKEW_BUDGET_SECONDS = 3600, and the report line states both boundaries and the back-off out loud, so a re-listed boundary entry reads as re-recognition rather than noise.
3. The date window is closed topologically, and refuses to read clean when it cannot prove it. The emitted set is every first-parent commit at or above the deepest commit dated inside the budgeted window — a chain prefix, so nothing is ever dropped for being dated below something that landed before it, whatever the budget is. The proof obligation is the other half: the walk must actually see a commit dated below the boundary, or that deepest commit cannot be shown to be the deepest one. When it cannot, the repo is WINDOW EDGE, the green tick is suppressed and the sweep exits 2.

Part 3 is an addition to the ruled route A, not a substitute for it, and it is why the card's invariant now holds mechanically rather than up to a constant: a governed entry at a skew boundary is either listed, or the sweep is INCOMPLETE — never clean-and-absent.

Why 3600 s, and why not 874 s

reading	measurement	source
largest build-to-land skew	1,939 s (PR #12443: committed 2026-08-26T05:00:49Z, merged 05:33:08Z)	card, two governed PRs of one batch
second of the same batch	1,495 s (PR #12440)	card
largest committer-date inversion on this mainline	874 s, 10 inversions in 3,613 first-parent pairs, median 539 s	re-measured on this tree 2026-08-27, git log --first-parent origin/main

The re-measurement reproduces the card exactly (10 / max 874 s / median 539 s; one extra pair because main advanced), and two of the ten inverted commits touch a governed surface. 3600 s is 1.86× the largest directly measured skew and 4.1× the largest inversion. It is deliberately not set to the measured maximum: a bound written exactly at today's worst case invalidates itself the first time a slower batch lands — the same trap as an upper bound pinned at the version that fixes it. The cost is re-listing whatever landed in the hour before the boundary; on the documented default (--since 24h) that widens the window by 4.2%, and consecutive default rounds already overlap by nearly a full day.

Before / after

Real history, the card's own probe (enumeration only — the sweep minus its attribution round-trips, which are one GET per entry and have nothing to do with the window):

BEFORE (origin/main)
--since 2026-08-14T05:55:02Z scanned=1720 governed_entries=190 01a7337fc0 listed? false
--since 2026-08-14T05:44:52Z scanned=1722 governed_entries=191 01a7337fc0 listed? true
AFTER (this branch)
--since 2026-08-14T05:55:02Z scanned=1726 governed_entries=193 01a7337fc0 listed? true
-> 01a7337fc0 PR #8620 surfaces: docs/adr/0029-kernel-object-ownership-and-platform-objects-decomposition.md
--since 2026-08-14T05:44:52Z scanned=1726 governed_entries=193 01a7337fc0 listed? true

The two boundaries that used to disagree by one governed ADR now return the identical list. The 190 → 193 growth is the hour of back-off plus the topological close, i.e. the re-listings named in the report line.

End to end, real exit codes, on a constructed QS-7 repo (a queue chain whose governed entry landed above the round tip while dated 874 s — the measured maximum — before it; subjects carry no PR number on purpose, so the run costs zero API lookups and the exit code under test is the window's). The BEFORE column is the pristine origin/main copy of the script run against the same repo:

BEFORE --since 2026-08-14T05:55:02Z exit 0
governed-merges sweep: 0 governed merge(s) …
✓ audited objectstack-ai/objectstack — … 0 mainline commit(s) in window; history complete clone
✅ clean window — no governed surface was merged in any governed repo.
AFTER --since 2026-08-14T05:55:02Z exit 0
governed-merges sweep: 1 governed merge(s) …
window: DATE boundary 2026-08-14T05:55:02.000Z, backed off by the 3600 s build-to-land
skew budget to 2026-08-14T04:55:02.000Z, then closed topologically down to the deepest commit
inside it (#12633). An entry you recognised last round may be RE-LISTED at the boundary —
that is RE-RECOGNITION, not noise; a dropped entry is never seen again.
• objectstack-ai/objectstack … docs(adr): kernel object ownership
surfaces: docs/adr/** ×1
- docs/adr/0029-kernel-object-ownership.md
AFTER --since-ref ROUND_TIP (route B) exit 0
window: TOPOLOGICAL — the first-parent range from the ref to origin/main, per repo (…).
Committer dates are not consulted, so no build-to-land skew of any size can move this boundary.
✓ audited … 1 mainline commit(s) in window; window topological from d865aeeef
• objectstack-ai/objectstack … docs(adr): kernel object ownership

The multi-repo half of route B, a ref that resolves in objectstack but not in the swept sibling — it falls back, names why, and still lists the governed entry:

 ✓ audited objectstack-ai/objectui — … window date (fell back — '98eec7e24…' does not resolve
in this checkout); history complete clone

Verification

Union re-run after the final commit, on fdff4bad1, one && chain under scripts/pm/os-verify-lock.sh so the verdict certifies all of it:

os-verify-lock: VERDICT command-exit 0 · held the lock 146s (2m26s) · waited 0s

covering check:pm-governed-merges, check:pm-governed-prose, check:pm-dispatch-gates, bare-root-worklist --self-test, check-governed-queue-guard --self-test, ci-failure --self-test, check:nul-bytes, check:agent-test-spelling, check:bash32-floor, check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check-ci-filter-parity, check-skills-token-ratchet, and whole-repo pnpm lint (no narrowing — eslint . --no-inline-config, 65 s). The gate family was derived from the diff by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, plus the two convention-triggered obligations it names for a gate-script edit, plus the three sibling scripts that import this module (check-governed-queue-guard, ci-failure, check-skills-token-ratchet) — an import is not a path literal, so the derivation cannot name them.

✓ check-governed-merges --self-test: 193 assertions

Baseline on this tree was 159, not the 157 the card recorded — main moved between the measurement and the dispatch; no pre-existing assertion was removed or weakened, and 34 were added. The new ones pin the QS-7 shape in both directions (the old bare cut drops the entry as a control; the budgeted window lists it), the topological close carrying an entry skewed past the budget, the unproven-boundary EDGE, the listed-or-INCOMPLETE invariant as a property over every fixture, the escalating floors (one walk in the ordinary case), per-repo --since-ref resolution with its named fallback, and the window words an operator actually reads.

Notes

• Not a governed surface.node scripts/pm/check-governed-merges.mjs --test scripts/pm/check-governed-merges.mjs → NOT governed, exit 0, derived from the register rather than recalled.
• WINDOW EDGE is a backstop and the header says so. On a complete clone the widened walk always reaches the root commit, so it cannot fire; on a shallow one the Three seat-run tools ask windowed history questions with no shallow guard, so each answers plausibly and wrongly in an agent container #9902 horizon guard classifies the repo UNAUDITED before enumeration begins. It is the mechanical statement of an invariant that otherwise rests entirely on a predicate living in another file, and it is exercised in --self-test rather than by a real sweep.
• Rider from the check-governed-merges: measure whether a governed-surface PR landing via a merge-queue batch is visible to the audit (#11831 ruling) #11996 close carried as the one-line header note it was ruled to be: queue-batch topology measured non-blind 2026-08-27 (six topologies plus a live batch replay), re-measure if the repo's merge method changes or the mainline-commits / commit-paths enumeration is reworked.
• No changeset, skip-changeset applied: this is a CI-internal script that publishes nothing — the textbook case .github/workflows/lint.yml names in its own prose.

---

Generated by Claude Code

[os-litant]

Fixes#12633

The merge queue writes a batch entry's commit when the batch is built, and main receives it when the batch lands. Those are not the same moment, so a governed landing can sit above another commit on main's first-parent chain — it landed later — while carrying an earlier committer date. git log --since=DATE cuts on committer date, so at a knife-edge boundary that landing is simply absent, with nothing in the output marking the gap; where it is the only governed landing in the window, the sweep prints ✅ clean window and exits 0 = "swept COMPLETELY", the one reading #4690 and #9902 say must never be producible.

Implements the route ruled on the card — B for --since-ref, A for --since. C (detect and refuse) and D (document) stay declined. The audit's report-only posture is unchanged, no judgment is weakened, and every pre-existing --self-test assertion is kept verbatim.

What changed — one file, scripts/pm/check-governed-merges.mjs

1. --since-ref is topological. The window is the first-parent range from the ref to origin/main; committer dates are not consulted at all, so no skew of any size can move the boundary. Multi-repo: a bare --since-ref is tried in every governed repo and used wherever it resolves, and --since-ref repoId=REF pins one repo (repeatable). A repo no ref resolves in falls back to the date window and its report line says so — one repo's ref silently dating four repos' windows is the same class of bug as the one being fixed. Recording the previous round's tip is the caller's obligation (this script keeps no state), so the PM assumption on the card is discharged by printing the line to use next round on every sweep: next round, exactly: --since-ref objectstack=SHA --since-ref objectui=SHA …. Bonus: for a topological window the Three seat-run tools ask windowed history questions with no shallow guard, so each answers plausibly and wrongly in an agent container #9902 horizon question answers itself — the ref being present in a checkout is necessary and sufficient for the range to be complete.
2. A bare --since is backed off by a declared budget, SKEW_BUDGET_SECONDS = 3600, and the report line states both boundaries and the back-off out loud, so a re-listed boundary entry reads as re-recognition rather than noise.
3. The date window is closed topologically, and refuses to read clean when it cannot prove it. The emitted set is every first-parent commit at or above the deepest commit dated inside the budgeted window — a chain prefix, so nothing is ever dropped for being dated below something that landed before it, whatever the budget is. The proof obligation is the other half: the walk must actually see a commit dated below the boundary, or that deepest commit cannot be shown to be the deepest one. When it cannot, the repo is WINDOW EDGE, the green tick is suppressed and the sweep exits 2.

Part 3 is an addition to the ruled route A, not a substitute for it, and it is why the card's invariant now holds mechanically rather than up to a constant: a governed entry at a skew boundary is either listed, or the sweep is INCOMPLETE — never clean-and-absent.

Why 3600 s, and why not 874 s

reading	measurement	source
largest build-to-land skew	1,939 s (PR #12443: committed 2026-08-26T05:00:49Z, merged 05:33:08Z)	card, two governed PRs of one batch
second of the same batch	1,495 s (PR #12440)	card
largest committer-date inversion on this mainline	874 s, 10 inversions in 3,613 first-parent pairs, median 539 s	re-measured on this tree 2026-08-27, git log --first-parent origin/main

The re-measurement reproduces the card exactly (10 / max 874 s / median 539 s; one extra pair because main advanced), and two of the ten inverted commits touch a governed surface. 3600 s is 1.86× the largest directly measured skew and 4.1× the largest inversion. It is deliberately not set to the measured maximum: a bound written exactly at today's worst case invalidates itself the first time a slower batch lands — the same trap as an upper bound pinned at the version that fixes it. The cost is re-listing whatever landed in the hour before the boundary; on the documented default (--since 24h) that widens the window by 4.2%, and consecutive default rounds already overlap by nearly a full day.

Before / after

Real history, the card's own probe (enumeration only — the sweep minus its attribution round-trips, which are one GET per entry and have nothing to do with the window):

BEFORE (origin/main)
--since 2026-08-14T05:55:02Z scanned=1720 governed_entries=190 01a7337fc0 listed? false
--since 2026-08-14T05:44:52Z scanned=1722 governed_entries=191 01a7337fc0 listed? true
AFTER (this branch)
--since 2026-08-14T05:55:02Z scanned=1726 governed_entries=193 01a7337fc0 listed? true
-> 01a7337fc0 PR #8620 surfaces: docs/adr/0029-kernel-object-ownership-and-platform-objects-decomposition.md
--since 2026-08-14T05:44:52Z scanned=1726 governed_entries=193 01a7337fc0 listed? true

The two boundaries that used to disagree by one governed ADR now return the identical list. The 190 → 193 growth is the hour of back-off plus the topological close, i.e. the re-listings named in the report line.

End to end, real exit codes, on a constructed QS-7 repo (a queue chain whose governed entry landed above the round tip while dated 874 s — the measured maximum — before it; subjects carry no PR number on purpose, so the run costs zero API lookups and the exit code under test is the window's). The BEFORE column is the pristine origin/main copy of the script run against the same repo:

BEFORE --since 2026-08-14T05:55:02Z exit 0
governed-merges sweep: 0 governed merge(s) …
✓ audited objectstack-ai/objectstack — … 0 mainline commit(s) in window; history complete clone
✅ clean window — no governed surface was merged in any governed repo.
AFTER --since 2026-08-14T05:55:02Z exit 0
governed-merges sweep: 1 governed merge(s) …
window: DATE boundary 2026-08-14T05:55:02.000Z, backed off by the 3600 s build-to-land
skew budget to 2026-08-14T04:55:02.000Z, then closed topologically down to the deepest commit
inside it (#12633). An entry you recognised last round may be RE-LISTED at the boundary —
that is RE-RECOGNITION, not noise; a dropped entry is never seen again.
• objectstack-ai/objectstack … docs(adr): kernel object ownership
surfaces: docs/adr/** ×1
- docs/adr/0029-kernel-object-ownership.md
AFTER --since-ref ROUND_TIP (route B) exit 0
window: TOPOLOGICAL — the first-parent range from the ref to origin/main, per repo (…).
Committer dates are not consulted, so no build-to-land skew of any size can move this boundary.
✓ audited … 1 mainline commit(s) in window; window topological from d865aeeef
• objectstack-ai/objectstack … docs(adr): kernel object ownership

The multi-repo half of route B, a ref that resolves in objectstack but not in the swept sibling — it falls back, names why, and still lists the governed entry:

 ✓ audited objectstack-ai/objectui — … window date (fell back — '98eec7e24…' does not resolve
in this checkout); history complete clone

Verification

Union re-run after the final commit, on fdff4bad1, one && chain under scripts/pm/os-verify-lock.sh so the verdict certifies all of it:

os-verify-lock: VERDICT command-exit 0 · held the lock 146s (2m26s) · waited 0s

covering check:pm-governed-merges, check:pm-governed-prose, check:pm-dispatch-gates, bare-root-worklist --self-test, check-governed-queue-guard --self-test, ci-failure --self-test, check:nul-bytes, check:agent-test-spelling, check:bash32-floor, check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check-ci-filter-parity, check-skills-token-ratchet, and whole-repo pnpm lint (no narrowing — eslint . --no-inline-config, 65 s). The gate family was derived from the diff by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, plus the two convention-triggered obligations it names for a gate-script edit, plus the three sibling scripts that import this module (check-governed-queue-guard, ci-failure, check-skills-token-ratchet) — an import is not a path literal, so the derivation cannot name them.

✓ check-governed-merges --self-test: 193 assertions

Baseline on this tree was 159, not the 157 the card recorded — main moved between the measurement and the dispatch; no pre-existing assertion was removed or weakened, and 34 were added. The new ones pin the QS-7 shape in both directions (the old bare cut drops the entry as a control; the budgeted window lists it), the topological close carrying an entry skewed past the budget, the unproven-boundary EDGE, the listed-or-INCOMPLETE invariant as a property over every fixture, the escalating floors (one walk in the ordinary case), per-repo --since-ref resolution with its named fallback, and the window words an operator actually reads.

Notes

• Not a governed surface.node scripts/pm/check-governed-merges.mjs --test scripts/pm/check-governed-merges.mjs → NOT governed, exit 0, derived from the register rather than recalled.
• WINDOW EDGE is a backstop and the header says so. On a complete clone the widened walk always reaches the root commit, so it cannot fire; on a shallow one the Three seat-run tools ask windowed history questions with no shallow guard, so each answers plausibly and wrongly in an agent container #9902 horizon guard classifies the repo UNAUDITED before enumeration begins. It is the mechanical statement of an invariant that otherwise rests entirely on a predicate living in another file, and it is exercised in --self-test rather than by a real sweep.
• Rider from the check-governed-merges: measure whether a governed-surface PR landing via a merge-queue batch is visible to the audit (#11831 ruling) #11996 close carried as the one-line header note it was ruled to be: queue-batch topology measured non-blind 2026-08-27 (six topologies plus a live batch replay), re-measure if the repo's merge method changes or the mainline-commits / commit-paths enumeration is reworked.
• No changeset, skip-changeset applied: this is a CI-internal script that publishes nothing — the textbook case .github/workflows/lint.yml names in its own prose.

---

Generated by Claude Code

[os-litant]

Fixes#12633

The merge queue writes a batch entry's commit when the batch is built, and main receives it when the batch lands. Those are not the same moment, so a governed landing can sit above another commit on main's first-parent chain — it landed later — while carrying an earlier committer date. git log --since=DATE cuts on committer date, so at a knife-edge boundary that landing is simply absent, with nothing in the output marking the gap; where it is the only governed landing in the window, the sweep prints ✅ clean window and exits 0 = "swept COMPLETELY", the one reading #4690 and #9902 say must never be producible.

Implements the route ruled on the card — B for --since-ref, A for --since. C (detect and refuse) and D (document) stay declined. The audit's report-only posture is unchanged, no judgment is weakened, and every pre-existing --self-test assertion is kept verbatim.

What changed — one file, scripts/pm/check-governed-merges.mjs

1. --since-ref is topological. The window is the first-parent range from the ref to origin/main; committer dates are not consulted at all, so no skew of any size can move the boundary. Multi-repo: a bare --since-ref is tried in every governed repo and used wherever it resolves, and --since-ref repoId=REF pins one repo (repeatable). A repo no ref resolves in falls back to the date window and its report line says so — one repo's ref silently dating four repos' windows is the same class of bug as the one being fixed. Recording the previous round's tip is the caller's obligation (this script keeps no state), so the PM assumption on the card is discharged by printing the line to use next round on every sweep: next round, exactly: --since-ref objectstack=SHA --since-ref objectui=SHA …. Bonus: for a topological window the Three seat-run tools ask windowed history questions with no shallow guard, so each answers plausibly and wrongly in an agent container #9902 horizon question answers itself — the ref being present in a checkout is necessary and sufficient for the range to be complete.
2. A bare --since is backed off by a declared budget, SKEW_BUDGET_SECONDS = 3600, and the report line states both boundaries and the back-off out loud, so a re-listed boundary entry reads as re-recognition rather than noise.
3. The date window is closed topologically, and refuses to read clean when it cannot prove it. The emitted set is every first-parent commit at or above the deepest commit dated inside the budgeted window — a chain prefix, so nothing is ever dropped for being dated below something that landed before it, whatever the budget is. The proof obligation is the other half: the walk must actually see a commit dated below the boundary, or that deepest commit cannot be shown to be the deepest one. When it cannot, the repo is WINDOW EDGE, the green tick is suppressed and the sweep exits 2.

Part 3 is an addition to the ruled route A, not a substitute for it, and it is why the card's invariant now holds mechanically rather than up to a constant: a governed entry at a skew boundary is either listed, or the sweep is INCOMPLETE — never clean-and-absent.

Why 3600 s, and why not 874 s

reading	measurement	source
largest build-to-land skew	1,939 s (PR #12443: committed 2026-08-26T05:00:49Z, merged 05:33:08Z)	card, two governed PRs of one batch
second of the same batch	1,495 s (PR #12440)	card
largest committer-date inversion on this mainline	874 s, 10 inversions in 3,613 first-parent pairs, median 539 s	re-measured on this tree 2026-08-27, git log --first-parent origin/main

The re-measurement reproduces the card exactly (10 / max 874 s / median 539 s; one extra pair because main advanced), and two of the ten inverted commits touch a governed surface. 3600 s is 1.86× the largest directly measured skew and 4.1× the largest inversion. It is deliberately not set to the measured maximum: a bound written exactly at today's worst case invalidates itself the first time a slower batch lands — the same trap as an upper bound pinned at the version that fixes it. The cost is re-listing whatever landed in the hour before the boundary; on the documented default (--since 24h) that widens the window by 4.2%, and consecutive default rounds already overlap by nearly a full day.

Before / after

Real history, the card's own probe (enumeration only — the sweep minus its attribution round-trips, which are one GET per entry and have nothing to do with the window):

BEFORE (origin/main)
--since 2026-08-14T05:55:02Z scanned=1720 governed_entries=190 01a7337fc0 listed? false
--since 2026-08-14T05:44:52Z scanned=1722 governed_entries=191 01a7337fc0 listed? true
AFTER (this branch)
--since 2026-08-14T05:55:02Z scanned=1726 governed_entries=193 01a7337fc0 listed? true
-> 01a7337fc0 PR #8620 surfaces: docs/adr/0029-kernel-object-ownership-and-platform-objects-decomposition.md
--since 2026-08-14T05:44:52Z scanned=1726 governed_entries=193 01a7337fc0 listed? true

The two boundaries that used to disagree by one governed ADR now return the identical list. The 190 → 193 growth is the hour of back-off plus the topological close, i.e. the re-listings named in the report line.

End to end, real exit codes, on a constructed QS-7 repo (a queue chain whose governed entry landed above the round tip while dated 874 s — the measured maximum — before it; subjects carry no PR number on purpose, so the run costs zero API lookups and the exit code under test is the window's). The BEFORE column is the pristine origin/main copy of the script run against the same repo:

BEFORE --since 2026-08-14T05:55:02Z exit 0
governed-merges sweep: 0 governed merge(s) …
✓ audited objectstack-ai/objectstack — … 0 mainline commit(s) in window; history complete clone
✅ clean window — no governed surface was merged in any governed repo.
AFTER --since 2026-08-14T05:55:02Z exit 0
governed-merges sweep: 1 governed merge(s) …
window: DATE boundary 2026-08-14T05:55:02.000Z, backed off by the 3600 s build-to-land
skew budget to 2026-08-14T04:55:02.000Z, then closed topologically down to the deepest commit
inside it (#12633). An entry you recognised last round may be RE-LISTED at the boundary —
that is RE-RECOGNITION, not noise; a dropped entry is never seen again.
• objectstack-ai/objectstack … docs(adr): kernel object ownership
surfaces: docs/adr/** ×1
- docs/adr/0029-kernel-object-ownership.md
AFTER --since-ref ROUND_TIP (route B) exit 0
window: TOPOLOGICAL — the first-parent range from the ref to origin/main, per repo (…).
Committer dates are not consulted, so no build-to-land skew of any size can move this boundary.
✓ audited … 1 mainline commit(s) in window; window topological from d865aeeef
• objectstack-ai/objectstack … docs(adr): kernel object ownership

The multi-repo half of route B, a ref that resolves in objectstack but not in the swept sibling — it falls back, names why, and still lists the governed entry:

 ✓ audited objectstack-ai/objectui — … window date (fell back — '98eec7e24…' does not resolve
in this checkout); history complete clone

Verification

Union re-run after the final commit, on fdff4bad1, one && chain under scripts/pm/os-verify-lock.sh so the verdict certifies all of it:

os-verify-lock: VERDICT command-exit 0 · held the lock 146s (2m26s) · waited 0s

covering check:pm-governed-merges, check:pm-governed-prose, check:pm-dispatch-gates, bare-root-worklist --self-test, check-governed-queue-guard --self-test, ci-failure --self-test, check:nul-bytes, check:agent-test-spelling, check:bash32-floor, check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check-ci-filter-parity, check-skills-token-ratchet, and whole-repo pnpm lint (no narrowing — eslint . --no-inline-config, 65 s). The gate family was derived from the diff by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, plus the two convention-triggered obligations it names for a gate-script edit, plus the three sibling scripts that import this module (check-governed-queue-guard, ci-failure, check-skills-token-ratchet) — an import is not a path literal, so the derivation cannot name them.

✓ check-governed-merges --self-test: 193 assertions

Baseline on this tree was 159, not the 157 the card recorded — main moved between the measurement and the dispatch; no pre-existing assertion was removed or weakened, and 34 were added. The new ones pin the QS-7 shape in both directions (the old bare cut drops the entry as a control; the budgeted window lists it), the topological close carrying an entry skewed past the budget, the unproven-boundary EDGE, the listed-or-INCOMPLETE invariant as a property over every fixture, the escalating floors (one walk in the ordinary case), per-repo --since-ref resolution with its named fallback, and the window words an operator actually reads.

Notes

• Not a governed surface.node scripts/pm/check-governed-merges.mjs --test scripts/pm/check-governed-merges.mjs → NOT governed, exit 0, derived from the register rather than recalled.
• WINDOW EDGE is a backstop and the header says so. On a complete clone the widened walk always reaches the root commit, so it cannot fire; on a shallow one the Three seat-run tools ask windowed history questions with no shallow guard, so each answers plausibly and wrongly in an agent container #9902 horizon guard classifies the repo UNAUDITED before enumeration begins. It is the mechanical statement of an invariant that otherwise rests entirely on a predicate living in another file, and it is exercised in --self-test rather than by a real sweep.
• Rider from the check-governed-merges: measure whether a governed-surface PR landing via a merge-queue batch is visible to the audit (#11831 ruling) #11996 close carried as the one-line header note it was ruled to be: queue-batch topology measured non-blind 2026-08-27 (six topologies plus a live batch replay), re-measure if the repo's merge method changes or the mainline-commits / commit-paths enumeration is reworked.
• No changeset, skip-changeset applied: this is a CI-internal script that publishes nothing — the textbook case .github/workflows/lint.yml names in its own prose.

---

Generated by Claude Code

[os-litant]

Fixes#12633

The merge queue writes a batch entry's commit when the batch is built, and main receives it when the batch lands. Those are not the same moment, so a governed landing can sit above another commit on main's first-parent chain — it landed later — while carrying an earlier committer date. git log --since=DATE cuts on committer date, so at a knife-edge boundary that landing is simply absent, with nothing in the output marking the gap; where it is the only governed landing in the window, the sweep prints ✅ clean window and exits 0 = "swept COMPLETELY", the one reading #4690 and #9902 say must never be producible.

Implements the route ruled on the card — B for --since-ref, A for --since. C (detect and refuse) and D (document) stay declined. The audit's report-only posture is unchanged, no judgment is weakened, and every pre-existing --self-test assertion is kept verbatim.

What changed — one file, scripts/pm/check-governed-merges.mjs

1. --since-ref is topological. The window is the first-parent range from the ref to origin/main; committer dates are not consulted at all, so no skew of any size can move the boundary. Multi-repo: a bare --since-ref is tried in every governed repo and used wherever it resolves, and --since-ref repoId=REF pins one repo (repeatable). A repo no ref resolves in falls back to the date window and its report line says so — one repo's ref silently dating four repos' windows is the same class of bug as the one being fixed. Recording the previous round's tip is the caller's obligation (this script keeps no state), so the PM assumption on the card is discharged by printing the line to use next round on every sweep: next round, exactly: --since-ref objectstack=SHA --since-ref objectui=SHA …. Bonus: for a topological window the Three seat-run tools ask windowed history questions with no shallow guard, so each answers plausibly and wrongly in an agent container #9902 horizon question answers itself — the ref being present in a checkout is necessary and sufficient for the range to be complete.
2. A bare --since is backed off by a declared budget, SKEW_BUDGET_SECONDS = 3600, and the report line states both boundaries and the back-off out loud, so a re-listed boundary entry reads as re-recognition rather than noise.
3. The date window is closed topologically, and refuses to read clean when it cannot prove it. The emitted set is every first-parent commit at or above the deepest commit dated inside the budgeted window — a chain prefix, so nothing is ever dropped for being dated below something that landed before it, whatever the budget is. The proof obligation is the other half: the walk must actually see a commit dated below the boundary, or that deepest commit cannot be shown to be the deepest one. When it cannot, the repo is WINDOW EDGE, the green tick is suppressed and the sweep exits 2.

Part 3 is an addition to the ruled route A, not a substitute for it, and it is why the card's invariant now holds mechanically rather than up to a constant: a governed entry at a skew boundary is either listed, or the sweep is INCOMPLETE — never clean-and-absent.

Why 3600 s, and why not 874 s

reading	measurement	source
largest build-to-land skew	1,939 s (PR #12443: committed 2026-08-26T05:00:49Z, merged 05:33:08Z)	card, two governed PRs of one batch
second of the same batch	1,495 s (PR #12440)	card
largest committer-date inversion on this mainline	874 s, 10 inversions in 3,613 first-parent pairs, median 539 s	re-measured on this tree 2026-08-27, git log --first-parent origin/main

The re-measurement reproduces the card exactly (10 / max 874 s / median 539 s; one extra pair because main advanced), and two of the ten inverted commits touch a governed surface. 3600 s is 1.86× the largest directly measured skew and 4.1× the largest inversion. It is deliberately not set to the measured maximum: a bound written exactly at today's worst case invalidates itself the first time a slower batch lands — the same trap as an upper bound pinned at the version that fixes it. The cost is re-listing whatever landed in the hour before the boundary; on the documented default (--since 24h) that widens the window by 4.2%, and consecutive default rounds already overlap by nearly a full day.

Before / after

Real history, the card's own probe (enumeration only — the sweep minus its attribution round-trips, which are one GET per entry and have nothing to do with the window):

BEFORE (origin/main)
--since 2026-08-14T05:55:02Z scanned=1720 governed_entries=190 01a7337fc0 listed? false
--since 2026-08-14T05:44:52Z scanned=1722 governed_entries=191 01a7337fc0 listed? true
AFTER (this branch)
--since 2026-08-14T05:55:02Z scanned=1726 governed_entries=193 01a7337fc0 listed? true
-> 01a7337fc0 PR #8620 surfaces: docs/adr/0029-kernel-object-ownership-and-platform-objects-decomposition.md
--since 2026-08-14T05:44:52Z scanned=1726 governed_entries=193 01a7337fc0 listed? true

The two boundaries that used to disagree by one governed ADR now return the identical list. The 190 → 193 growth is the hour of back-off plus the topological close, i.e. the re-listings named in the report line.

End to end, real exit codes, on a constructed QS-7 repo (a queue chain whose governed entry landed above the round tip while dated 874 s — the measured maximum — before it; subjects carry no PR number on purpose, so the run costs zero API lookups and the exit code under test is the window's). The BEFORE column is the pristine origin/main copy of the script run against the same repo:

BEFORE --since 2026-08-14T05:55:02Z exit 0
governed-merges sweep: 0 governed merge(s) …
✓ audited objectstack-ai/objectstack — … 0 mainline commit(s) in window; history complete clone
✅ clean window — no governed surface was merged in any governed repo.
AFTER --since 2026-08-14T05:55:02Z exit 0
governed-merges sweep: 1 governed merge(s) …
window: DATE boundary 2026-08-14T05:55:02.000Z, backed off by the 3600 s build-to-land
skew budget to 2026-08-14T04:55:02.000Z, then closed topologically down to the deepest commit
inside it (#12633). An entry you recognised last round may be RE-LISTED at the boundary —
that is RE-RECOGNITION, not noise; a dropped entry is never seen again.
• objectstack-ai/objectstack … docs(adr): kernel object ownership
surfaces: docs/adr/** ×1
- docs/adr/0029-kernel-object-ownership.md
AFTER --since-ref ROUND_TIP (route B) exit 0
window: TOPOLOGICAL — the first-parent range from the ref to origin/main, per repo (…).
Committer dates are not consulted, so no build-to-land skew of any size can move this boundary.
✓ audited … 1 mainline commit(s) in window; window topological from d865aeeef
• objectstack-ai/objectstack … docs(adr): kernel object ownership

The multi-repo half of route B, a ref that resolves in objectstack but not in the swept sibling — it falls back, names why, and still lists the governed entry:

 ✓ audited objectstack-ai/objectui — … window date (fell back — '98eec7e24…' does not resolve
in this checkout); history complete clone

Verification

Union re-run after the final commit, on fdff4bad1, one && chain under scripts/pm/os-verify-lock.sh so the verdict certifies all of it:

os-verify-lock: VERDICT command-exit 0 · held the lock 146s (2m26s) · waited 0s

covering check:pm-governed-merges, check:pm-governed-prose, check:pm-dispatch-gates, bare-root-worklist --self-test, check-governed-queue-guard --self-test, ci-failure --self-test, check:nul-bytes, check:agent-test-spelling, check:bash32-floor, check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check-ci-filter-parity, check-skills-token-ratchet, and whole-repo pnpm lint (no narrowing — eslint . --no-inline-config, 65 s). The gate family was derived from the diff by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, plus the two convention-triggered obligations it names for a gate-script edit, plus the three sibling scripts that import this module (check-governed-queue-guard, ci-failure, check-skills-token-ratchet) — an import is not a path literal, so the derivation cannot name them.

✓ check-governed-merges --self-test: 193 assertions

Baseline on this tree was 159, not the 157 the card recorded — main moved between the measurement and the dispatch; no pre-existing assertion was removed or weakened, and 34 were added. The new ones pin the QS-7 shape in both directions (the old bare cut drops the entry as a control; the budgeted window lists it), the topological close carrying an entry skewed past the budget, the unproven-boundary EDGE, the listed-or-INCOMPLETE invariant as a property over every fixture, the escalating floors (one walk in the ordinary case), per-repo --since-ref resolution with its named fallback, and the window words an operator actually reads.

Notes

• Not a governed surface.node scripts/pm/check-governed-merges.mjs --test scripts/pm/check-governed-merges.mjs → NOT governed, exit 0, derived from the register rather than recalled.
• WINDOW EDGE is a backstop and the header says so. On a complete clone the widened walk always reaches the root commit, so it cannot fire; on a shallow one the Three seat-run tools ask windowed history questions with no shallow guard, so each answers plausibly and wrongly in an agent container #9902 horizon guard classifies the repo UNAUDITED before enumeration begins. It is the mechanical statement of an invariant that otherwise rests entirely on a predicate living in another file, and it is exercised in --self-test rather than by a real sweep.
• Rider from the check-governed-merges: measure whether a governed-surface PR landing via a merge-queue batch is visible to the audit (#11831 ruling) #11996 close carried as the one-line header note it was ruled to be: queue-batch topology measured non-blind 2026-08-27 (six topologies plus a live batch replay), re-measure if the repo's merge method changes or the mainline-commits / commit-paths enumeration is reworked.
• No changeset, skip-changeset applied: this is a CI-internal script that publishes nothing — the textbook case .github/workflows/lint.yml names in its own prose.

---

Generated by Claude Code

[os-litant]

Fixes#12633

The merge queue writes a batch entry's commit when the batch is built, and main receives it when the batch lands. Those are not the same moment, so a governed landing can sit above another commit on main's first-parent chain — it landed later — while carrying an earlier committer date. git log --since=DATE cuts on committer date, so at a knife-edge boundary that landing is simply absent, with nothing in the output marking the gap; where it is the only governed landing in the window, the sweep prints ✅ clean window and exits 0 = "swept COMPLETELY", the one reading #4690 and #9902 say must never be producible.

Implements the route ruled on the card — B for --since-ref, A for --since. C (detect and refuse) and D (document) stay declined. The audit's report-only posture is unchanged, no judgment is weakened, and every pre-existing --self-test assertion is kept verbatim.

What changed — one file, scripts/pm/check-governed-merges.mjs

1. --since-ref is topological. The window is the first-parent range from the ref to origin/main; committer dates are not consulted at all, so no skew of any size can move the boundary. Multi-repo: a bare --since-ref is tried in every governed repo and used wherever it resolves, and --since-ref repoId=REF pins one repo (repeatable). A repo no ref resolves in falls back to the date window and its report line says so — one repo's ref silently dating four repos' windows is the same class of bug as the one being fixed. Recording the previous round's tip is the caller's obligation (this script keeps no state), so the PM assumption on the card is discharged by printing the line to use next round on every sweep: next round, exactly: --since-ref objectstack=SHA --since-ref objectui=SHA …. Bonus: for a topological window the Three seat-run tools ask windowed history questions with no shallow guard, so each answers plausibly and wrongly in an agent container #9902 horizon question answers itself — the ref being present in a checkout is necessary and sufficient for the range to be complete.
2. A bare --since is backed off by a declared budget, SKEW_BUDGET_SECONDS = 3600, and the report line states both boundaries and the back-off out loud, so a re-listed boundary entry reads as re-recognition rather than noise.
3. The date window is closed topologically, and refuses to read clean when it cannot prove it. The emitted set is every first-parent commit at or above the deepest commit dated inside the budgeted window — a chain prefix, so nothing is ever dropped for being dated below something that landed before it, whatever the budget is. The proof obligation is the other half: the walk must actually see a commit dated below the boundary, or that deepest commit cannot be shown to be the deepest one. When it cannot, the repo is WINDOW EDGE, the green tick is suppressed and the sweep exits 2.

Part 3 is an addition to the ruled route A, not a substitute for it, and it is why the card's invariant now holds mechanically rather than up to a constant: a governed entry at a skew boundary is either listed, or the sweep is INCOMPLETE — never clean-and-absent.

Why 3600 s, and why not 874 s

reading	measurement	source
largest build-to-land skew	1,939 s (PR #12443: committed 2026-08-26T05:00:49Z, merged 05:33:08Z)	card, two governed PRs of one batch
second of the same batch	1,495 s (PR #12440)	card
largest committer-date inversion on this mainline	874 s, 10 inversions in 3,613 first-parent pairs, median 539 s	re-measured on this tree 2026-08-27, git log --first-parent origin/main

The re-measurement reproduces the card exactly (10 / max 874 s / median 539 s; one extra pair because main advanced), and two of the ten inverted commits touch a governed surface. 3600 s is 1.86× the largest directly measured skew and 4.1× the largest inversion. It is deliberately not set to the measured maximum: a bound written exactly at today's worst case invalidates itself the first time a slower batch lands — the same trap as an upper bound pinned at the version that fixes it. The cost is re-listing whatever landed in the hour before the boundary; on the documented default (--since 24h) that widens the window by 4.2%, and consecutive default rounds already overlap by nearly a full day.

Before / after

Real history, the card's own probe (enumeration only — the sweep minus its attribution round-trips, which are one GET per entry and have nothing to do with the window):

BEFORE (origin/main)
--since 2026-08-14T05:55:02Z scanned=1720 governed_entries=190 01a7337fc0 listed? false
--since 2026-08-14T05:44:52Z scanned=1722 governed_entries=191 01a7337fc0 listed? true
AFTER (this branch)
--since 2026-08-14T05:55:02Z scanned=1726 governed_entries=193 01a7337fc0 listed? true
-> 01a7337fc0 PR #8620 surfaces: docs/adr/0029-kernel-object-ownership-and-platform-objects-decomposition.md
--since 2026-08-14T05:44:52Z scanned=1726 governed_entries=193 01a7337fc0 listed? true

The two boundaries that used to disagree by one governed ADR now return the identical list. The 190 → 193 growth is the hour of back-off plus the topological close, i.e. the re-listings named in the report line.

End to end, real exit codes, on a constructed QS-7 repo (a queue chain whose governed entry landed above the round tip while dated 874 s — the measured maximum — before it; subjects carry no PR number on purpose, so the run costs zero API lookups and the exit code under test is the window's). The BEFORE column is the pristine origin/main copy of the script run against the same repo:

BEFORE --since 2026-08-14T05:55:02Z exit 0
governed-merges sweep: 0 governed merge(s) …
✓ audited objectstack-ai/objectstack — … 0 mainline commit(s) in window; history complete clone
✅ clean window — no governed surface was merged in any governed repo.
AFTER --since 2026-08-14T05:55:02Z exit 0
governed-merges sweep: 1 governed merge(s) …
window: DATE boundary 2026-08-14T05:55:02.000Z, backed off by the 3600 s build-to-land
skew budget to 2026-08-14T04:55:02.000Z, then closed topologically down to the deepest commit
inside it (#12633). An entry you recognised last round may be RE-LISTED at the boundary —
that is RE-RECOGNITION, not noise; a dropped entry is never seen again.
• objectstack-ai/objectstack … docs(adr): kernel object ownership
surfaces: docs/adr/** ×1
- docs/adr/0029-kernel-object-ownership.md
AFTER --since-ref ROUND_TIP (route B) exit 0
window: TOPOLOGICAL — the first-parent range from the ref to origin/main, per repo (…).
Committer dates are not consulted, so no build-to-land skew of any size can move this boundary.
✓ audited … 1 mainline commit(s) in window; window topological from d865aeeef
• objectstack-ai/objectstack … docs(adr): kernel object ownership

The multi-repo half of route B, a ref that resolves in objectstack but not in the swept sibling — it falls back, names why, and still lists the governed entry:

 ✓ audited objectstack-ai/objectui — … window date (fell back — '98eec7e24…' does not resolve
in this checkout); history complete clone

Verification

Union re-run after the final commit, on fdff4bad1, one && chain under scripts/pm/os-verify-lock.sh so the verdict certifies all of it:

os-verify-lock: VERDICT command-exit 0 · held the lock 146s (2m26s) · waited 0s

covering check:pm-governed-merges, check:pm-governed-prose, check:pm-dispatch-gates, bare-root-worklist --self-test, check-governed-queue-guard --self-test, ci-failure --self-test, check:nul-bytes, check:agent-test-spelling, check:bash32-floor, check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check-ci-filter-parity, check-skills-token-ratchet, and whole-repo pnpm lint (no narrowing — eslint . --no-inline-config, 65 s). The gate family was derived from the diff by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, plus the two convention-triggered obligations it names for a gate-script edit, plus the three sibling scripts that import this module (check-governed-queue-guard, ci-failure, check-skills-token-ratchet) — an import is not a path literal, so the derivation cannot name them.

✓ check-governed-merges --self-test: 193 assertions

Baseline on this tree was 159, not the 157 the card recorded — main moved between the measurement and the dispatch; no pre-existing assertion was removed or weakened, and 34 were added. The new ones pin the QS-7 shape in both directions (the old bare cut drops the entry as a control; the budgeted window lists it), the topological close carrying an entry skewed past the budget, the unproven-boundary EDGE, the listed-or-INCOMPLETE invariant as a property over every fixture, the escalating floors (one walk in the ordinary case), per-repo --since-ref resolution with its named fallback, and the window words an operator actually reads.

Notes

• Not a governed surface.node scripts/pm/check-governed-merges.mjs --test scripts/pm/check-governed-merges.mjs → NOT governed, exit 0, derived from the register rather than recalled.
• WINDOW EDGE is a backstop and the header says so. On a complete clone the widened walk always reaches the root commit, so it cannot fire; on a shallow one the Three seat-run tools ask windowed history questions with no shallow guard, so each answers plausibly and wrongly in an agent container #9902 horizon guard classifies the repo UNAUDITED before enumeration begins. It is the mechanical statement of an invariant that otherwise rests entirely on a predicate living in another file, and it is exercised in --self-test rather than by a real sweep.
• Rider from the check-governed-merges: measure whether a governed-surface PR landing via a merge-queue batch is visible to the audit (#11831 ruling) #11996 close carried as the one-line header note it was ruled to be: queue-batch topology measured non-blind 2026-08-27 (six topologies plus a live batch replay), re-measure if the repo's merge method changes or the mainline-commits / commit-paths enumeration is reworked.
• No changeset, skip-changeset applied: this is a CI-internal script that publishes nothing — the textbook case .github/workflows/lint.yml names in its own prose.

---

Generated by Claude Code

[os-litant]

Fixes#12633

The merge queue writes a batch entry's commit when the batch is built, and main receives it when the batch lands. Those are not the same moment, so a governed landing can sit above another commit on main's first-parent chain — it landed later — while carrying an earlier committer date. git log --since=DATE cuts on committer date, so at a knife-edge boundary that landing is simply absent, with nothing in the output marking the gap; where it is the only governed landing in the window, the sweep prints ✅ clean window and exits 0 = "swept COMPLETELY", the one reading #4690 and #9902 say must never be producible.

Implements the route ruled on the card — B for --since-ref, A for --since. C (detect and refuse) and D (document) stay declined. The audit's report-only posture is unchanged, no judgment is weakened, and every pre-existing --self-test assertion is kept verbatim.

What changed — one file, scripts/pm/check-governed-merges.mjs

1. --since-ref is topological. The window is the first-parent range from the ref to origin/main; committer dates are not consulted at all, so no skew of any size can move the boundary. Multi-repo: a bare --since-ref is tried in every governed repo and used wherever it resolves, and --since-ref repoId=REF pins one repo (repeatable). A repo no ref resolves in falls back to the date window and its report line says so — one repo's ref silently dating four repos' windows is the same class of bug as the one being fixed. Recording the previous round's tip is the caller's obligation (this script keeps no state), so the PM assumption on the card is discharged by printing the line to use next round on every sweep: next round, exactly: --since-ref objectstack=SHA --since-ref objectui=SHA …. Bonus: for a topological window the Three seat-run tools ask windowed history questions with no shallow guard, so each answers plausibly and wrongly in an agent container #9902 horizon question answers itself — the ref being present in a checkout is necessary and sufficient for the range to be complete.
2. A bare --since is backed off by a declared budget, SKEW_BUDGET_SECONDS = 3600, and the report line states both boundaries and the back-off out loud, so a re-listed boundary entry reads as re-recognition rather than noise.
3. The date window is closed topologically, and refuses to read clean when it cannot prove it. The emitted set is every first-parent commit at or above the deepest commit dated inside the budgeted window — a chain prefix, so nothing is ever dropped for being dated below something that landed before it, whatever the budget is. The proof obligation is the other half: the walk must actually see a commit dated below the boundary, or that deepest commit cannot be shown to be the deepest one. When it cannot, the repo is WINDOW EDGE, the green tick is suppressed and the sweep exits 2.

Part 3 is an addition to the ruled route A, not a substitute for it, and it is why the card's invariant now holds mechanically rather than up to a constant: a governed entry at a skew boundary is either listed, or the sweep is INCOMPLETE — never clean-and-absent.

Why 3600 s, and why not 874 s

reading	measurement	source
largest build-to-land skew	1,939 s (PR #12443: committed 2026-08-26T05:00:49Z, merged 05:33:08Z)	card, two governed PRs of one batch
second of the same batch	1,495 s (PR #12440)	card
largest committer-date inversion on this mainline	874 s, 10 inversions in 3,613 first-parent pairs, median 539 s	re-measured on this tree 2026-08-27, git log --first-parent origin/main

The re-measurement reproduces the card exactly (10 / max 874 s / median 539 s; one extra pair because main advanced), and two of the ten inverted commits touch a governed surface. 3600 s is 1.86× the largest directly measured skew and 4.1× the largest inversion. It is deliberately not set to the measured maximum: a bound written exactly at today's worst case invalidates itself the first time a slower batch lands — the same trap as an upper bound pinned at the version that fixes it. The cost is re-listing whatever landed in the hour before the boundary; on the documented default (--since 24h) that widens the window by 4.2%, and consecutive default rounds already overlap by nearly a full day.

Before / after

Real history, the card's own probe (enumeration only — the sweep minus its attribution round-trips, which are one GET per entry and have nothing to do with the window):

BEFORE (origin/main)
--since 2026-08-14T05:55:02Z scanned=1720 governed_entries=190 01a7337fc0 listed? false
--since 2026-08-14T05:44:52Z scanned=1722 governed_entries=191 01a7337fc0 listed? true
AFTER (this branch)
--since 2026-08-14T05:55:02Z scanned=1726 governed_entries=193 01a7337fc0 listed? true
-> 01a7337fc0 PR #8620 surfaces: docs/adr/0029-kernel-object-ownership-and-platform-objects-decomposition.md
--since 2026-08-14T05:44:52Z scanned=1726 governed_entries=193 01a7337fc0 listed? true

The two boundaries that used to disagree by one governed ADR now return the identical list. The 190 → 193 growth is the hour of back-off plus the topological close, i.e. the re-listings named in the report line.

End to end, real exit codes, on a constructed QS-7 repo (a queue chain whose governed entry landed above the round tip while dated 874 s — the measured maximum — before it; subjects carry no PR number on purpose, so the run costs zero API lookups and the exit code under test is the window's). The BEFORE column is the pristine origin/main copy of the script run against the same repo:

BEFORE --since 2026-08-14T05:55:02Z exit 0
governed-merges sweep: 0 governed merge(s) …
✓ audited objectstack-ai/objectstack — … 0 mainline commit(s) in window; history complete clone
✅ clean window — no governed surface was merged in any governed repo.
AFTER --since 2026-08-14T05:55:02Z exit 0
governed-merges sweep: 1 governed merge(s) …
window: DATE boundary 2026-08-14T05:55:02.000Z, backed off by the 3600 s build-to-land
skew budget to 2026-08-14T04:55:02.000Z, then closed topologically down to the deepest commit
inside it (#12633). An entry you recognised last round may be RE-LISTED at the boundary —
that is RE-RECOGNITION, not noise; a dropped entry is never seen again.
• objectstack-ai/objectstack … docs(adr): kernel object ownership
surfaces: docs/adr/** ×1
- docs/adr/0029-kernel-object-ownership.md
AFTER --since-ref ROUND_TIP (route B) exit 0
window: TOPOLOGICAL — the first-parent range from the ref to origin/main, per repo (…).
Committer dates are not consulted, so no build-to-land skew of any size can move this boundary.
✓ audited … 1 mainline commit(s) in window; window topological from d865aeeef
• objectstack-ai/objectstack … docs(adr): kernel object ownership

The multi-repo half of route B, a ref that resolves in objectstack but not in the swept sibling — it falls back, names why, and still lists the governed entry:

 ✓ audited objectstack-ai/objectui — … window date (fell back — '98eec7e24…' does not resolve
in this checkout); history complete clone

Verification

Union re-run after the final commit, on fdff4bad1, one && chain under scripts/pm/os-verify-lock.sh so the verdict certifies all of it:

os-verify-lock: VERDICT command-exit 0 · held the lock 146s (2m26s) · waited 0s

covering check:pm-governed-merges, check:pm-governed-prose, check:pm-dispatch-gates, bare-root-worklist --self-test, check-governed-queue-guard --self-test, ci-failure --self-test, check:nul-bytes, check:agent-test-spelling, check:bash32-floor, check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check-ci-filter-parity, check-skills-token-ratchet, and whole-repo pnpm lint (no narrowing — eslint . --no-inline-config, 65 s). The gate family was derived from the diff by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, plus the two convention-triggered obligations it names for a gate-script edit, plus the three sibling scripts that import this module (check-governed-queue-guard, ci-failure, check-skills-token-ratchet) — an import is not a path literal, so the derivation cannot name them.

✓ check-governed-merges --self-test: 193 assertions

Baseline on this tree was 159, not the 157 the card recorded — main moved between the measurement and the dispatch; no pre-existing assertion was removed or weakened, and 34 were added. The new ones pin the QS-7 shape in both directions (the old bare cut drops the entry as a control; the budgeted window lists it), the topological close carrying an entry skewed past the budget, the unproven-boundary EDGE, the listed-or-INCOMPLETE invariant as a property over every fixture, the escalating floors (one walk in the ordinary case), per-repo --since-ref resolution with its named fallback, and the window words an operator actually reads.

Notes

• Not a governed surface.node scripts/pm/check-governed-merges.mjs --test scripts/pm/check-governed-merges.mjs → NOT governed, exit 0, derived from the register rather than recalled.
• WINDOW EDGE is a backstop and the header says so. On a complete clone the widened walk always reaches the root commit, so it cannot fire; on a shallow one the Three seat-run tools ask windowed history questions with no shallow guard, so each answers plausibly and wrongly in an agent container #9902 horizon guard classifies the repo UNAUDITED before enumeration begins. It is the mechanical statement of an invariant that otherwise rests entirely on a predicate living in another file, and it is exercised in --self-test rather than by a real sweep.
• Rider from the check-governed-merges: measure whether a governed-surface PR landing via a merge-queue batch is visible to the audit (#11831 ruling) #11996 close carried as the one-line header note it was ruled to be: queue-batch topology measured non-blind 2026-08-27 (six topologies plus a live batch replay), re-measure if the repo's merge method changes or the mainline-commits / commit-paths enumeration is reworked.
• No changeset, skip-changeset applied: this is a CI-internal script that publishes nothing — the textbook case .github/workflows/lint.yml names in its own prose.

---

Generated by Claude Code

[os-litant]

Fixes#12633

The merge queue writes a batch entry's commit when the batch is built, and main receives it when the batch lands. Those are not the same moment, so a governed landing can sit above another commit on main's first-parent chain — it landed later — while carrying an earlier committer date. git log --since=DATE cuts on committer date, so at a knife-edge boundary that landing is simply absent, with nothing in the output marking the gap; where it is the only governed landing in the window, the sweep prints ✅ clean window and exits 0 = "swept COMPLETELY", the one reading #4690 and #9902 say must never be producible.

Implements the route ruled on the card — B for --since-ref, A for --since. C (detect and refuse) and D (document) stay declined. The audit's report-only posture is unchanged, no judgment is weakened, and every pre-existing --self-test assertion is kept verbatim.

What changed — one file, scripts/pm/check-governed-merges.mjs

1. --since-ref is topological. The window is the first-parent range from the ref to origin/main; committer dates are not consulted at all, so no skew of any size can move the boundary. Multi-repo: a bare --since-ref is tried in every governed repo and used wherever it resolves, and --since-ref repoId=REF pins one repo (repeatable). A repo no ref resolves in falls back to the date window and its report line says so — one repo's ref silently dating four repos' windows is the same class of bug as the one being fixed. Recording the previous round's tip is the caller's obligation (this script keeps no state), so the PM assumption on the card is discharged by printing the line to use next round on every sweep: next round, exactly: --since-ref objectstack=SHA --since-ref objectui=SHA …. Bonus: for a topological window the Three seat-run tools ask windowed history questions with no shallow guard, so each answers plausibly and wrongly in an agent container #9902 horizon question answers itself — the ref being present in a checkout is necessary and sufficient for the range to be complete.
2. A bare --since is backed off by a declared budget, SKEW_BUDGET_SECONDS = 3600, and the report line states both boundaries and the back-off out loud, so a re-listed boundary entry reads as re-recognition rather than noise.
3. The date window is closed topologically, and refuses to read clean when it cannot prove it. The emitted set is every first-parent commit at or above the deepest commit dated inside the budgeted window — a chain prefix, so nothing is ever dropped for being dated below something that landed before it, whatever the budget is. The proof obligation is the other half: the walk must actually see a commit dated below the boundary, or that deepest commit cannot be shown to be the deepest one. When it cannot, the repo is WINDOW EDGE, the green tick is suppressed and the sweep exits 2.

Part 3 is an addition to the ruled route A, not a substitute for it, and it is why the card's invariant now holds mechanically rather than up to a constant: a governed entry at a skew boundary is either listed, or the sweep is INCOMPLETE — never clean-and-absent.

Why 3600 s, and why not 874 s

reading	measurement	source
largest build-to-land skew	1,939 s (PR #12443: committed 2026-08-26T05:00:49Z, merged 05:33:08Z)	card, two governed PRs of one batch
second of the same batch	1,495 s (PR #12440)	card
largest committer-date inversion on this mainline	874 s, 10 inversions in 3,613 first-parent pairs, median 539 s	re-measured on this tree 2026-08-27, git log --first-parent origin/main

The re-measurement reproduces the card exactly (10 / max 874 s / median 539 s; one extra pair because main advanced), and two of the ten inverted commits touch a governed surface. 3600 s is 1.86× the largest directly measured skew and 4.1× the largest inversion. It is deliberately not set to the measured maximum: a bound written exactly at today's worst case invalidates itself the first time a slower batch lands — the same trap as an upper bound pinned at the version that fixes it. The cost is re-listing whatever landed in the hour before the boundary; on the documented default (--since 24h) that widens the window by 4.2%, and consecutive default rounds already overlap by nearly a full day.

Before / after

Real history, the card's own probe (enumeration only — the sweep minus its attribution round-trips, which are one GET per entry and have nothing to do with the window):

BEFORE (origin/main)
--since 2026-08-14T05:55:02Z scanned=1720 governed_entries=190 01a7337fc0 listed? false
--since 2026-08-14T05:44:52Z scanned=1722 governed_entries=191 01a7337fc0 listed? true
AFTER (this branch)
--since 2026-08-14T05:55:02Z scanned=1726 governed_entries=193 01a7337fc0 listed? true
-> 01a7337fc0 PR #8620 surfaces: docs/adr/0029-kernel-object-ownership-and-platform-objects-decomposition.md
--since 2026-08-14T05:44:52Z scanned=1726 governed_entries=193 01a7337fc0 listed? true

The two boundaries that used to disagree by one governed ADR now return the identical list. The 190 → 193 growth is the hour of back-off plus the topological close, i.e. the re-listings named in the report line.

End to end, real exit codes, on a constructed QS-7 repo (a queue chain whose governed entry landed above the round tip while dated 874 s — the measured maximum — before it; subjects carry no PR number on purpose, so the run costs zero API lookups and the exit code under test is the window's). The BEFORE column is the pristine origin/main copy of the script run against the same repo:

BEFORE --since 2026-08-14T05:55:02Z exit 0
governed-merges sweep: 0 governed merge(s) …
✓ audited objectstack-ai/objectstack — … 0 mainline commit(s) in window; history complete clone
✅ clean window — no governed surface was merged in any governed repo.
AFTER --since 2026-08-14T05:55:02Z exit 0
governed-merges sweep: 1 governed merge(s) …
window: DATE boundary 2026-08-14T05:55:02.000Z, backed off by the 3600 s build-to-land
skew budget to 2026-08-14T04:55:02.000Z, then closed topologically down to the deepest commit
inside it (#12633). An entry you recognised last round may be RE-LISTED at the boundary —
that is RE-RECOGNITION, not noise; a dropped entry is never seen again.
• objectstack-ai/objectstack … docs(adr): kernel object ownership
surfaces: docs/adr/** ×1
- docs/adr/0029-kernel-object-ownership.md
AFTER --since-ref ROUND_TIP (route B) exit 0
window: TOPOLOGICAL — the first-parent range from the ref to origin/main, per repo (…).
Committer dates are not consulted, so no build-to-land skew of any size can move this boundary.
✓ audited … 1 mainline commit(s) in window; window topological from d865aeeef
• objectstack-ai/objectstack … docs(adr): kernel object ownership

The multi-repo half of route B, a ref that resolves in objectstack but not in the swept sibling — it falls back, names why, and still lists the governed entry:

 ✓ audited objectstack-ai/objectui — … window date (fell back — '98eec7e24…' does not resolve
in this checkout); history complete clone

Verification

Union re-run after the final commit, on fdff4bad1, one && chain under scripts/pm/os-verify-lock.sh so the verdict certifies all of it:

os-verify-lock: VERDICT command-exit 0 · held the lock 146s (2m26s) · waited 0s

covering check:pm-governed-merges, check:pm-governed-prose, check:pm-dispatch-gates, bare-root-worklist --self-test, check-governed-queue-guard --self-test, ci-failure --self-test, check:nul-bytes, check:agent-test-spelling, check:bash32-floor, check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check-ci-filter-parity, check-skills-token-ratchet, and whole-repo pnpm lint (no narrowing — eslint . --no-inline-config, 65 s). The gate family was derived from the diff by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, plus the two convention-triggered obligations it names for a gate-script edit, plus the three sibling scripts that import this module (check-governed-queue-guard, ci-failure, check-skills-token-ratchet) — an import is not a path literal, so the derivation cannot name them.

✓ check-governed-merges --self-test: 193 assertions

Baseline on this tree was 159, not the 157 the card recorded — main moved between the measurement and the dispatch; no pre-existing assertion was removed or weakened, and 34 were added. The new ones pin the QS-7 shape in both directions (the old bare cut drops the entry as a control; the budgeted window lists it), the topological close carrying an entry skewed past the budget, the unproven-boundary EDGE, the listed-or-INCOMPLETE invariant as a property over every fixture, the escalating floors (one walk in the ordinary case), per-repo --since-ref resolution with its named fallback, and the window words an operator actually reads.

Notes

• Not a governed surface.node scripts/pm/check-governed-merges.mjs --test scripts/pm/check-governed-merges.mjs → NOT governed, exit 0, derived from the register rather than recalled.
• WINDOW EDGE is a backstop and the header says so. On a complete clone the widened walk always reaches the root commit, so it cannot fire; on a shallow one the Three seat-run tools ask windowed history questions with no shallow guard, so each answers plausibly and wrongly in an agent container #9902 horizon guard classifies the repo UNAUDITED before enumeration begins. It is the mechanical statement of an invariant that otherwise rests entirely on a predicate living in another file, and it is exercised in --self-test rather than by a real sweep.
• Rider from the check-governed-merges: measure whether a governed-surface PR landing via a merge-queue batch is visible to the audit (#11831 ruling) #11996 close carried as the one-line header note it was ruled to be: queue-batch topology measured non-blind 2026-08-27 (six topologies plus a live batch replay), re-measure if the repo's merge method changes or the mainline-commits / commit-paths enumeration is reworked.
• No changeset, skip-changeset applied: this is a CI-internal script that publishes nothing — the textbook case .github/workflows/lint.yml names in its own prose.

---

Generated by Claude Code