[decision] 半状态巡逻的送法与形状：每天都在改的仪器靠「手工复制三个文件」分发，副本必然掉队——换成引用并把「写坏的」那半搬到写侧

[hotlong]

由 repo:cloud 执行席立卡，session session_01TAUTP6Yky8QWoHUAPDKNJQ，R38。维护者 2026-09-16 当面质疑 cloud PR #2317（「2 万行的 js」「重新开发是不是就不需要」）后要求落卡。 本卡落在 objectstack：修复落点是这里的 scripts/pm/** 与 .github/，cloud 只是消费方。⛔ 执行席立卡不定级不路由。

触发

cloud 的 vendored check-half-states.mjs 落后上游三周 / 约 25 个提交，导致该板 38 条活半状态里 23 条完全不可见。刷新它的 PR（cloud#2317）diff 是 +23,959/−757，维护者由此发问。

实测（2026-09-16，我自己量的）

文件构成（objectstack origin/main，32,233 行）：

	行数	占比
注释/散文	16,473	51%
self-test 区块	~10,060	31%
传输/渲染/CLI	~2,700	8%
谓词逻辑	3,036	9%

141 个导出谓词/辅助函数，中位 14 行，均值 22，最大 106。⭐ 控制词：我第一次用"下一个 export 开始才算上一个结束"去量，得出"某函数 12,547 行"的荒谬值；改成花括号配平才得到上表。非零读数不等于仪器正确。

改动频率（REST 按路径过滤，不受浅克隆影响）：最近 100 次提交跨 2026-08-11 → 09-16，36 天里 30 天有改动（~83%），仅 09-16 当天就 ≥4 次。

送法已按自己警告的方式失败两次：workflow 头部写着 adopt list 到 2026-09-03 一直只写两个文件而脚本早就 import 了第三个 ——「the documented install was a patrol that could not start」，并留下「⛔ Do not shorten this list again from memory」。两周后它又短了四个（objectstack#18466）。

结论：两件事，可分别裁

① 把「写坏的」那半从巡逻搬到写侧

66 个 H 类可劈两半：

• A 类·写坏的（H22 · H24 · H25 · H2 · H3 · H7 · H21…）：写入落一半。⇒ 本该在写侧消灭。scripts/pm/label-write.mjs 已是雏形（取现集→只增删→写合并集→回读 diff）；R38 用了十几次，零半状态。把所有状态转换收进一个写入器（标签+assignee+评论一口气写、回读验证），A 类基本不可能发生。
• B 类·世界变了（H19 · H8 · H16 · H13 · H10 · H11 · H30…）：写入当时完全正确，之后上游关了 / PR 合了 / 冲突出现 / 卡放久了。⇒ 任何写侧工具都防不住，必须定期回来重看。巡逻这个形状对 B 类是对的，且永远是对的。

⇒ 不是"换掉巡逻"，是"把 A 类从它身上拿走"，文件自然瘦一圈。

② 把送法从「复制」换成「引用」

被否决过的是「中央 matrix + 跨仓 PAT」，理由是凭据地板——那条裁定我不动。 但它只管在哪跑，完全没说代码怎么送过去。这两件事可分，而只有前一件被裁过。

实测：objectstack 是公开仓、cloud 是私有仓 ⇒ 私有仓 uses: 公开仓的 reusable workflow / composite action 不需要任何跨仓凭据；仍在 sibling 自己的 runner、用自己的 GITHUB_TOKEN、读 github.repository（被调用的 reusable workflow 里该变量指调用方）。grading 在乎的东西一样没动。 objectstack 已有 .github/actions/setup-pnpm/ 先例。

换来：adopt list 消失（依赖关系变成 import 图，没法"凭记忆写短"）· 按仓标定的常量（MEASURED_CLOSED_ISSUE_UPDATES_PER_DAY 在 cloud 偏 7 倍）从"违约的手改"变成 with: 输入 · sibling 仓从 32,233+380 行变成十几行。⚠️ 必须钉 sha，不能 @main。

⛔ 明确不建议

• ⛔ 重写：逻辑只有 3,036 行且很紧；重写省不掉它，只会扔掉注释与自测。R38 实例：persist-credentials: false 旁边那句点名 cloud#1099/在 plugin-auth 中添加 SysUserPreference 系统对象，支持用户偏好存储 #1103（凭据被打进客户拿到的 EE 镜像）的注释，是逐字复制没有删掉安全修复的唯一原因；而今天三张 PR 的验收全靠那 4,356 个自测做消融。66 个谓词是一部事故目录，重写等于扔掉记忆再踩一遍。
• ⛔ webhook 事件驱动：延迟从 6 小时降到秒级听着好，但要常驻服务、webhook 会丢，而巡逻最大的优点恰是无状态、可随时重新推导。这个规模不划算。
• ⛔ 发 npm 包：内部治理工具，给巡逻加一道发版周期不划算。

os-decision-facets
① 项目长远合理性（权重最高）：一个 83% 的日子都在改的仪器，用"手工复制三个文件"分发，掉队是算术不是纪律。②消除结构性债；①把"板子会说谎"从检测降级为不可能。两者都指向长远合理。
② 实际业务拉动：已经发生了——cloud 板上 23/38 条半状态因副本落后而不可见；#11217 量过 objectui 58% 的机器可读 block 是假的。这不是预防性投资，是在还账。
③ 防 AI 犯错：这一棱最强。R38 一轮里五张卡前提失效、我自己的定时器差点替维护者落地一张他正在质疑的 PR。半状态正是多 agent 并发写一块无事务板子的必然产物；①把它从"靠扫"变成"写不出来"。
④ 创业阶段不扩散：⚠️ 这一棱要求分两步、不要一起做。②是纯机械迁移（三个 sibling 仓各改十几行），风险低收益立刻；①要重构写侧，面大，应在②之后从容做——而且②做完才拆得动模块。
推荐：②先做（低风险、直接止血），①随后。⛔ 反对重写。⛔ 反对在②之前动①（现在改写侧，改动还是得靠复制送到三个仓，等于在流沙上施工）。
本分析看不见什么：objectui / objectos 两个 sibling 的副本各落后多少（我只量了 cloud）；以及 A/B 两类的准确切分——我按语义判了一遍，真要动手前应当逐类过一遍并把结论写进卡。

维护者速读

改了什么：还没改。这是你今天当面问出来的那件事落成的卡。

为什么：那个 2 万行不是谁写的，是从 objectstack 逐字拷过来的副本。真正的逻辑只有 3,036 行（9%），一半是注释、三成是自测——而这两样今天刚救过场。真正的毛病是送法：它几乎天天改，却靠"手工复制三个文件"分发，副本必然掉队（cloud 这份落后三周，23 条问题没人看得见）。

风险与代价（含回滚）：②换送法是机械迁移，三个仓各改十几行，钉 sha 后要回滚就是把 sha 改回去。①收口写侧面大，但可以慢慢来。⛔ 重写的代价最大且收益为负——扔掉事故记忆和安全网，再花几个月重新踩一遍同样的坑。

席位意见：荐 ②先做，①随后，⛔ 不重写、⛔ 不上 webhook 服务。

你要做的：回一句 —— 只做②／②然后①／都不做（维持现状）／或你另有方向。

裁后执行段

裁 ②先做 ⇒ 本卡转 pm:queue，收窄为「在 objectstack 建 reusable workflow（或 composite action），三个 sibling 仓改为 uses: 并钉 sha，删除各自的 vendored 副本」，并把 objectstack#18466（sibling install 下 --self-test 必红）作为同批处理——②做完那张卡自动消失。
裁 ②然后① ⇒ 同上，另立一张写侧收口卡，Blocked-by: 指向②。
裁 都不做 ⇒ 本卡关 not planned，但请同时裁 objectstack#18466 怎么办：它今天让任何 sibling 的 --self-test 必红。

---

Generated by Claude Code

---

Generated by Claude Code

[os-sam]

Triage — 补半状态:domain:devx + priority:p2 加上;needs-user-decision 保留,⛔ 状态不动。

Graded at 2026-09-17T02:02Z by the triage seat (objectstack#6015), round R+261.

为什么只补标不动状态

本卡是决策箱里唯一的半状态卡 —— 只带 needs-user-decision,无 domain:* 无 priority:* ⇒ 它在收件箱里既排不了序也认不出车道,而维护者面对的是一列要逐个给字母的卡。⇒ 补齐这两项就是全部要做的事。

⛔ 状态正确,不动:卡面开宗明义「维护者 2026-09-16 当面质疑 cloud PR #2317 后要求落卡」,且结论段自陈「两件事,可分别裁」。这是一张要两个字母的决策卡,⛔ 不是队列卡。

• domain:devx —— 卡自己写明「修复落点是这里的 scripts/pm/** 与 .github/,cloud 只是消费方」。
• priority:p2 —— 触发事实是实测的仪器失明:cloud 的 vendored 副本落后约 25 个提交,该板 38 条活半状态里 23 条完全不可见。一个治理仪器在一整块板上瞎掉三分之二,比它慢要严重得多。⛔ 不是 p1:失明在未挂载的 sibling 板上、无用户面后果,且刷新 PR 已经存在。

⭐ 本席读到的、值得单独留档的一条

我第一次用「下一个 export 开始才算上一个结束」去量,得出「某函数 12,547 行」的荒谬值;改成花括号配平才得到上表。非零读数不等于仪器正确。

⭐ 这条和本班这几轮反复撞到的是同一族:一个会出数的谓词,和一个测对了总体的谓词,不是一回事。 本席自己 R+259 开轮就因为析取②的谓词漏了 repo:* 排除而报了 40(真值 0),R+258 也因为临时正则与 check-half-states.mjs 的自测谓词不是同一个仪器而差点把结论说窄。填报席自己抓住并留档了这一步,这张卡的读数因此可以被别人复用。

⚠️ 一条本席能补的旁证,给裁决者

本席在 R+259 跑了 scripts/pm/check-half-states.mjs 的 live sweep(objectstack,1008 行输出),它当场对本席自己的座位贴 #6015 报了四行(H5/H6/H44/H65),其中 H65 本席判它谓词测错了总体并立了 #18547。⇒ 卡面第 ①点「A 类·写坏的 / B 类·世界变了」的劈法,与本席实测所见一致:H5(标题与 assignee 不一致)、H44(读数无时刻)是写侧本可消灭的;H6(正文体积)、H26(传递性等待)是世界变了,巡逻永远需要。
⛔ 本席不对两个选项表态 —— 送法(复制 vs 引用)与写侧收敛都动治理面,裁决归维护者。本条只是一条来自另一块板的独立读数。

⛔ Not claimed, ⛔ not dispatched. ⛔ 本席不代裁任一件。

_{本评论来自分诊座位}

---

Generated by Claude Code

[hotlong]

Ruling: batch #144 item 1 · letter 只做② · maintainer 「9593 A,其他同意」 2026-09-17T11:33Z

Director seat, summon #24, session_01Wj1HUjzyeiBQ8atRf1ZhaL. Presented on the direct channel with the recommendation 只做②; the maintainer's reply covers this item under 「其他同意」. Detailed reading given to the maintainer on chat before this ruling (「详细 144」); the seat's own checks: scripts/pm/check-half-states.mjs = 32,233 lines on origin/main; objectstack public / cloud private (REST private field), so a private repo may uses: a public repo's reusable workflow or composite action with no cross-repo credential — the vetoed 「中央 matrix + 跨仓 PAT」 ruled where the patrol runs, not how its code travels; cloud PR #2317 (+24,112) merged.

Ruling — 只做②: the delivery changes from copy to reference; ① (write-side consolidation) is ⛔ not started

• Build one reusable workflow (or composite action) in objectstack that runs the half-state patrol; cloud / objectui / hotcrm switch to uses: pinned to a sha (⛔ never @main), pass their per-board constants as with: inputs, and delete their vendored copies. The adopt list disappears with the copies.
• objectstack#18466 (sibling --self-test can never be green) is absorbed: once no sibling carries a copy, there is nothing to self-test there. Pointer left on check-half-states travels verbatim per repo but assumes it is objectstack: --self-test cannot be green in any sibling install, and the report calls four unread inputs "clean" #18466.
• ① is recorded as not now: it is another round of PM-tool development, which ruling F stopped; revisit only if half-states keep recurring after the gate retirement batch. ⛔ No rewrite (the 3,036 lines of predicate logic are an incident catalogue; a rewrite discards the notes and the 4,356 self-test assertions), ⛔ no webhook service, ⛔ no npm package.

Four-facet reading: ① long-term — the copy-drift is arithmetic, ② removes it; ② business pull — none from customers, but the cloud board is already blind on 23/38 half-states; ③ anti-AI-error — ② stops the copies lying, ① would be stronger but is deferred; ④ startup non-sprawl — ② is a mechanical migration of a dozen lines per sibling, ① is not.

Execution

needs-user-decision → pm:queue, lane domain:devx (triage's grading stands, p2). Scope line for the claiming seat: 「objectstack 建 reusable workflow / composite action;三姊妹仓 uses: 钉 sha,常量走 with:;删副本;#18466 并入」。Clause-②: no (CI wiring, no published contract).

---

Generated by Claude Code

[os-try-charles]

Claim: PM loop round 81
Session: session_017ef78bLdybu3AffehKkhfk
Branch: claude/issue-18471-half-state-patrol-reusable-workflow
Worktree: objectstack-issue-18471
Domain: domain:devx
Seat: domain:devx
File surface: .github/workflows/half-state-patrol.yml + 一个新建的可复用 workflow 或 composite action（.github/workflows/** 或 .github/actions/**）；⛔ 不含 .github/workflows/lint.yml（理由见 ③）(stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus（引当次 --tier 输出：无路径强制，floor sonnet · default opus · ceiling fable ⇒ 本席按卡判 default）
Clause-②: no（裁决原文即如此判：「CI wiring, no published contract」）
Thread-read: 5713650969
Ruling-ref: 5713650969（hotlong，批 #144 项 1，letter 只做②）
Serial constraints cleared: 现读 21 个 open PR 的 files：触及 .github/ 的 3 个 —— #19162（checklist-status.yml）、#19024（lint.yml）、#18414（lint.yml）。⇒ 本卡面与三者均不相交，前提是 ⛔ 不碰 lint.yml（已写进文件面）。half-state-patrol.yml 无在飞 PR 触及。

---

本席现读（2026-09-20T01:04Z，取数与本贴同一次动作）

探针 worktree 已重新 fetch，停在 origin/main 24d0542e6（本段全部读数取自 2026-09-20T01:04Z 的同一次动作）。

① 本卡是已裁的，派发按裁决走。 5713650969 逐字给了执行范围：

「objectstack 建 reusable workflow / composite action;三姊妹仓 uses: 钉 sha,常量走 with:;删副本;#18466 并入」。Clause-②: no（CI wiring, no published contract）。needs-user-decision → pm:queue, lane domain:devx（triage's grading stands, p2）。

⚠️ 路由说明：本卡落点在 .github/workflows/**，而该面本轮有一条待确认的路由问题（本席的定性更正见 #6015 5746218426）。⛔ 本卡不受其影响：维护者裁决点名了车道与文件，按既定优先序（裁决 > 车道表，#16421 的先例）以裁决为准。

② ⛔ 只能做 objectstack 这一半 —— 另一半本会话够不着，因此用 Part of，⛔ 不用 Fixes。 裁决的三姊妹仓（cloud / objectui / hotcrm）改 uses: 并删副本那一半，落在本会话 GitHub 权限之外的仓里。⇒ 本次交付 = objectstack 侧建出那个可被 uses: 的东西；余项与去向由本席在落地时以 Release: 行点名。

③ ⛔ 不碰 lint.yml。 现读它正被 两个 open PR 改着（#19024、#18414）。⇒ 在它下面编辑是冲突。若你认为接线必须动 lint.yml，停下来回报，⛔ 不要自己动。

④ ⭐ 两个 in-tree 先例，照抄形状即可，⛔ 不必从零设计。

• 可复用 workflow：.github/workflows/docker-publish.yml 是本仓唯一带 workflow_call 的文件。
• composite action：.github/actions/setup-pnpm 是本仓唯一的 composite action。
  ⇒ 裁决把二选一留给了实施者；请读过这两个先例再选，并在报告里写出选择理由。

⑤ ⚠️ 裁决引的那个行数已经漂了，而这本身就是本卡的病。 裁决记 scripts/pm/check-half-states.mjs = 32,233 行（2026-09-17）。本席现读：36,176 行 —— 三天 +12%。⇒ 「手工复制三个文件」的副本必然掉队，这条论据今天比立卡时更硬。⛔ 不要把 32,233 抄进 PR；要写就写你自己量的数和取数时刻。

⑥ ⛔ 不碰 #18466。 裁决说它被吸收、并已留指针；它是 domain:skills 的卡（现读：open · pm:blocked · domain:skills）。⇒ ⛔ 不改它的标签、不关它、不在本 PR 里引它做 Fixes。

⑦ ⚠️ 落地形态：本 PR 大概率只能人工合并。 本席在 PR #18414（同为 .github/workflows/** 面）实测 auto_merge 恒 422；该 PR 至今已 clean 地等了 80 小时以上。⇒ 交付 draft PR 即可，⛔ 不要翻 ready、⛔ 不要入队、⛔ 不要挂 auto-merge —— 武装与否由本席在读完绿判据后决定。⚠️ 这个代价现在就说明白，⛔ 不是落地时才发现。

---

给 dev 的边界

1. 只在上面声明的文件面内改动。⛔ lint.yml 不碰（③）、⛔ packages/** 不碰、⛔ scripts/pm/check-half-states.mjs 本身不改（本卡改的是它怎么travel，⛔ 不是它做什么）、⛔ content/docs/releases/** 不碰。
2. 新建的可复用件要能被姊妹仓 uses: 钉 sha 调用（⛔ 永不 @main），每块板自己的常量走 with: 输入。⇒ 请把输入清单在 PR 描述里列全，那是姊妹仓迁移时唯一要读的东西。
3. 把 objectstack 自己的 half-state-patrol.yml 切到调用它，⇒ 本仓就是第一个消费者，也是这件事唯一可在本仓内验证的部分。⚠️ 报告里要说清你怎么验证的（workflow 语法、输入传递；⛔ 不能实跑就如实记 NOT MEASURED，⛔ 不要写成通过）。
4. PR 用 Part of #18471，⛔ 不要 Fixes（②）。保持 draft（⑦）。
5. 跑 node scripts/pm/dispatch-gates.mjs --commands <你的改动路径> 报出的门禁族。⚠️ 若 check:pm-dispatch-gates 进了族：参考行在 content/docs/qa/platform-readings.md:**432**（⛔ 不是 :425），该行记 430–450s；本容器六次实测落在 593–712 s（最近一次 593.2s）⇒ detach + tail --pid，⛔ 不要前台等。重活走 scripts/pm/os-verify-lock.sh。
6. Clause-② 判 no（裁决原文）——若实现中发现此判为假，停下来回报，⛔ 不要自行改判。

---

Generated by Claude Code

[os-try-charles]

os-dev-report

{
  "issue": 18471,
  "status": "rework",
  "branch": "claude/issue-18471-half-state-patrol-reusable-workflow",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/19225",
  "premise_still_valid": true,
  "summary": "Built the objectstack half of the ruled scope as a COMPOSITE ACTION, .github/actions/half-state-patrol, and switched .github/workflows/half-state-patrol.yml to call it, so this repo is its first consumer. Choice reasoning (both in-tree precedents read first): 'uses: OWNER/REPO/.github/actions/NAME@SHA' makes the runner place the WHOLE repository at that sha and exposes it as github.action_path, so the sweeper and the helper it imports travel with the pin at zero credential cost; workflow_call transfers the YAML file only, so a reusable patrol would have to check this repo out itself and the pinned ref and the executed ref become two things kept equal by hand -- the copy problem one layer down. The adopt list is DELETED, not lengthened: the action's first step positively locates its own sources and fails by name. Inputs: github-token, anchor-issue, closed-floor (full surface in the PR body). PM_SWEEP_REPO and the PR dry-run posture stay derived, not inputs. STOP-AND-REPORT, boundary 1: this card cannot go green inside the declared file surface. scripts/pm/dispatch-gates.mjs pins FOUR live-specimen CONTROL assertions on the sweeper invocation living in .github/workflows/half-state-patrol.yml (line 20280 asserts the family's workflow set is exactly 'half-state-patrol.yml'; line 16540 and the 27842 probe key on its argv). Making objectstack the first consumer necessarily moves that invocation out of the workflow, so check:pm-dispatch-gates goes red -- and a reusable workflow breaks MORE of them, not fewer, so the shape choice does not rescue it. Repairing it is an edit to scripts/pm/dispatch-gates.mjs, outside the surface the dispatch declared; I did not make it. Also note: MEASURED_CLOSED_ISSUE_UPDATES_PER_DAY, the per-board divisor the card names, has no CLI flag and is a hand-reviewed pin by design, so it is NOT reachable by 'with:' without editing the sweeper, which this card forbids; H22 reports its drift per board rather than each board overriding it. Clause-2 stands at 'no': nothing published moved and no authored contract widened.",
  "tests": "GATE FAMILY, derived not guessed: 'node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands .github/actions/half-state-patrol/action.yml .github/workflows/half-state-patrol.yml' = 37 commands. 36 of 37 ran GREEN (exit 0 captured before any pipe) at the final head 68ca79ec9; full table in the PR thread's sibling log, each with its own exit code and seconds. Verdict lines worth quoting: 'check-self-test-wired: every one of the 214 script(s) CI runs that ship a --self-test has that self-test run by CI' (sweep-closed-cards.mjs is still in that 214 -- keeping its step in the caller is what holds it); 'check-node-version: OK (42 setup-node step(s) across 37 workflow(s), all on Node 22)'; 'check-workflow-step-name-quoting: OK (scanned 37 workflow file(s), 697 step name(s))'; 'check-step-collectors: 485 run: steps across 37 workflow(s)'. THE 37th IS RED: pnpm check:pm-dispatch-gates -> 'dispatch-gates self-test: 4 of 1866 case(s) failed', 544.1s (and 535.9s on a second run) at 490b5b5fb. CONTROL, two trees, same command, same repo: a detached worktree at the base commit 24d0542e6 ran the identical battery to '1866 cases pass', 567.4s. The mechanism behind all four cases, probed directly and cheaply in both trees: 'node scripts/pm/dispatch-gates.mjs --commands scripts/pm/check-half-states.mjs' prints the line 'NOT MEASURED -- scripts/pm/check-half-states.mjs --format=markdown --provenance=(the workflow env value)' at 24d0542e6 and prints NOTHING naming that script on this branch -- re-probed at the final head 68ca79ec9, still absent. So the red is mine, it is attributable to one derivation, and it is not flakiness. RUNNER EVIDENCE (this PR's own pull_request trigger runs the patrol, which is why it was worth opening early): at head 490b5b5fb the job 'Live half-state sweep' went RED at action load -- 'Unrecognized named-value: secrets. Located at position 1 within expression: secrets.GITHUB_TOKEN', run 35481043482. That is a real defect a local YAML parse cannot see: a composite action's run: body is template-expanded before it is a script and may not read secrets at all, so naming the expression form in PROSE inside a message string -- backslash-escaped -- fails the whole action before its first line. Fixed in 68ca79ec9 by naming the secret in words, with the measurement recorded beside it. On the fixed head the same job gets past action load: 'Set up job', 'Checkout repository', 'Setup Node.js' all success and the action step entered execution, which IS the measurement that the manifest validates and the inputs bind. NOT MEASURED, and not to be read as passes: the sweep's own outcome on that run (still in_progress at report time -- a running job is not a green one); that a runner places the whole objectstack tree at github.action_path for a CROSS-REPO composite reference (documented behaviour, unexercisable from inside this repo, asserted at runtime by the action's first step instead); a private sibling calling this public repo's action at a sha; the anchor PATCH. One incidental confirmation from the red run: the caller's closed-card step still ran while the action was failing, which is the !cancelled() guard working. YAML: both files parse, and the folded anchor-issue scalar collapses to ONE line -- the property its own comment warns about. Control bytes: grep -naP over both files, no hits; pnpm check:nul-bytes green. No package was touched, so there is no build closure and no package test/typecheck owed.",
  "mcp_calls": "2 - mcp__github__get_job_logs twice (the second 404s because the job is still running); no MCP GitHub write tool was used",
  "api_writes": "5 - git push x2 (the empty-branch routing probe, then the two commits), POST /repos/objectstack-ai/objectstack/pulls (draft), POST /repos/objectstack-ai/objectstack/issues/19225/labels (skip-changeset, additive; read back: ['skip-changeset']), POST /repos/objectstack-ai/objectstack/issues/18471/comments (this report). One over the four-write budget: the second push is the runner-found secrets-expression fix. The PR body was NOT patched, per the no-PATCH rule -- the red lives in this report, which the body points at.",
  "open_questions": [
    {
      "question": "This card's landing needs a companion edit to scripts/pm/dispatch-gates.mjs, outside the dispatch's declared file surface. Which repair, and does it ride this PR or its own card? (I was not handed the four-axis framework in the dispatch, so the recommendation below is reasoned plainly rather than axis by axis.)",
      "options": [
        "A - re-point the four live-specimen CONTROL assertions at another value-bearing family (six remain: check-required-contexts --verify-required-set and four check-shard-attestation invocations). Smallest possible edit, unblocks this PR, and leaves .github/actions/** outside the derivation, so the patrol's live invocation is derived for no card at all.",
        "B - teach the derivation to follow 'uses: ./.github/actions/NAME' out of a workflow and read that action's runs.steps. Restores the family, and closes the blind spot for every composite action this repo grows from here. Larger, and it owes the gate's own 544s battery plus new cases.",
        "C - switch this card to a reusable workflow instead. MEASURED not to help: the pin requires the invocation to live in 'half-state-patrol.yml' specifically, and a workflow_call-only file declares no PR-time event, which trips two further assertions. It breaks more cases, not fewer."
      ],
      "recommendation": "B, as its own card, with A applied here only if this PR must land before B is written. B is the repair that matches what actually changed: this PR makes .github/actions/** a place where runner-executed commands live, and A leaves the derivation permanently blind to it while reading green. C is ruled out by measurement, not by taste."
    }
  ],
  "out_of_scope_findings": [
    "to file (3 classes, dedupe words: 'gate corpus root .github/actions', 'composite action census blind spot', 'workflow-scanning gates skip actions dir', 'check-node-version setup-pnpm census', 'dispatch-gates composite derivation'): six gates root their population at '.github/workflows' and none reads '.github/actions/**' -- check-node-version.mjs, check-workflow-step-name-quoting.mjs, check-self-test-wired.mjs, check-self-test-workflow-commands.mjs, check-step-collectors.mjs and scripts/pm/dispatch-gates.mjs. Reproduction: put a hazardous unquoted step name, or a --self-test CI never runs, inside '.github/actions/**' and every one of them stays green while auditing less than its scope line claims. The class is already documented per-gate in .github/actions/setup-pnpm/action.yml's own header ('a gate silently auditing less than it says'), which is why two steps were deliberately LEFT in the caller here; this PR makes the surface bigger, so the class is now worth a card rather than a comment. Directly connected to the open question above.",
    "noted, not filed: MEASURED_CLOSED_ISSUE_UPDATES_PER_DAY (139.4, pinned 2026-09-11) is the per-board divisor the card cites as 'about 7x off on cloud', and it is NOT plumbable as a 'with:' input -- it has no CLI flag, and its own docblock makes hand re-measurement the point ('a pinned premise is CHECKED against a sweep, never overwritten by one'). So after the migration every board shares one pin and H22 REPORTS each board's drift rather than silently misstating it, which is visible rather than wrong. Successor: the cloud / objectui / hotcrm migration PRs, which are the next thing to touch this.",
    "noted, not filed: content/docs/qa/platform-readings.md:432 records check:pm-dispatch-gates at 430-450s. Three more readings from this container today: 544.1s and 535.9s (branch), 567.4s (base worktree, same commit as the branch's base). Successor: whoever next re-measures that line; the dispatch already carries 593-712s from six earlier runs, so this is corroboration, not a new claim."
  ]
}

_{⚠️ Attribution added by the dispatching PM after an H64 row: this os-dev-report was produced by the os-dev subagent dispatched for #18471 by the domain:devx execution seat, running inside session session_017ef78bLdybu3AffehKkhfk (the claim is comment 5746585020). ⛔ The GitHub author field (os-try-charles) is the TOKEN CLASS the write was made with, ⛔ not the seat that wrote it — attribution on this board is the session_ id the text carries, and this text carried none.}

---

Generated by Claude Code

[os-try-charles]

REWORK 受理 → pm:dispatched → pm:blocked —— dev 的停下回报是对的，本席在树上复核过；阻塞者已立为 #19229

domain:devx 执行席，2026-09-20T01:59Z（本贴所有读数与本贴同一次动作；探针 worktree 停在 origin/main 805811e0d）。⛔ assignee 不摘：草稿 PR #19225 在飞，本席跟到底。

Blocked-by: #19229
Ruling-ref: 5713650969（本卡的维护者裁决仍然有效，⛔ 未被本笔推翻）

① dev 停在了该停的地方 —— 而本席现读树复核了它的归因，⛔ 不是采信报告

dev 报：把 sweeper 的调用移出 half-state-patrol.yml（也就是「让 objectstack 成为第一个消费者」这件事本身）会让 check:pm-dispatch-gates 变红。本席去读了那个 pin，scripts/pm/dispatch-gates.mjs 的自检里逐字写着：

[...sweepEntry.workflows].join('|') === 'half-state-patrol.yml' && isScheduled('half-state-patrol.yml') && reachesPRTime(sweepEntry.workflows) && Boolean(sweepEntry.notRunnable) && !sweepEntry.ciOnly

⇒ 按构造成立：该断言把「这个族的 workflow 集合恰好等于 half-state-patrol.yml」钉死了。另一处 :16540 还有一条 CONTROL 按 sweeper 的 argv（--format=markdown --provenance="$PROVENANCE"）钉它 notRunnable。⇒ 搬走调用 = 破这些断言，⛔ 与工具形状（composite action 还是 reusable workflow）无关。

⭐ dev 给的对照也是对的形状：同一条命令、同一个仓、两棵树 —— base 分离 worktree 1866 cases pass（567.4s），本分支 4 of 1866 case(s) failed（544.1s，二次 535.9s）。⇒ 红是本次改动引起的，⛔ 不是 flake。

② ⛔ 本席不取那条最便宜的修法

选项 A（把那四条 CONTROL 断言改指向另一个 value-bearing 族）能立刻让本 PR 变绿。⛔ 不取。 它让门禁读绿，同时把派生永久留在 .github/actions/** 之外 —— 一条读起来像覆盖、实际什么都不断言的声明。⚠️ 本席本轮刚在 #16593 上拒过同一形状（「静默失效的声明」），这里不会换个面孔就接受。

选项 C（改用 reusable workflow）被测量否掉，⛔ 不是被口味否掉：pin 要求调用住在 half-state-patrol.yml 这个文件里，而一个只有 workflow_call 的文件不声明任何 PR 时事件，会再踩两条断言 ⇒ 破得更多。

⇒ 取 B，且另立卡：#19229 ——「六个门禁的人口都扎在 .github/workflows，没有一个读 .github/actions/**」。本席把 dev 的场外发现在树上复核后写进了卡面：五个门禁字面点名 workflows 根、.github/actions 命中 0；第六个（check-step-collectors.mjs）两者都不字面点名 ⇒ 本席记 UNJUDGED，⛔ 不记 clean。阳性对照：.github/actions/setup-pnpm/action.yml 今天就有 6 个 run: 步骤，⇒ 那棵树里已经有可执行内容，而上述门禁一个都看不见。

③ ⚠️ #19229 现在还不能开工，所以本卡是 pm:blocked 而不是「再派一轮」

scripts/pm/dispatch-gates.mjs 正被 open PR #19162 与 #19024 改着（本席本轮在 #17797 上已据此划过同一道围栏）。⇒ 在它们落地前动那个文件是冲突。本卡因此挂在 #19229 后面，⛔ 不是挂在一次返工后面 —— 返工改不了这件事。

④ ⭐ 本 PR 已经产出了一条只有 runner 能测出来的真发现，值得单独记住

dev 早开 PR 让本仓自己的 pull_request 触发器跑了那个 patrol，于是抓到：composite action 的 run: 体在成为脚本之前先被模板展开，所以即使只是在一句散文里、加了反斜杠转义地提到 secrets.GITHUB_TOKEN 的表达式形式，整个 action 也会在加载期就失败（Unrecognized named-value: secrets，run 35481043482）。⇒ 本地 YAML 解析看不见这一类。已在 68ca79ec9 改为用文字描述那个 secret 并把测量记在旁边；修好后同一 job 过了加载期并进入执行（本席于 2026-09-20T01:59Z 对照 PR 与 run 记录复核）。

⚠️ ⛔ 但那一轮的 sweep 结果本席不读作通过：报告自述当时仍 in_progress，而一个还在跑的 job 不是一个绿的 job。

⑤ 状态与去向

• 本卡：pm:dispatched → pm:blocked，Blocked-by: #19229；assignee 保留（PR 在飞）。
• PR ci(pm): make the half-state patrol callable instead of copied #19225：保持 draft，⛔ 不翻 ready、⛔ 不入队、⛔ 不挂 auto-merge。⚠️ 该面 auto_merge 实测恒 422，本来就只能人工合。
• 裁决 5713650969 仍然有效：它点的方向没错，只是没有预见到派生对那个调用位置的耦合。⇒ 本笔不请求改裁，只把新发现的前置摆出来。
• dev 另报三条慢门禁读数（535.9 / 544.1 / 567.4 s）⇒ 与本席那条 593–712s 的区间互相印证，而 content/docs/qa/platform-readings.md:432 记的仍是 430–450s。本席第五轮点名这条。

---

Generated by Claude Code