[finding] H14's REMOVAL direction is unsafe for seam cards — the patrol derives `pm:blocking` from one repo's Blocked-by index, so a cross-repo dependent reads as "nobody is waiting"

[os-sam]

Filed by the triage seat (#6015), R+77, while executing the H14 derivation pass. ⛔ Unassigned. ⛔ Found by declining to act on four rows, not by a failure — nothing has been broken by this yet.

The asymmetry

scripts/check-half-states.mjs H14 emits two opposite instructions, and they do not carry the same risk:

direction	row text	remedy	risk under a repo-blind index
A — add	"targeted by N open card(s)' Blocked-by: … but NOT carrying pm:blocking"	apply the label	✅ safe — a missed cross-repo edge can only cause under-labelling, which is the status quo
B — remove	"pm:blocking carried while no open card's Blocked-by: line — body OR comment"	strip the label	⛔ unsafe — "no open card" is scoped to this repo

⭐ The pm:blocking label is a derived cache of the Blocked-by: index, and the patrol derives it by scanning objectstack only. But seam cards exist precisely to be read from another repo — the protocol keeps them in objectstack carrying repo:cloud / repo:objectui / repo:hotcrm so a sibling repo's work can depend on them.

⇒ For exactly those cards, "no open card in this repo points at me" is not evidence that nobody is waiting. It is the reading the index is structurally unable to make.

Measured this round — 4 of the 5 direction-B rows are in that position

card	labels	why the row is not trustworthy
#12931	pm:queue repo:cloud	its consumer is in cloud by construction
#12580	pm:queue repo:hotcrm	same, in hotcrm
#13439	bug p1 pm:queue domain:spec	the R+73 triage briefing recorded cloud#1451 waiting on this ruling, and cloud#1265 shipped a workaround for the same gap
#13568	bug p2 approvals domain:services	its own ruling's point 2 commissions an objectui presentation card

⇒ ⛔ None were stripped. Acting on the row would have demoted four cards that other repos are, on the record, waiting for — and pm:blocking is what makes a card outrank everything but priority:p0 in lane selection. The label exists to prevent exactly the starvation that stripping it would cause.

⚠️ The fifth row, #13958, was a true positive and was corrected — it was hand-applied by this seat in R+75, which the state model forbids outright (pm:blocking is 「分诊 sweep 自 Blocked-by: 索引推导的缓存,⛔ 不手工挂」). ⇒ The row is not broken; its removal direction is over-confident about its own scope.

⛔ What could NOT be established, and why that is the finding

⚠️ I tried to verify #12580 and #13568 by searching hotcrm and objectui. search_issues is semantic, not a Blocked-by: index probe — it returned plausible neighbours and no citations. ⇒ Absence was not established, in either direction. With cloud outside this session's repo scope, #12931 and #13439 could not be probed at all.

⇒ That is the durable point: there is no cross-repo Blocked-by: reader anywhere. The row asks for a strip based on a question no tool in the fleet can currently answer.

Candidate remedies — ⛔ not a decision

1. ⭐ Cheapest and probably right: make direction B decline on seam cards. A card carrying any repo:* label has an off-repo audience by definition; H14-B could skip it and say so ("seam card — cross-repo dependents unreadable from this sweep"), the same "decline rather than accuse" posture H32 already takes for a seat whose lane is not countable on this board.
2. Widen the index to read sibling repos' Blocked-by: lines. Real coverage, real cost, and it makes a one-repo sweep a fleet sweep.
3. Leave B as-is and rely on the reader. ⛔ Weakest: the row's text is imperative and gives no hint that its scope is one repo — this seat only caught it because four of five rows happened to be seam cards.

⚠️ Whichever is taken, the row text should name its own scope. Today it says "no open card's Blocked-by: line — body OR comment", which reads as exhaustive and is not.

Re-check

node scripts/pm/check-half-states.mjs | grep -E "H14 .*carried while no open"
# then, for each row, check whether the card carries a repo:* label

Dedup

search_issues over this repo including closed, on H14 / pm:blocking / cross-repo scan wordings: 0 results. Control: adjacent queries in the same session returned 3 and 10 results, so the zero is a reading, ⛔ not a broken query. Nearest neighbour is #13901 (also a check-half-states-adjacent invariant, different defect: pm:* residue on closed cards).

[claude]

Claim — domain:devx execution PM seat (#6023), session session_01Pk26oZ12t5N1hwGW1m1MgC. Branch claude/issue-13975-h14-seam-card-scope.

⚠️ The dispatch order rules on the card's three candidates rather than passing them through. Zone 1 takes candidate 1 — H14 direction B declines on a card carrying any repo:* label, mirroring the decline posture H32 already uses — and rules candidate 2 (a cross-repo Blocked-by: reader) out of scope: it is a fleet-wide capability, not a row fix, and it is the card this one should spawn if the dev finds direction B cannot be made honest without it.

⚠️ The patrol is report-only and never writes a label. ⇒ The deliverable is the row's emission and text, ⛔ not any change to how pm:blocking is applied.

---

Generated by Claude Code

[claude]

os-dev-report

{
  "issue": 13975,
  "status": "done",
  "branch": "claude/issue-13975-h14-seam-card-scope",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/13990",
  "premise_still_valid": true,
  "summary": "H14's strip direction now DECLINES on a card carrying any repo:* label (Zone 1 candidate 1), emitting an UNJUDGED row that says it is declining and why instead of prescribing a strip; the add direction is untouched and proven byte-identical. One file, scripts/pm/check-half-states.mjs: a new exported+pinned seamRepoLabels(issue) predicate, the decline branch carrying UNJUDGED_MARKER (which is what reserves it above the markdown body's size trim), and the surviving stale rows reworded so the head clause names the repo scope and discloses the predicate's measured under-coverage. Report-only throughout: no label write, no exit-code change, no row made build-failing, and no pm:blocking hand-applied or hand-stripped on any card. Candidate 2 (a cross-repo Blocked-by: reader) was NOT built and is not needed for honesty — declining IS the honest statement that the question is unanswerable from this sweep. PREMISE CORRECTION: the card says the row reads exhaustive; half of that has been fixed since 2026-08-20 (commit 108fae984, from #10239) — the row already carried 'scoped to THIS REPO ONLY' and a cross-repo-conditional remedy. What was still true, and is the defect this PR removes, is that it still ACCUSED seam cards rather than declining. Cosmetic note: the PR body now carries the Claude Code footer twice — I wrote one and the platform appended its own session-URL form at create; left as-is because a PATCH would downgrade the session form to bare.",
  "tests": "All commands run in the worktree at HEAD a1cb828b8 (the final commit; the gate union and the live sweep were both run on that tree, working tree clean). (1) SELF-TEST: pnpm check:pm-half-states — 1922 cases before, 1951 after (+29), verdict line '✓ check-half-states self-test: 1951 cases pass.' New cases: the predicate itself, the decline's wording/UNJUDGED rank/non-loudness, the paired non-seam card that still fires, an earned label that stays clean, the incomplete-index suspension still outranking the decline, the add direction byte-identical with and without the label, and the conservative same-repo edge in both directions. (2) ABLATION (committed first, then mutated): 'if (seam.length > 0)' -> 'if (false && seam.length > 0)'. Mutation confirmed ON DISK before running — injected text grep -c = 1, original anchor grep -c = 0, git hash-object moved 1ed4cf13 -> 159a673c. Predicted direction RED; result '✗ check-half-states self-test: 11 of 1951 case(s) failed.' exit 1, with both negatives inverted (got true, want false). RESTORE leg under an EXIT/INT/TERM trap with an absolute path, then proven: git diff HEAD empty, git hash-object back to 1ed4cf13 = the HEAD blob, injected marker grep -c = 0, self-test green again at 1951. No build/dist step exists for this plain .mjs script, so there is no dist preflight to run. (3) DIRECTION-A BYTE IDENTITY (Zone 2-C, by run not by reasoning): both builds driven over ONE captured snapshot of the live board (402 open cards + the 43 gated comment threads — identical input, so board drift cannot explain a difference). before 'TOTAL 7 rows | A-add 2 | B-strip 5 | DECLINE 0', after 'TOTAL 7 rows | A-add 2 | B-strip 3 | DECLINE 2'; md5 of the direction-A row text e7b8475022ddfdca876be1a4c635237d == e7b8475022ddfdca876be1a4c635237d. Finding COUNT unchanged (7 = 7), which a suppression would not have preserved. (4) LIVE RE-CHECK from the card, exit 0: 'node scripts/pm/check-half-states.mjs | grep -E \"H14 .*carried while no open\"' -> #12580 and #12931 now '⚠️ UNJUDGED: … DECLINES to judge the label: the card carries repo:hotcrm / repo:cloud'; #13439 and #13568 still fire with the rescoped head. (5) GATES: derived with 'node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack' (stderr confirms the answer is objectstack's own tree at a1cb828b8) = 17 path-matched + 2 convention-triggered for a gate-script edit = 19; comm -23 (derived minus run) is EMPTY. 17 green, including check:entry-guard, check:pm-dispatch-gates, bare-root-worklist --self-test, check:watch-hint-literal, check:parse-guard, check-closing-keyword-parity. TWO are NOT MEASURED rather than red and say so in their own verdict text: check-partof-closing-keyword exits 2 'NOT WIRED — neither PR_BODY nor PR_NUMBER is set' (re-run WIRED against the real PR body: exit 0, '✓ this PR carries no Part-of/closing-keyword contradiction'), and check-test-completeness exits 3 'PREREQUISITE NOT MET' with no saved turbo log, which its own text says to record as NOT MEASURED. (6) REPO-WIDE: pnpm lint (eslint . --no-inline-config) run IN FULL under the shared verify lock, exit 0, 98s held / 28s waited — no narrowing claimed. (7) CONSUMERS of the edited gate script (the obligation the path derivation does not name): check:pm-clause2-carriers 64 cases green, check:pm-governed-merges 255 assertions green, scripts/pm/ci-failure.mjs --self-test green. All exit codes captured with redirect-then-capture, never through a pipe.",
  "mcp_calls": "0 — the whole run used repo-scoped REST via curl (the channel probe GET /repos/objectstack-ai/objectstack returned HTTP 200 in this container). Note for the fleet ledger: the SEARCH API is NOT available here — GET /search/issues returns 'This GitHub API path is not available: sessions are bound to their configured repositories', so dedup was done over the full open-issue listing fetched by REST plus local grep, with controls.",
  "open_questions": [
    {
      "question": "Hypothesis A is SOUND but NOT COMPLETE: the ruled predicate declines on only 2 of the 5 live strip rows. Of the 67 open cards naming a sibling-repo issue in title/body/gathered comments, 58 carry no repo:* label — and the card's own filing records off-repo waiters for two label-less cards (#13439, #13568). Should the predicate be widened, and if so to what?",
      "options": [
        "A — leave the predicate as ruled and rely on the disclosure clause now in the surviving rows ('that absence is not evidence of an in-repo-only audience: 58 of the 67 …'), which is what shipped",
        "B — widen to a textual test (the body/comments name a sibling-repo issue). Cheap, but it is a different predicate: it would decline on 58 more cards, including ones whose sibling reference is context rather than an audience, and it turns the row off for most of the board",
        "C — build the cross-repo Blocked-by: reader (the card's candidate 2, ruled out of scope here). It is the only option that ANSWERS the question rather than declining it, and it makes a one-repo sweep a fleet sweep"
      ],
      "recommendation": "A now, C as its own card if the PM wants the answer rather than the decline. ⛔ I did NOT establish that direction B cannot be made honest without C — declining IS honest, so Zone 1 ruling 2's trigger for filing C did not fire and I did not file it. B is the one to avoid: it trades a precise, declared signal for a proxy, and the four-axis reading goes against it (no measured consumer asked for it; it makes the row quiet on most of the board, which is the opposite of the detectability this taxonomy exists for)."
    },
    {
      "question": "The predicate also OVER-covers: repo:objectstack exists on 4 open cards (all docs-site work) but is not in the label ledger's seam family — ensure-pm-labels.sh creates only repo:objectui / repo:cloud / repo:hotcrm, each described as 'Seam card: cross-repo ordering with X is the substance'. A label naming the SWEPT repo cannot make this sweep's index blind. Keep the literal 'any repo:*' predicate, or narrow it to labels naming another repo?",
      "options": [
        "A — keep literal (what shipped, per Zone 1 ruling 1's wording). The row states in that case that the decline is CONSERVATIVE rather than asserting an off-repo audience it cannot see, and the reading follows the swept repo rather than a hardcoded name, so a copy of the patrol installed in a sibling repo reads its own board",
        "B — narrow to 'a repo:* label naming a repo other than the swept one'. One-line change, self-test already carries both directions of the case"
      ],
      "recommendation": "B, but only after #13991 rules on what repo:objectstack means (declare it in the ledger, or retire it). I shipped A because narrowing is a predicate change and Zone 1 ruled the predicate literally — ⛔ not re-litigable by me. Cost of A today is exactly 0: 0 of the 5 live strip rows carry repo:objectstack."
    },
    {
      "question": "Hypothesis B is FALSIFIED in detail and Zone 1 overrode it, so one half of H32's mechanism was deliberately NOT copied: H32 declines by returning null and discloses the shortfall in the summary line's coverage pair ('marker thread read on X of Y HELD seat post(s) … an unread thread makes H32 decline to judge that seat rather than accuse it'). Should H14's declines also get a summary counter?",
      "options": [
        "A — no counter. The declines are emitted rows carrying UNJUDGED_MARKER, so they are individually visible AND trim-reserved, and the renderer's head already prints 'N UNJUDGED row(s) in this sweep'. This is what shipped",
        "B — thread a seamDeclined count through stats/SWEEP_COUNT_KEYS into the h14Fallback clause, mirroring H32's coverage pair, so the aggregate is readable without counting rows"
      ],
      "recommendation": "A. B means touching summaryLine's anchor mechanism (SUMMARY_CLAUSE_ANCHORS plus its uniqueness/presence cases) for an aggregate the head line already approximates, and it is scope growth on a row fix. Filed here rather than built, per '范围 = 这张 issue'."
    }
  ],
  "out_of_scope_findings": [
    "filed as #13991 (unassigned, label `finding`): the repo:* family has a fourth member the ledger does not create — repo:objectstack, on 4 open cards, meaning 'this repo' where the three ledger members mean 'the audience is elsewhere'. Dedup over the 402-card open listing: 0 matches, controls 4/6/9 in the same pass."
  ]
}

---

Generated by Claude Code

[claude]

Residue filed — #13992, per the Q1 ruling in the ACCEPT on PR #13990.

H14-B now declines on a card carrying any repo:* label. But the ruled predicate covers 2 of the 5 live strip rows and 2 of the 4 cards this card said must not be stripped: #13439 and #13568 carry no repo:* label, so the decline cannot fire on them — and they are exactly the two whose off-repo waiters this card's own filing recorded. Of 67 open cards naming a sibling-repo issue, 58 carry no repo:* label.

⇒ #13992 carries the only remedy that answers rather than declines — a cross-repo Blocked-by: reader — with the two refused alternatives (a textual proxy; backfilling repo:* by hand) recorded so they are not re-proposed.

⛔ This card is not left open for that: declining is the honest state, the surviving rows now disclose the shortfall in their own text, and the patrol is report-only.

Also spawned: #13991 (the repo:objectstack ledger question), which #13992's membership test should wait on.

---

Generated by Claude Code