fix(pm): scope pm:* label queries to open cards, re-judge the closed-residue census

[huangyiirene]

Fixes #13605

Reader-side audit of every pm:*-label issue query, plus the census-leg re-judgment,
under the maintainer ruling of 2026-08-31 (第 6 场总监席决裁批 #13), verbatim and
untranslated:

「13605 已关卡 为什么要清理。普查时不应该只看open的卡片吗，其他同意」

No bulk strip, no backfill, no reaper. The ~3,000 closed cards carrying pm:* stay as
they are; what makes them harmless is that every reader selecting by a pm:* label
scopes itself to open cards.

Item ① — the reader audit

Population: call sites in scripts/pm/**, and the patrol paths those scripts drive,
that query issues by pm:* labels. Enumerated by reading every API call site in the
tree, not by sampling.

Result: 2 sites in population. Both were already open-scoped or deliberately closed-scoped —
zero sites were missing an open-state filter. The audit's value is therefore a pin, not a
repair: the scoping that the whole ruling rests on was an incidental detail of one inline
template, and nothing would have gone red if a later edit had widened it.

site	queries pm:* how	open filter before	verdict / fix
listIssues() — check-half-states.mjs	GET /issues with state=open plus labels=LABEL, one page-loop per state label (7 labels)	state=open present	compliant — extracted to pmLabelListingPath(), now the single place the scoping is asserted, with the ruling cited in its docblock and 11 self-test pins behind it
censusClosedPmResidue() — check-half-states.mjs	GET /issues with state=closed plus labels=LABEL, fully paginated, one pass per residue label	state=closed by design	re-judged — see item ②

Out of population — measured, not assumed

Closed-card readers that do not select by a pm:* label (they read residue locally
from rows fetched for another reason):

site	why it is out
listRecentlyClosedIssues() (drives H22)	no label filter; a 3-day closure window, residue read from the returned rows
census control query	GET /issues with state=closed, deliberately unfiltered — it is the instrument control

Issue/PR queries that never touch a pm:* label: listAllOpenIssues() (already
open-scoped), listOpenPrs(), listRecentlyMergedPrs(), the per-card comment fetch, PR
detail, PR files, the Blocked-by: target read, the repo probe, the commit window and the
issue-event window — all by number or unfiltered.

Scripts that query no issues at all by pm:* label, so they are out of population
entirely — this is the "measure, don't assume" half the dispatch asked for:

• ci-failure.mjs — check-runs, annotations, action runs/jobs, one PR by number.
• check-governed-merges.mjs — one PR by number.
• check-governed-queue-guard.mjs — one PR's reviews and head.
• check-label-desc-cap.mjs — its two pm: strings are self-test fixture text inside a
  gh label create line; it makes no API call.
• dispatch-gates.mjs — no API calls; its only pm: grep hit is pnpm: inside a
  variable name, not a label.
• ensure-pm-labels.sh — creates and reconciles label objects; never queries issues.
• bare-root-worklist.mjs, check-dispatch-gates.mjs, check-governed-prose.mjs,
  check-skill-id-lint.mjs, check-skill-line-ratchet.mjs, git-history.mjs,
  release-rehearsal-clone.mjs, os-verify-lock.sh, os-regen-merge.sh — no API calls.
• .github/workflows/half-state-patrol.yml, the only patrol path these scripts drive —
  its sole API write is an anchor-issue update; it runs no label query.

Item ② — the census leg, re-judged

renderClosedResidueCensus went from a block (bold heading, a row per label, a nested row
per lane, a page-cap alarm, a control-failure alarm, a contradictory-pair roster, and two
closing warnings) to one informational line, italic in markdown — the styling the
healthy rate premise already uses, deliberately not the bold heading a finding block wears.

Closed-card `pm:*` residue (H39 census, informational): pm:dispatched 2064, pm:queue 846,
pm:blocking 27, pm:blocked 18, pm:on-hold 13, pm:awaiting-maintainer 2, oldest closed
2026-08-02; 555 carrying both `pm:queue` and `pm:dispatched`. Archive, not state — no
cleanup is owed and none is planned (ruled 2026-08-31, 批 #13); readers scope `pm:*`
queries to open cards.

What was kept and why:

• The gathering is unchanged. The figures are the informational line's content, and the
  cost lands on the patrol workflow's own runner token (15,000/h core), not on the shared
  agent pool the 2026-08-16 ruling protects.
• The #4690 instrument caveats survive, demoted to a parenthesis. A page cap is still
  not a count and an empty control still means "not read" — that is about the instrument,
  and the ruling was about the board. censusIsCountable is untouched. The two caveats
  are now mutually exclusive on the line, and a pin refuses the naive fallback that would
  let a capped census also blame the control.
• One bug found while collapsing it: the old "oldest closed" reading took a bare find
  over rows — the first row carrying an oldest — and rows is sorted by size, so it
  reported the oldest closure of the largest label while reading as the population's
  floor. Now a global minimum, with a pin whose fixture puts the real floor on the smaller
  label.

Why H22 was left alone — stated because it is the one judgment call here

H22 also reports pm:* residue on closed cards, and as finding rows. It is deliberately
not changed, and the PM should confirm this reading:

• Item ② of the ruling names one leg: the census leg (H39). H22 predates it and is a
  different shape.
• Item ③ keeps close-time hygiene as the convention. H22, bounded to a 3-day closure
  window, is the only mechanism that observes that convention; deleting it would silently
  retire a rule the ruling explicitly retained.
• H22 never asks for the backlog cleanup that was refused — its window covers residue
  produced now, while the paired write is still a live duty someone remembers.

If the PM reads 「普查时不应该只看open的卡片吗」 as reaching H22 too, that is a one-line
change to h22ClosedCardPmResidue and belongs on its own card rather than smuggled in here.

Verification

Authored by Claude Code session session_01EnE7G31tqbxN1rqpQmzurT (durable attribution
copy — a body edit rewrites the footer below).

• node scripts/pm/check-half-states.mjs --self-test — before:
  ✓ check-half-states self-test: 1791 cases pass. (exit 0). After:
  ✓ check-half-states self-test: 1826 cases pass. (exit 0). 35 new pins.
• Reverse verification, three ablations, each committed first, each confirmed on disk by
  counting the injected and the original spelling, each restored and the restore proved by
  git hash-object equality against the HEAD blob:
  • the open-state scoping widened to all states in pmLabelListingPath — 8 pins red, exit 1.
  • an alarm glyph injected into the census line — 2 pins red, exit 1.
  • global-oldest reverted to the bare find — 2 pins red, exit 1.
• Gate families derived from the real diff via node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (exit 0; it reads the merge-base change set itself). 17 derived
  plus 2 convention-triggered for a gate-script edit. 16 green; three are not readings and
  say so themselves: check-partof-closing-keyword exits 2 NOT WIRED without a PR body in the
  environment (its pnpm check:partof-closing-keyword spelling is green, and this body was
  checked against it separately), check-test-completeness exits 3 and instructs the local
  family runner to record NOT MEASURED, and the live check-half-states sweep exits 3
  PREREQUISITE NOT MET because this container's session gate refuses repo-scoped reads.
• pnpm lint (repo-wide eslint . --no-inline-config, no narrowing) — exit 0, 103s.
• node scripts/check-nul-bytes.mjs — OK, 7,574 text files, no raw control bytes.
• Union re-run on the final commit 54f5b104 — the gate families above, pnpm lint and the
  self-test all ran on that tree, which is this PR head.

No changeset: the diff is scripts/pm/** only, which publishes from no package — the
skip-changeset closed list. The label is applied on this PR.

Refs: #13526 and PR #13601 (the census leg being re-judged) · #13597.

Generated by Claude Code