chore(pm): close-cards.mjs — one named script for the three-step card closure

The three-step closure (comment · label · close) had no named spelling, so a
seat's batch ran as a bash loop and the session's write classifier judged it
act by act — non-deterministically, which is how a 90-card sweep stopped after
one card rather than risk a comment landing without its label write.

`scripts/pm/close-cards.mjs` is that spelling: it re-reads every card live,
applies the skip matrix, drives post-stamped (child process, its documented
flags) and label-write's exported `runLabelWrite`, closes with the reason and
reads the answer back, and STOPS at the first card left half-written, naming it
and which of the three writes landed. Stamping and the four-step label write are
imported, never re-implemented.

`.claude/settings.json` gains the four allow rules that let a seat run it and
its two helpers as typed, from the repo root.

Claude-Session: https://claude.ai/code/session_012GcsUbuqFGBibkEDMRC1eE
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.claude/settings.json

@@ -52,6 +52,10 @@
       "Bash(curl -sS -X PUT https://api.github.com/repos/objectstack-ai/objectstack/pulls/*/ccr/auto_merge *)",
       "Bash(node --use-env-proxy scripts/pm/post-stamped.mjs *)",
       "Bash(node --use-env-proxy scripts/pm/label-write.mjs *)",
+      "Bash(node scripts/pm/post-stamped.mjs *)",
+      "Bash(node scripts/pm/label-write.mjs *)",
+      "Bash(node scripts/pm/close-cards.mjs *)",
+      "Bash(node --use-env-proxy scripts/pm/close-cards.mjs *)",
       "Bash(curl -sS -X PATCH https://api.github.com/repos/objectstack-ai/objectstack/issues/* *)",
       "Bash(curl -sS -X PATCH https://api.github.com/repos/objectstack-ai/objectui/issues/* *)"
     ],

.github/workflows/lint.yml

@@ -1307,6 +1307,29 @@ jobs:
       - name: Label-write helper self-test
         run: pnpm check:pm-label-write
 
+      # Card-closure helper self-test (#19469) — same family and the same split
+      # as the two steps above, and it drives BOTH of them: `close-cards.mjs` is
+      # the three-step closure (comment · label · close) as one named command,
+      # so a seat's batch closure is one allow-listed prefix instead of a loop
+      # the session's write classifier judges act by act. The LIVE path posts
+      # comments, strips labels and closes cards, so it is emphatically not a
+      # thing CI runs against the board; the offline half is all CI can hold.
+      #
+      # What the self-test instruments is the set of rules a clean tree cannot
+      # exercise, every one of which is silent when it breaks: the skip matrix
+      # (not open · assigned · `pm:retriage` · a pm-state that is not EXACTLY
+      # the expected one · an open PR cross-referencing the card); that an
+      # unreadable card or timeline STOPS the run rather than being read as a
+      # "no"; that a 200 whose body does not read back `closed`, or reads back
+      # another `state_reason`, is not a close; and — the one this tool exists
+      # for — that a comment which lands whose label write then fails STOPS at
+      # that card, naming it and which of the three writes landed, instead of
+      # turning one half-state into a page of them. Weakening any of them leaves
+      # every ordinary invocation just as green, which is the shape
+      # `check:self-test-wired` requires this step for.
+      - name: Card-closure helper self-test
+        run: pnpm check:pm-close-cards
+
       # Board-snapshot archiver self-test (#17390) — same family and the same
       # split as every step around it. The LIVE run reads the whole board over
       # REST and commits the result to an orphan branch, so it is not a thing

package.json

@@ -88,6 +88,7 @@
     "check:pm-stale-finding": "node scripts/pm/sweep-stale-finding.mjs --self-test",
     "check:pm-post-stamped": "node scripts/pm/post-stamped.mjs --self-test",
     "check:pm-label-write": "node scripts/pm/label-write.mjs --self-test",
+    "check:pm-close-cards": "node scripts/pm/close-cards.mjs --self-test",
     "check:pm-board-snapshot": "node scripts/pm/board-snapshot.mjs --self-test",
     "check:pm-changeset-deadline-census": "node scripts/pm/changeset-deadline-census.mjs --self-test",
     "check:pm-governed-merges": "node scripts/pm/check-governed-merges.mjs --self-test",