Promote H21 (negation-window closing-keyword detection) from report-only patrol row to the blocking PR gate, once the patrol baseline is long enough

[huangyiirene]

Follow-up filed by the skills seat (session_01ApyDuQY2fkunMCqXiqvBhR) on ACCEPTing the H21 report-only row (PR #10939, card #10392) — the stage-2 promotion decision, tracked as a card per the landing seat's follow-up duty.

What

Wire h21NegatedClosingKeyword (exported from scripts/pm/check-half-states.mjs) into the blocking PR gate surface — scripts/check-partof-closing-keyword.mjs + .github/workflows/partof-closing-keyword-guard.yml — with its own self-test cases and its own remedy string. The H21 predicate itself needs no change; the work is the gate wiring, the gate's self-test, and the remedy text.

Why hold, and the exit

The stage-1 measurement behind the row is clean (0 false positives in 301 closing-keyword matches over the 300 most recently merged PR bodies; window sensitivity measured; per-marker independence measured — full numbers in PR #10939's header comment and the #10392 report). But that is a 2.2-day window of one repo's register, and a wrong blocking gate hard-reds unrelated PRs and teaches authors to route around it, while a wrong patrol row costs one report line. The promotion should ride a longer baseline, not a moment.

Restart-when: after 2026-09-04, the half-state patrol runs since H21 landed report 0 H21 false positives (a flagged PR whose sentence was in fact a correct close counts as one; the specimen class does not)

Constraints for the eventual dispatch

• The dispatch surface is the GATE side only; ⛔ do not restructure H21 or re-run its corpus inside check-half-states.mjs beyond what wiring requires.
• The remedy string must keep the safe rewordings and the backtick advice — backticks are valid on the PR-body surface this gate reads (unlike the commit-message surface, which is [finding] The closing-keyword guards read PR BODIES only — a commit message is a second surface GitHub closes cards from, and nothing in the repo checks it #10942's separate card).
• If any H21 false positive appears in the patrol before the restart date, this card's premise is re-triaged, not silently discharged.

Ref: #10392 (the commissioned two-stage order) · PR #10939 (the row and its measurements) · #10942 (the commit-message surface, deliberately not this card)

[claude]

Claim: PM loop round 9 — flight U, one pure-code card, premise-first: the card's restart condition (after 2026-09-04, zero H21 false positives in the half-state patrol since the report-only row landed) is measured first, from the live sweep's H21 row and the recorded sweep runs, with every flagged PR read and classified; only if it holds is h21NegatedClosingKeyword wired into the blocking gate scripts/check-partof-closing-keyword.mjs with its own self-test cases and its own remedy string. If a false positive exists, the flight ends with the measurement and the card returns to the seat for re-triage. Graded at claim: tooling, priority:p3 (the card carried no priority).
Session: session_019RfFHiRCSs3JXLK4cwcfox
Branch: claude/issue-10947-h21-gate-promotion
Worktree: objectstack-issue-10947
Domain: domain:skills
File surface: scripts/check-partof-closing-keyword.mjs and its self-test; scripts/pm/check-half-states.mjs only if the wiring needs an export it lacks — ⛔ no change to H21's predicate or its corpus; .github/workflows/partof-closing-keyword-guard.yml only if the gate needs an input the workflow does not pass today.
Container & model: S, mode:subagent, opus — dispatch-gates.mjs --tier: no path-derived mandate on either path.
Clause-②: no — a repo PR gate gains a refusal class; the published contract surface does not move.
Serial: no open lane PR touches either file (PR #16406 and PR #16423 on check-half-states.mjs are merged). Pure code ⇒ in-seat review, then the seat flips ready and arms SQUASH auto-merge; skip-changeset. The PR carries Fixes #10947.

---

Generated by Claude Code

[claude]

os-dev-report

{
  "issue": 10947,
  "status": "done",
  "branch": "claude/issue-10947-h21-gate-promotion",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/16444",
  "premise_still_valid": true,
  "summary": "Claim verified before anything else: the newest Claim: comment (5563508513, 00:51Z) names this branch. PREMISE MEASURED FIRST, and it HOLDS: zero H21 false positives, where the card's own definition of one is a flagged PR whose sentence was in fact a correct close. Only then was anything edited. GATE SIDE ONLY: h21NegatedClosingKeyword is imported into scripts/check-partof-closing-keyword.mjs as RULE 3, a new finding kind under the EXISTING contradiction exit (a body that negates the relation it also states is the class this gate already refuses, so no new exit code). It has its own remedy string, which keeps the three safe rewordings and the backtick advice and adds that backticks are NOT the escape on the commit-message surface (that is RULE 2's). The predicate already exported the symbol, so scripts/pm/check-half-states.mjs is BYTE-IDENTICAL to origin/main -- not merely 'unchanged in spirit', zero lines in the diff -- and .github/workflows/partof-closing-keyword-guard.yml is untouched because the gate needs no input the workflow does not already pass. Disjointness is free: a number already declared Part of is RULE 1's row and the predicate skips it, so one card number can never be reported by two rules. The clean verdict line now says RULE 3 was judged too, so a run that judged one surface cannot present itself as one that judged all. THE FINDING THAT MATTERS MOST: the premise sweep turned up a SECOND SPECIMEN of the original incident, after the report-only row landed. PR #11746's body said an adjacent finding had been filed rather than repaired, bound a closing keyword to that card in the same sentence, and card #11745 went to completed TWO SECONDS after the merge (15:33:58Z merge, 15:34:00Z close, 2026-08-24). #11745 is labelled bug + domain:spec, still carries pm:queue, and describes a real unfixed defect; it has read as finished ever since. The patrol could not have caught it: that PR was open for 41 minutes, entirely between the 13:56Z and 19:48Z sweeps. A six-hourly report-only row is STRUCTURALLY blind to a short-lived PR and no schedule fixes that -- which is the measured case for the promotion this card asked for, rather than an argument for it. NO STATE WAS TOUCHED on #11745: a state this flight did not set belongs to another actor, so it is reported for the seat to judge. PR #16444 is DRAFT, skip-changeset applied additively and read back, CI fully converged GREEN (34 check runs, 23 success / 11 skipped / 0 failures). Not flipped ready, not enqueued, not approved -- the seat does that at ACCEPT.",
  "tests": "All local verification at final commit 90c2b5dacf (BASE ac76425f0b); every exit captured BEFORE any pipe (redirect-then-capture), every verdict quoted from the gate's own line. (1) PREMISE, measured two ways as ruled. (a) LIVE SWEEP now: node scripts/pm/check-half-states.mjs read-only against objectstack-ai/objectstack (REST probe 200 first) -> EXIT=0, 306 half-states over 439 pm-labelled cards and 30 open PRs, and ZERO H21 rows. The newest recorded run agrees in the form that names the family explicitly: the patrol anchor body written by run 34055667490 (swept 2026-09-06T19:46:09Z) lists H21 among the families that 'were EVALUATED and found nothing'. (b) RECORDED RUNS: 64 Live half-state sweep runs on main since PR #10939 merged 2026-08-21T20:09:43Z -- oldest 2026-08-22T02:05:12Z, newest 2026-09-06T19:41:09Z, every one completed/success. THEIR LOGS COULD NOT BE READ, and the reason is a ROUTE REFUSAL, not expiry: the run-logs endpoint answers 302 to results-receiver.actions.githubusercontent.com, which the egress proxy denies (connect_rejected, organization policy) -- measured identically on the oldest, middle and newest run. GraphQL, which would serve the anchor's body edit history (the archive the patrol workflow itself names as the archive), answers 403 to this seat. Two channels shut, neither expiry, and NOTHING is padded with recall. SUBSTITUTE, STATED AS ONE and strictly WIDER than what it replaces: H21 reads the OPEN PR listing at sweep time, so anything those 64 runs could have flagged was a PR open at some point in the window. That population was enumerated in full via repo-scoped REST -- every currently open PR plus every PR closed with activity after the row landed -- 2,285 PRs, 2,285 non-empty bodies, created_at 2026-08-20T13:02:51Z..2026-09-07T00:27:44Z, each body run through the SHIPPED predicate imported from the worktree rather than a re-implementation. H21 FLAGS 3, FALSE POSITIVES 0. Classified: PR #11746, sentence 'One adjacent finding filed rather than fixed: [card 11745]' = SPECIMEN, true positive, and it cost card #11745 (see summary). PR #14524, sentence '...is walked deliberately, not as an afterthought: a scan omitting it reports 0 cycles on the pre-fix [card 13513]' = TRUE NEGATION -- not a close at all, correct or otherwise (that PR closes #14195, and #13513 had been closed by a human a day earlier). PR #15738, sentence 'The person still cannot register a login, because per the 2026-09-02 ruling recorded on closed [card 14349]' = TRUE NEGATION -- a reference to a card already closed not_planned three days before. Neither of the latter two is a correct close that H21 refused, so neither is a false positive under the card's definition; both bind a keyword to a card the sentence merely refers to, and in both the named card was already closed at merge time, so the parser had nothing left to close -- luck, not correctness, and one pair of backticks is the remedy. (2) SELF-TEST: 66 -> 83 cases. 17 new cases in one registered battery, roster floor 15 -> 16. pnpm check:partof-closing-keyword -> EXIT=0, 'check-partof-closing-keyword self-test: 83 cases pass.' (3) ABLATION, committed FIRST so the restore leg had an implementation to point at. The one call was replaced with a constant. MUTATION PROVED ON DISK BEFORE THE RUN, not by the editor's exit code: removed-text grep 1 -> 0 occurrences, injected-text grep 1, blob 03724543a3 -> feedd0bb22. Script carried trap restore EXIT INT TERM against an ABSOLUTE path. ABLATED -> EXIT=1, 'check-partof-closing-keyword self-test: 9 of 83 case(s) failed' -- exactly the predicted set: both specimens, the no-forked-rule check, and all six remedy pins. RESTORED via git checkout HEAD -- <abs path> -> blob back to 03724543a3, git diff HEAD EMPTY for that path, injected-text grep 0 / call grep 1, then EXIT=0, 83 cases pass. Restore proved by STATE, never by an exit code. This gate has no build step, so no dist preflight applies; there is no stale artifact to fool the run. (4) AGAINST REAL PR BODIES, both from the H21 reading: PR #11746 (flagged, real body) -> EXIT=1 and the output names the card, quotes the sentence and offers the three rewordings plus the backtick escape; PR #16429 (real control) -> EXIT=0. Had this gate existed on 2026-08-24, PR #11746 would have gone red and card #11745 would still be open. (5) THIS PR'S OWN BODY was run through the new gate before it was posted -> EXIT=0. Every specimen sentence in the body is inside backticks or a fence, so the body cannot re-close any of the cards it discusses. (6) GATE UNION derived AFTER the final commit: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, no path arguments, change set re-derived from the merge base -> 1 path, 31 commands. ALL 31 RUN, ALL EXIT 0. Reconciled: --ran -> EXIT=0, 'dispatch-gates --ran: 31 derived famil(ies) accounted for -- 31 run, 0 NOT-MEASURED.' (7) RULED EXTRAS: node scripts/pm/check-half-states.mjs --self-test -> EXIT=0, 'check-half-states self-test: 2636 cases pass.' (2636 UNCHANGED; the file is not touched at all). pnpm check:pm-clause2-carriers -> EXIT=0, 'check-clause2-carriers self-test: 190 cases pass'. node scripts/pm/check-governed-merges.mjs --test on the FINAL file list -> EXIT=0, 'NOT governed -- ordinary queue landing applies to a PR with exactly this file list.' pnpm check:nul-bytes -> EXIT=0, plus a direct control-byte scan of the edited file, grep_exit=1, no matches. (8) WHOLE-REPO pnpm lint (eslint . --no-inline-config) through scripts/pm/os-verify-lock.sh, slot issue-10947, acquired once and held: 'VERDICT command-exit 0 - held the lock 86s - waited 0s'. No narrowing was needed, so none is claimed. Shared-box seconds, per the wrapper's own caveat. (9) FIRST MISSTEP, CORRECTED AND RECORDED: my first two attempts at the extra gates used wrong script paths and died MODULE_NOT_FOUND (exit 1). That is not a red gate -- it never reached a gate body -- so it was re-run under the real pnpm check:* names above rather than written down as a failed measurement. (10) CI ON THE HEAD, polled in the FOREGROUND to convergence as this card's dispatch required: 34 check runs on 90c2b5dacf -- 23 success, 11 skipped, 0 failures, 0 incomplete. (11) DELIVERY READ-BACKS: PR body read back in full -- prose byte-identical to what was sent, the only delta being the platform's own appended attribution footer (the documented create-time behaviour), so the sanitizer ate nothing. skip-changeset written through the ADDITIVE labels endpoint and confirmed by COMPARISON read-back (before [], target skip-changeset, after [skip-changeset], union minus read-back EMPTY = nothing stripped); re-read after CI, still present alongside the size labeler's size/m. PR still draft, mergeable_state clean. Worktree removed WITHOUT --force, which is itself the proof nothing was left uncommitted.",
  "mcp_calls": "2 - two mcp__github__issue_read calls (cards 11745 and 14349), used to try to settle the hyphen question below; everything else went through repo-scoped REST (probe 200 first) and git. GraphQL was attempted once for the anchor's edit history and answered 403.",
  "open_questions": [
    {
      "question": "H21's word boundary admits a closing keyword that is the TAIL OF A HYPHENATED COMPOUND. In PR #14524 the match sits inside 'pre-fix', because a hyphen is a word boundary. Whether GitHub's own parser fires there could NOT be measured, so it is unknown whether H21 is marginally wider than the parser it models. Now that the rule is blocking, that width is a hard red rather than a patrol line.",
      "options": [
        "A. Leave the predicate exactly as it is and keep this as a watched unknown. The shape occurs ONCE in 2,285 bodies, the remedy is one pair of backticks, and this repo's own doctrine already treats a closing keyword sitting beside a card number as a defect whether or not the card happens to be open.",
        "B. Commission a direct measurement first -- open a throwaway PR whose body carries a hyphen-prefixed keyword bound to a deliberately OPEN throwaway card, read whether the closing link appears, then rule. This is the same shape as the measurement that settled the fence and inline-span arms, and it is the only thing that can answer it.",
        "C. Narrow the predicate so a keyword preceded by a hyphen does not match. Costs a change to H21 itself, which THIS card's ruling puts out of surface, and would be a narrowing taken on a guess about GitHub rather than on a reading of it."
      ],
      "recommendation": "A now, B as its own small card. Real business pull: near zero either way -- one body in 2,285, and its named card was already closed, so nobody has yet been taxed by this. Long-term soundness: B is the only option that replaces a guess with a reading, and this file's whole register is measured-not-assumed (the fence and inline-span arms are in the self-test precisely because they were read live); C would write a narrowing into the predicate on an unmeasured premise, which is the workaround shape. AI-error resistance: A and B keep the loud refusal; C is the tolerance direction, and a quiet miss on this surface silently closes a card, which is exactly the harm class. Startup-stage focus: A costs nothing today, C spends a predicate change plus a corpus re-run on a shape nobody has hit, and B is one throwaway PR. C is not recommended at any confidence level -- it is out of this card's surface by ruling AND it is the only option that could make the gate quieter on a real defect."
    },
    {
      "question": "The dispatch's phrase 'the specimen class is NOT refused' admits two readings, and I could not tell them apart from the text: (i) the near-miss REGISTER -- bodies in the specimen's deliberate-non-closure wording that bind no keyword to a number -- must stay green; or (ii) a number already declared Part of is RULE 1's row and must not be double-reported by RULE 3.",
      "options": [
        "A. Pin both readings, which is what shipped: the register bodies are green cases, AND the disjointness is its own case (the predicate returns null on a Part-of number while the body is still refused by RULE 1, so the disjointness costs no coverage).",
        "B. Pick one reading and pin only it.",
        "C. Stop and ask before writing any case."
      ],
      "recommendation": "A, which is what shipped. Both readings are true statements about the gate, both are cheap to pin, and neither can be the wrong thing to assert -- so the ambiguity costs two extra cases rather than a round trip, and C would have stopped a flight over a question that resolves itself by covering both. Flagged here only so the seat can confirm the reading was not narrowed."
    }
  ],
  "out_of_scope_findings": [
    "noted, not filed: card #11745 currently reads as finished and is not. It went to completed two seconds after PR #11746 merged, by the very auto-close H21 exists to catch, while still carrying bug, domain:spec and pm:queue, and it describes a real unfixed defect (translateFlow walks flow.nodes flat, so a screen node inside an ADR-0031 region is never overlaid). It is now outside every patrol window -- H22's closed-card horizon is 3 days and this closed 2026-08-24 -- so nothing on the board will surface it again on its own. Under the finding admission threshold this is not a new card: the card already exists and only its STATE is wrong, and a state this flight did not set belongs to another actor. Recommend the seat reopen it. NO state, label or assignee was touched here.",
    "noted, not filed: the hyphenated-compound word boundary described in the first open question. Not filed as a card because it does not meet the admission threshold -- it is not a reproducible defect (the verdict that would make it one could not be measured), not a contract violation, and not a metadata-authoring trap. It rides this PR's acceptance notes instead, where the seat can rule on whether the throwaway-PR measurement is worth commissioning."
  ]
}

---

Generated by Claude Code