ci(timings): give the test-timing parser self-test teeth in lint.yml, not continue-on-error in ci.yml - #18096

…tack-ai#18243)

Fixes objectstack-ai#18229

## What changed

`scripts/pm/check-half-states.mjs` only. H31 compares the two carriers
of the
`needs:contract-review` gate, and it took `prDeliversCard` — the wide
body-first/branch-fallback delivery relation — as its population. That
relation
counts a `Part of #N` line, which declares MEMBERSHIP in what #N tracks
rather
than a delivery of it, so an epic tracker whose sub-PRs are gated
correctly drew
a row saying the gate was missing from the card half of a dual carrier.
The
row's remedy text is action-shaped, so acting on it hangs the gate on a
card
nothing will ever close — where the stroke that clears gates never
arrives.

Three edits:

1. **`bindingClosesCard(pr, n)`** — a new exported predicate, one read
of
`deliveryEvidence`'s existing grading, never a second keyword parser. It
answers "does this PR CLOSE #n", which is the question the gate's
clearing
stroke rides. `part-of`, `part-of-inline` and `branch-name` all answer
false.
2. **H31's own population filter** — the carrier comparison runs over
the PRs
   `bindingClosesCard` accepts. Those rows are byte-identical to before.
3. **A DECLINED row for every other binding** — a weak-bound delivering
PR whose
carrier differs from the card's still produces a row, one that names
both
carriers and the binding it read, states that it declined to judge, and
prescribes no write. A weak-bound PR whose carrier agrees produces
nothing,
   exactly as before.

`TRACKING_ANCHOR_LABEL` is extracted so the ruling-anchor state has one
spelling
across H13's exemption list and H31's new clause.

## Why this seam, and how the shared invariant survives

The shared relation is NOT narrowed. `prDeliversCard`'s docblock forbids
it
(「⛔ Do not narrow it here to serve H8: that would make the live half
invisible
to the rows that exist to see it」), and H8's open side, H35's sibling
resolver,
`claimDelivery`, H53 and the `check-clause2-carriers` pairing all still
read it
wide. The narrowing is H31's own filter over the population that
relation hands
it, so the rows still agree about which PR delivers which card and
differ only
about which binding makes a CARRIER PAIR — a question only H31 asks.
Both
docblocks that state the invariant were updated to say so rather than
left to
imply the old thing.

Silently dropping the weak bindings would have been objectstack-ai#4690 in this row's
own
uniform: a split that was never judged renders identically to a board
whose two
carriers agree, and this is the one row that can tell 「被剥」 from 「从未挂过」.
Hence the declined row, and hence its scope: it speaks only where the
carriers
actually differ, because a standing row per tracker per sweep is the
disease,
not the cure. The declined row is deliberately NOT marked
`UNJUDGED_MARKER` —
that marker buys trim priority ahead of judged rows, and a decline must
never
sort ahead of a real carrier split in the same `gate` band.

## Measured on the live board

Anchor objectstack-ai#9857's sweep at 2026-09-15T01:57Z, commit `b3b43b6`, run
34919049964,
carries exactly one H31 row: objectstack-ai#14122 (`tracking`), naming open PR objectstack-ai#18212
(draft,
via a `Part of` declaration). Replayed offline against the 9 open PRs
and the 9
open cards those PRs name (the exact H31 candidate set — a card no open
PR names
can never reach the comparison):

| card | `tracking` | delivering evidence | row before | row after |
|---|---|---|---|---|
| objectstack-ai#18122 | no | objectstack-ai#18238 closing-keyword | none | none |
| objectstack-ai#17502 | no | objectstack-ai#18231 closing-keyword | none | none |
| objectstack-ai#17598 | no | objectstack-ai#18230 closing-keyword | none | none |
| objectstack-ai#15410 | no | objectstack-ai#18227 closing-keyword | none | none |
| objectstack-ai#18202 | no | objectstack-ai#18212 closing-keyword | none | none |
| objectstack-ai#14122 | **yes** | objectstack-ai#18212 **part-of** | action-shaped finding |
**DECLINED row** |
| objectstack-ai#17396 | no | objectstack-ai#18198 closing-keyword | none | none |
| objectstack-ai#17356 | no | objectstack-ai#18131 closing-keyword | none | none |
| objectstack-ai#17097 | no | objectstack-ai#18096 closing-keyword | none | none |

One row changes, and it is the expected one. Every other delivering
binding on
the live board is a closing keyword, so nothing else moves.

## Tests

`pnpm check:pm-half-states` (= `node scripts/pm/check-half-states.mjs
--self-test`): **4042 cases pass** before, **4075 cases pass** after,
exit 0 —
33 new cases.

The pin and the control both land, per the card's own remedies:

- pin: the `Part of`-only tracker still produces a row (⛔ not a silent
skip),
the row says `DECLINES to judge`, names the binding it read, explains
why a
ruling anchor can never clear a gate, and prescribes NOTHING; it is
asserted
  to be neither the old action-shaped sentence nor a LOUD row nor an
  UNJUDGED-ranked one.
- control: a closing-keyword binding whose card lacks the gate — the row
STANDS,
  with the unchanged action-shaped sentence.
- plus: agreement on a weak binding stays clean both ways; a weak-bound
card
without `tracking` still reports the split but without the ruling-anchor
  clause; an adjudicable split outranks a decline and names only the
  closing-bound PR.

**Ablation** (one-off, restored; run from the committed fix). Mutating
`bindingClosesCard` back to the pre-fix wide population
(`deliveryEvidence(pr, n) !== null`) turns the self-test RED:

```
== anchor counts BEFORE ==   old-text occurrences: 1 / new-text occurrences: 0
mutation written
== anchor counts AFTER ==    old-text occurrences: 0 / new-text occurrences: 1
HEAD blob=dca4e1dbff5d6a46d10c5ac53a527b888e5f0811
MUT  blob=906ac10ab7837ef5dc746f1bb3ccda8740e88c75
VERDICT ablation-exit=1
✗ check-half-states self-test: 11 of 4075 case(s) failed.
== restore leg ==
REST blob=dca4e1dbff5d6a46d10c5ac53a527b888e5f0811
old-text occurrences after restore: 1 / new-text occurrences after restore: 0
git diff HEAD bytes: 0
```

The mutation is proved on disk by the blob hash moving off the HEAD blob
and by
the two anchor occurrence counts flipping; the restore leg is proved by
the blob
hash returning to the HEAD blob and by an empty `git diff HEAD`, not by
an exit
code. There is no build step and no `dist/` for a repo-root `.mjs`, so
the
rebuild half of the ablation preflight does not apply here.

**Gates** — derived with no paths, at head `e0a4efa`:

```
node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack
  -> 41 command(s)
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran RECORD_FILE
  -> Run reconciliation — 41 derived, 41 run, 0 NOT-MEASURED, 0 UNRUN.
     EXIT CODES — all 41 accounted famil(ies) carry one, so the NOT-MEASURED
     count above is DERIVED from them.
```

All 41 exited 0, each captured by redirect before any pipe. The gate
script's
own wiring is inside that set: `pnpm check:pm-half-states` is the
package.json
step lint.yml runs, and it is the script's `--self-test`.

**Lint** — a declared narrowing, not the farm. `eslint
scripts/pm/check-half-states.mjs
--no-inline-config --format json` at head `e0a4efa`: **1 file linted, 0
errors, 0
warnings**, exit 0. The population is read from eslint's own config, not
guessed
— an `ESLint` instance over `git ls-files` reports `tracked=8674
in-scope=6755
ignored=1919 no-rules=0`. Invariance: this repo runs one
`eslint.config.mjs`
which enables type-aware linting for no file at all (every
`parserOptions` in it
is exactly `{ ecmaVersion: 'latest', sourceType: 'module' }`; zero
`project`/`projectService` hits; the config says so itself at its
`QUERY_OPTIONS_TEST_GLOBS` note), and that config is not in this diff —
so no
rule's verdict on a file this PR did not touch can move because of it.
The
repo-wide `pnpm lint` run is CI's.

`skip-changeset`: `scripts/pm/**` is PM tooling and ships in no
package's
`files[]`, so nothing published moves.

## Acceptance notes

- `scripts/pm/check-half-states.mjs` is non-governed PM tooling, so this
is
in-seat review. `.github/workflows/half-state-patrol.yml` and anchor
objectstack-ai#9857 are
untouched: the workflow runs the script from `main`, so the fix reaches
the
  anchor at the first scheduled sweep after landing.
- objectstack-ai#18214 is the sibling shape one file over — the clause-② dual carrier
that
`scripts/pm/check-clause2-carriers.mjs --pair` demands on an epic
tracker
reached through a `Part of` line. It is out of scope here and remains
open.
  `bindingClosesCard` is exported for it: that file already imports
`deliveryEvidence` and `prDeliversCard` from this one, so the fix there
is an
  import rather than a second copy of the predicate.
- noted, not filed: the sibling install of this script in `objectui`
(`scripts/pm/check-half-states.mjs`) has already drifted from this copy
(different md5 at `b3b43b6`), while this file's header describes the
pair as
copied VERBATIM. No gate can hold two repos equal, so the wording is an
  aspiration rather than a claim — carrier: the next dev dispatched on a
  cross-repo patrol card.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01HZfg2AwVX191qCizp88gQr)_

---------

Co-authored-by: Claude <[email protected]>

… gates read it (objectstack-ai#18346)

Fixes objectstack-ai#16421

Clause-②: no

A gate strengthens; no published runtime contract moves. Stated by the
ruling, and re-derived here: the declaration's accept set only grows
(the arm is optional and every existing spelling reads
byte-identically), and the three gates that read it become stricter,
never looser.

## The defect

A **narrowing** — "these spellings stop being accepted" — could ship to
customers with the release notes saying nothing, and every gate green.
`check-adr-0087-registration.mjs` decided breaking-ness from an author's
hand-written `**BREAKING**` prose banner; an author who did not type it
was classified non-breaking and was asked for no ADR-0087 disposition.

Measured, not hypothesised: **objectstack-ai#16296** narrowed `sys_job.timezone` /
`sys_report_schedule.timezone` to the IANA value domain and shipped with
no banner, no `major` and no `!`. **objectstack-ai#14238** did the same one surface
earlier.

## The ruling being executed

Director summon objectstack-ai#17, decision batch objectstack-ai#2 item 1, **option B**, maintainer
verbatim 「同意」 (comment `5572145955`, 2026-09-07T14:32:32Z). Options A
(keep the prose banner) and C (a static accept-set differ) are refused
there and are not reopened here.

## What landed

| # | deliverable | where |
| --- | --- | --- |
| 1 | the closed two-arm enumeration in the declaration format |
`AGENTS.md` item 3 |
| 2 | `readClause2Line` reads the arm — **once**, no second parser |
`scripts/pm/check-clause2-carriers.mjs` |
| 3 | signal (4): a declared `narrowing` is breaking |
`scripts/check-adr-0087-registration.mjs` |
| 4 | the level axis reads the arm |
`scripts/check-changeset-no-major.mjs` |
| 5 | **ONE** ADR-0087 ledger row, recording objectstack-ai#16296 |
`packages/spec/src/migrations/entries/semantic/` |

> ⚠️ **Row 5 is deliberately one row, not the two the ruling names —
corrected by the `domain:devx` seat (objectstack-ai#6023) on the dev's measurement.**
> The ruling lists objectstack-ai#14238 and objectstack-ai#16296 as the two already-shipped
narrowings. **objectstack-ai#14238 is not a narrowing**: its diff is 535 insertions
and 0 deletions across 11 files (two nullable columns ADDED, carrying
`valueDomain: 'iana_time_zone'` from their first release), and its own
shipped changeset says so in writing — *"A NON-BREAKING ADDITION,
registered here in writing because ADR-0087's registries have no
additive entry kind"*.
> A row claiming it narrowed something would be false data in the one
ledger this mechanism keeps true, which ADR-0087's objectstack-ai#13080 addendum
refuses by name. ⇒ One row is written, the second is **not fabricated**,
and the falsified premise is carried to the maintainer rather than
silently dropped.

> ⚠️ **The citation above was wrong in the dispatch order and is
corrected here.** The seat's dispatch word cited comment `5573372199`,
which answers **HTTP 404**; the real ruling is `5572145955` (HTTP 200,
verified by both the dev and the seat). The quoted ruling text itself is
unchanged — only the provenance id moved.
| 6 | pins for both arms, in both directions | the three gates'
self-tests |

### The shape

| spelling | reading |
| --- | --- |
| `Clause-②: yes` | a widening, declared through the value — unchanged |
| `Clause-②: yes (widening)` | the same, said out loud |
| `Clause-②: yes (narrowing)` | widens one surface, narrows another;
both facts are read |
| `Clause-②: no (narrowing)` | NOT a widening, but BREAKING — the point
of the arm |
| `Clause-②: no (widening)` | MALFORMED: the value and the arm
contradict each other |

(The rows are table cells on purpose: a line-initial second declaration
in this body would be a second answer to the same question.)

The arm is **optional**, and that is a measurement rather than a
kindness: all five declarations on the open board the day this landed
carry no parenthetical arm, and all five read byte-identically
afterwards (proof below).

Two shapes fail **closed** rather than reading as an absent arm, because
reading them as absent is the direction a declared narrowing silently
disappears in: a near-arm spelling (`(narrowed)`, `(Narrowing)`,
`(widen)`) and the unfilled template `(widening|narrowing)`. Both land
in `malformed`, the state this reader already owns for "the slot holds
something nobody can grade".

## Measurements

### Back-compat — the five in-flight declarations

Read from the live GitHub payload, before and after the change,
comparing the whole reading object:

| PR | reading | arm |
| --- | --- | --- |
| objectstack-ai#18344 | `declared no` — IDENTICAL | none |
| objectstack-ai#18268 | `declared no` (em-dash reasoning, parenthesised identifiers)
— IDENTICAL | none |
| objectstack-ai#18231 | `near-miss inline-key` — IDENTICAL | n/a |
| objectstack-ai#18227 | `declared no` — IDENTICAL | none |
| objectstack-ai#18096 | `declared no` — IDENTICAL | none |

**5/5 byte-identical** apart from the additive `arm: null` field.
Nothing in flight loses its reading.

### `AGENTS.md` — both ratchet axes

Its line ratchet has **zero headroom** (1075 lines, ceiling 1075), so
the format is carried at **net zero lines**, paid for by deleting
content rather than by re-wrapping:

- deleted: the widening-rationale clause (`the widening it declares is
what makes it more than a patch…`), 93 bytes;
- deleted: the CI step name the gate already prints in its own failure,
78 bytes.

| axis | before | after |
| --- | --- | --- |
| lines | 1075 / ceiling 1075 | **1075** — headroom 0, unchanged |
| widest line | ≤ 120 bytes | edited lines measure 119 / 118 / 120 / 119
/ 81 bytes |
| widest table row | 768 / pin 768 | **768**, untouched |

`check:pm-skill-ratchet` self-test and run both exit 0.

### Both arms, both directions

Every arm pin is a **pair**, because one direction alone cannot tell a
reading from a constant — a gate that classified both arms as breaking
would satisfy a `narrowing` test while telling a consumer nothing:

- `check-adr-0087-registration`: `narrowing` is in
`MUST_MATCH_BREAKING`, `widening` is in `MUST_NOT_MATCH_BREAKING`, both
on a banner-free `minor` changeset — the exact shape objectstack-ai#16296 shipped in.
- `check-changeset-no-major`: same tree, same levels, only the
declaration moves — `no (narrowing)` reaches `enforce`, bare `no`
reaches `not-declared`.
- `check-clause2-carriers`: both arms read; the contradiction, the
near-arm family and the unfilled menu are all `malformed`; and three
CONTROL rows pin the arm-less spellings unmoved.

## Two judgement calls, declared rather than made quietly

1. **The `**BREAKING**` banner signal is KEPT.** The dispatch word asked
for breaking-ness to stop being read from the prose banner. Removing
signal (2) would un-declare the **52 changesets in stock** that carry it
and nothing else — the gate's own docblock has refused that direction
("narrowing to any one of them would drop real declarations") since it
was written, and the ruling's own text asks only that the gate *read the
arm*. Signal (4) is added beside it, so breaking-ness no longer
**depends** on prose. If the maintainer wants (2) retired, that is a
second, deliberate card with its own stock count.
2. **`check-adr-0087-registration` reads the arm from the CHANGESET
body, not the PR body.** It has no pull-request payload by construction
— `cut-rc.yml` runs it on a `workflow_dispatch` over a whole snapshot
range with no PR at all. All three of its existing signals are
changeset-local, and the fourth is too.

## Acceptance notes

- noted, not filed: `readClause2Correction` does not carry the arm. A
correction comment can change a declaration's *value* but not its
*direction*. No half-state results today — the arm's three readers are
the changeset body (ADR-0087), the PR body (no-major) and this file's
own rows, and none of them reads corrections — so this is recorded
rather than filed. Carrier: `scripts/pm/check-clause2-carriers.mjs`, the
next card that touches `readClause2Correction`.
- noted, not filed: the I1/I2 fixture in
`check-adr-0087-registration.mjs` staged its import siblings from a
hand-written two-name list. Signal (4) added an edge into a nine-module
closure including `pm/dispatch-gates.mjs`, so the list is now
**derived** by walking real import statements. That is a guard extension
inside this card's own defect class, not a drive-by: without it, the
next import added over in `pm/` would kill this gate's fixture with an
error about neither file.

## 维护者速读(草稿)

**改了什么** —「本卡是否放宽契约」这条申报,现在可以再带一个方向:`(widening)` 或
`(narrowing)`,只有这两种拼法。声明 `(narrowing)` 的改动会被三个门禁当作破坏性变更处理:必须写 ADR-0087
处置、必须给到 `minor` 档。`AGENTS.md` 记下格式,行数一行没多。

**为什么改** — 一次「以后不再接受某些写法」的收紧,过去可以在发布说明里一个字都不提就发给客户,所有门禁照样亮绿:门禁是从作者手写的
`**BREAKING**` 横幅判断破坏性的,忘了写就当没有。objectstack-ai#16296 和 objectstack-ai#14238
就是这么发出去的。改完之后,判据是一个封闭的词,不是一段散文。

**风险与代价(含回滚)** — 风险面是「在飞的申报会不会一夜失效」。方向词是可选的,板上 5 个在飞 PR
的申报实测全部逐字不变,已列在上面的表里。代价是作者多写一个词,并且要把同一行抄进 changeset
正文。两条已申报的判断:`**BREAKING**` 横幅这条旧信号保留(库存里 52 个 changeset 只靠它),以及 ADR-0087
门禁从 changeset 正文读方向(它跑 RC 切版时根本没有 PR)。回滚是单笔
revert:三个门禁各自的自测都是新增用例,没有既有用例被改写。

**席位意见** — (留空,复核席定稿)

**你要做的** — 确认两件事:① 旧的 `**BREAKING**`
横幅信号保留,是否合你意(裁定原文只说「读分肢」,派发词的转述是「不再从横幅判断」);② 两条 ADR-0087
账本行记的是平台对象列的取值域收紧 —— 该账本服务的是元数据升级者,请确认这两行落在那里是你要的记录位置。

---

🤖 Generated with [Claude Code](https://claude.com/claude-code)

_Generated by [Claude
Code](https://claude.ai/code/session_017ef78bLdybu3AffehKkhfk)_

---
_Generated by [Claude
Code](https://claude.ai/code/session_017ef78bLdybu3AffehKkhfk)_

---
_Generated by [Claude Code](https://claude.ai/code)_

---------

Co-authored-by: claude[bot] <[email protected]>