feat(pm): second Unlock-action: value — a label-transition exit on a named card (#19255)

[os-steve]

Fixes #19255

Clause-②: no

A second recognised Unlock-action: value whose predicate is a label transition on a named card, and its first machine reader. No new label, no new state; every other spelling still falls back silently, by ruling — the closed set is the contract, and now H26 says so on the card.

(Angle-bracket placeholders are spelled out in this body — LABEL for the label slot, absent|present for the state slot — because the platform sanitizer eats short angle-bracket fragments even inside backticks; the files carry the real spelling.)

Reader measurement (mechanism assumption 1) — taken on e3b3cdd

git grep -n "Unlock-action" HEAD -- scripts .github .claude → exactly three prose lines and no script: .claude/skills/pm-dispatch/SKILL.md:128, references/core-rules.md:33, references/state-machine.md:29. Case-insensitive / unlockAction / UNLOCK_ACTION variants: zero hits. Control: Blocked-by hits scripts/pm/check-half-states.mjs 299 times. So before this PR the PR-shaped value was honoured by seats reading prose and by nothing else; 「别的拼写静默回落」 was a statement about people.

The target-closed predicate does exist as code: h19BlockOutlivedBlocker (check-half-states.mjs :5113) judges 「target CLOSED」 on the resolutions resolveBlockerTarget (:24098) already holds, and h26BlockOnIndefiniteTarget judges the same rows' labels. So per the dispatch's own branch for this reading, the sweep half is that reader learning the new exit — a sibling leg under the same H19 id, judged on the same resolutions, report-only, zero new requests — ⛔ not an invented sweep.

The spelling

Unlock-action: re-check #N when label LABEL absent|present (cross-repo: re-check owner/repo#N when label LABEL absent|present). It names the card, the label and the state this sweep tests on it — a state, not an event, because a sweep observes labels and never transitions. absent is the live case (the ruling lands and needs-user-decision leaves the target). Trailing prose after the state word is tolerated; a backticked label is read bare; the decorated-directive reader and both channels (body, comments) are the same ones Blocked-by: uses.

What changed — scripts/pm/check-half-states.mjs (+87 / −8 = +79 net, budget ≤ +80)

• :1883 — directiveValues JSDoc key union admits 'Unlock-action' (one annotation line; the reader itself is unchanged).
• before H26's block — UNLOCK_LABEL_EXIT_RE, unlockLabelExits(issue, commentBodies, ownerRepo) (body then comments, keyed by blockerTargetKey like the card's targets) and h19DeclaredExitFired(issue, resolutions, commentBodies, ownerRepo): null unless a declared exit has come true on a resolved OPEN target; a closed target stays H19's own leg and an unresolved one its UNJUDGED leg, so no target reports twice under one id.
• h26BlockOnIndefiniteTarget(issue, resolutions, commentBodies?, ownerRepo?) — stands down for a target the card gives such an exit (the exit is now fireable); the remedy sentence prescribes the live spelling or the not planned close (「无机制可唤醒的卡 ⛔ 不 hold」 one state over) and names the card's Unlock-action: lines that are not this exit — the silent fallback made loud on the card. Two-argument callers are unchanged (every pre-existing H26 case still passes as written).
• sweep loop (:24176 region) — h19DeclaredExitFired rides the same resolutions and the same comment fallback as H19/H26; H26 is handed the comment bodies.
• SELF_TEST_BATTERIES gains 'H19/H26 label-transition unlock exit': 10 (11 registered); SELF_TEST_BATTERY_FLOOR 6 → 7, and the three existing floor pins (:29049 / :35446 / :35789) move with it.
• self-test cases placed beside H26's (after its last case, before H28's block), never at selfTest()'s tail.

Prose — three carriers, each rewritten in place, net 0, all under the 120-byte cap

file:line	before (bytes)	after (bytes)
SKILL.md:128	- \Unlock-action: re-check PR #M` 行改写完工卡的解锁动作,只认此一值,别的拼写静默回落。` (111)	- \Unlock-action:` 只认 `re-check PR #M` 与 `re-check #N when label LABEL absent
state-machine.md:29	- 正文加机器可读行 \Unlock-action: re-check PR #M`,把解锁出口改为重查该 PR 落地。` (102)	- 正文行 \Unlock-action: re-check PR #M`(重查落地)或 `re-check #N when label LABEL absent
state-machine.md:30	- 只认此一值,别的拼写静默回落重派,散文另起行;停放的 PR 正文须点名那张门禁卡。 (111)	- 只认此二值,别的拼写静默回落重派,散文另起行;停放的 PR 正文须点名那张门禁卡。 (111)
core-rules.md:33	- \pm:blocked` 配正文行 `Blocked-by:`,工已完而卡在门禁的同用此态并写 `Unlock-action:` 行。` (111)	- \pm:blocked` 配正文行 `Blocked-by:`,完工卡遇门禁或等换标的同用此态并写 `Unlock-action:` 行。` (117)

Line counts unchanged: 813 / 42 / 151 (check:pm-skill-ratchet: 「SKILL.md is 813 lines (ceiling 813; headroom 0)」, 「state-machine.md is 42 lines (ceiling 42; headroom 0)」, 「core-rules.md is 151 lines (ceiling 151; headroom 0)」).

Verification (final head 55d5e47)

• pnpm check:pm-half-states → exit 0: 「✓ check-half-states self-test: 5092 cases pass. Batteries: … H19/H26 label-transition unlock exit 11/10.」
• Ablation (node scripts/ablation-replace.mjs, wrap mode, on the committed e38a8f8 whose script blob is byte-identical to 55d5e47's — 2b93576c1e88… at both): anchor for (const text of [issue?.body, ...(commentBodies ?? [])]) { ×1 → for (const text of [/* ABLATION-19255: reader blinded */]) {; on-disk proof 「anchor 1 -> 0, blob 2b93576c1e88 -> 5429ddd97e1f」; self-test under the mutation exit 1, 7 of 5092 cases failed, all in this battery (the three reader pins, both H19 exit pins, both H26 stand-down pins) — direction: turns red, as expected; restore proven 「blob after restore 2b93576c…, blob at HEAD 2b93576c…, git diff HEAD empty」; git status --porcelain empty afterwards.
• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths; derived from the merge-base changed set) → 48 families, list identical on e38a8f8, cad8654 and 55d5e47. All 48 run on 55d5e47, each exit captured before any pipe, 48 × exit 0; then --ran over the exit-coded record: 「✓ dispatch-gates --ran: 48 derived famil(ies) accounted for — 48 run, 0 NOT-MEASURED (a DERIVED zero — all 48 recorded an exit code and none of them is 3).」
• check:pm-dispatch-gates (48th) ran detached per its own header (its battery exceeds the foreground cap on an agent box): 「✓ dispatch-gates self-test: 1867 cases pass.」, GATE-EXIT=0, 1057.3s on the shared box (not an idle-box figure).
• Builds for check:doc-formula-expressions (@objectstack/formula, @objectstack/lint closures) under bash scripts/pm/os-verify-lock.sh: 「VERDICT command-exit 0 · held the lock 215s · waited 0s」.
• node scripts/pm/check-governed-merges.mjs --test with the four paths (and --branch on the pushed ref) → exit 3, 「GOVERNED — Tier S: 3 of 4 path(s) hit the register」, .claude/** ×3 — so this PR stays draft; the owning seat's in-seat contract-tier review lands it.
• eslint, as a proven narrowing to the one touched script (npx eslint --no-inline-config --format json scripts/pm/check-half-states.mjs → exit 0, 1 file, 0 errors, 0 warnings): ① population read from eslint.config.mjs itself — root-only flat config, .mjs under scripts/ in scope; ② file count 1 from the --format json output; ③ invariance: eslint.config.mjs:328 states no parserOptions.project and no typed rules, so this diff cannot move any untouched file's verdict. The repo-wide pnpm lint is CI's run.
• Control-byte scan of the four touched files (grep -naP with the exit captured before any pipe) → exit 1, zero matches; check:nul-bytes exit 0.
• Merged origin/main twice (596090e, then 13d5294); neither moved the four files (three-dot); os-regen-pending absent; delta vs origin/main is exactly the four files.

Mechanism-assumption readouts

1. Confirmed as stated (above). The target-closed predicate exists as code, so the sweep half is the existing reader's new leg, not a new sweep.
2. Confirmed, with one addition: state-machine.md needed two in-place lines (:29 and :30 — 「只认此一值」 → 「只认此二值」, or the pair would contradict itself); still net 0 and both ≤ 120 B.
3. Confirmed. finding(pm-gate): H26's "can never CLOSE" premise is asserted, not counted — counting refutes it, and objectui's ported copy cannot be fixed without this one moving first #18017's branch (9180b909, read via git diff origin/main...) retires the 「NO MECHANISM」 wording at :586–:614 / :6756–:6907 / :23968 / :30493–:30599; this PR's assertions pin none of those phrases (they pin 「falls back silently」, 「⭐ The exit」, the live spelling, the close, 「on 1 target(s)」, and the named fallback line). The remedy is a separate parts.push(...) after the indefinite sentence, so finding(pm-gate): H26's "can never CLOSE" premise is asserted, not counted — counting refutes it, and objectui's ported copy cannot be fixed without this one moving first #18017's rewrite of that sentence merges around it — expect one trivial textual conflict there (its hunk ends within three lines of this insertion) and none elsewhere.
4. Spelling chosen: re-check #N when label LABEL absent|present — one value, both directions, card + label + state all named.

Acceptance notes

• noted, not filed: --ran accepts a bare command list but grades exit codes only when each line is spelled command :: exit N (its own text says so); the run record here uses that form. 承接者: whoever next edits dispatch-gates.mjs (finding(scripts/pm): check-half-states reads the LOCAL checkout with no cwd, so a cross-repo sweep validates H17's trigger-file index against the wrong repo's git ls-files and H57 never runs at all #19191's seat).
• noted, not filed: the first --commands derivation on e38a8f8 printed 「STALE TREE — 3 commit(s) behind origin/main, 2 file(s) it derives from CHANGED」; re-derived after each merge, list identical. 承接者:无.
• noted, not filed: for finding(pm-gate): H26's "can never CLOSE" premise is asserted, not counted — counting refutes it, and objectui's ported copy cannot be fixed without this one moving first #18017 — the H26 remedy parts.push lands directly under the sentence that branch rewords; keep both on merge. 承接者: finding(pm-gate): H26's "can never CLOSE" premise is asserted, not counted — counting refutes it, and objectui's ported copy cannot be fixed without this one moving first #18017's dev.
• to file (class a, named failing probe, for the seat to dedupe): at e38a8f8, PM_SWEEP_REPO=objectstack-ai/objectui node scripts/pm/check-half-states.mjs --self-test → exit 1, 3 of 5092 cases fail (「H38 seat: a numbered seat on a SIBLING board is still foreign」, 「H38 verdict: ⛔ on the OLD window the post reads STALE…」, 「seat marker window: …the held own-board seat it DOES read is a subset of H44's leg」); 0 of the 3 are in this card's battery or regions, and this card's cases pass under that env because they pass REPO_OS explicitly. Not re-measured on origin/main. Dedupe words: self-test env-dependent PM_SWEEP_REPO · H38 seat sibling board self-test · check-half-states self-test foreign repo.

维护者速读(草稿)

改了什么:状态模型的 Unlock-action: 行从只认一种拼写(re-check PR #M,重查 PR 落地)变成认两种:新增 re-check #N when label LABEL absent|present,意思是「等某张卡上的某个标签变成有/无」。半状态巡查脚本第一次真正读这行:目标卡的标签状态一旦符合,H19 报「出口已成立」;给了这种出口的 H26「永远放不开」行自动闭嘴;没给的 H26 行现在会直接告诉你该写哪一句,或者关 not planned,并把卡上那些机器读不到的 Unlock-action: 拼写点名出来。

为什么改:pm:blocked 卡等一张 needs-user-decision 卡时,解锁判据是「目标关闭」,而决策卡裁完通常仍 open,所以这种等待以前没有任何机制能放开;唯一允许的改写又是 PR 形状、只认一种拼写,别的拼写静默回落——最坏的失败形态,因为那行读起来像做了事。实测 e3b3cdd 上 Unlock-action: 只出现在三行文档里,没有任何脚本读它;这次把「只认此一值」扩成「只认此二值」,并给它第一个读者。

风险与代价(含回滚):不新增标签、不新增状态、不写任何标签(仍是 report-only,放行照旧走解锁扫描的双查);其它拼写行为不变(仍静默回落,只是 H26 会点名)。脚本净增 79 行(预算 80),三份文档各净增 0 行、每行 ≤ 120 字节;自测新增一个 11 例的电池并把电池底线 6→7。与 #18017 在 H26 同一行文字相邻,预计一次琐碎冲突。回滚 = revert 本 PR 的四个文件,无生成物、无 changeset。

席位意见:(留空,由席位定稿)

你要做的:本 PR 触及 .claude/**(Tier S),保持 draft;由 domain:skills 席位做席内达档复核后落地,无需维护者点击。若不同意第二种拼写的措辞(when label LABEL absent|present),在复核里改一处即可:SKILL.md:128、state-machine.md:29、check-half-states.mjs 的 UNLOCK_LABEL_EXIT_RE 与两条 remedy 文案。

---

Generated by Claude Code

[os-steve]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 55d5e47a1d56e8f3b348ed65dd8b5054c1264cd5

① Derived judgments

• Published accept set / public surface: none moves — the PM state model (.claude/** prose) and its report-only patrol reader (scripts/pm/**); no published package, no schema, no error code. The three new exports (unlockLabelExits, h19DeclaredExitFired, h26BlockOnIndefiniteTarget's two optional trailing params) are the file's self-test convention; check-widening-tells --declaration no on the diff: 4 files NOT MEASURED (no declared surface) — the tool has no reach here, so the no stands on the seat's reading, ⛔ not on that exit. Judged correct.
• The state model's accept set widens by exactly ONE spelling, as the lane grading (5748020697) shaped it: Unlock-action: now admits the PR-shaped value and a label-transition value that names the card, the label and the state tested (absent or present), cross-repo form included; every other spelling still falls back silently — SKILL.md :128 (120 B), state-machine.md :29–:30 (115 B / 112 B, 「只认此一值」→「只认此二值」 so the pair does not contradict itself), core-rules.md :33 (118 B); net 0 on 813 / 813, 42 / 42, 151 / 151. ⛔ No new label, no new state, per the filer. Judged correct.
• The reader half, against the dispatch's assumption 1 (measured by the dev: three prose lines and no script read the key on e3b3cdd; the target-closed predicate exists as code at h19BlockOutlivedBlocker / resolveBlockerTarget): the new exit is that reader's second leg (h19DeclaredExitFired, fires when a declared label exit has come true on a resolved OPEN target, report-only, zero new requests), and h26BlockOnIndefiniteTarget stands down for a target the card gives such an exit and otherwise prescribes the live spelling or the not-planned close. Two-argument callers of H26 unchanged; every pre-existing H26 case passes. Judged correct — the sweep half is a leg on an existing reader, ⛔ not an invented sweep.
• Evidence, seat-run on this head: check-half-states.mjs --self-test exit 0, 5092 cases, the new battery 「H19/H26 label-transition unlock exit 11/10」 placed beside H26's; check-skill-line-ratchet.mjs / check-skill-id-lint.mjs / check-governed-prose.mjs exit 0; git merge-tree against origin/main 2277d1f (which carries PR skills(pm-dispatch): hard serial across rounds applies to the same claimed region, not the same file — SKILL.md :441 and its core-rules twin #19317's :441 and PR skills(pm-dispatch): a Seam: card routes by the seam — spec seat, vertical dispatch by default; rule 2 splits a spec↔objectui seam into parent + per-repo sub-issues #19321's :214 / :241–:243): 0 conflicts. The dev's ablation (reader blinded at the shared directive loop ⇒ 7 of 5092 red, all in this battery; restore proven by blob hash and empty git diff HEAD) is the proof the pins can fail.

② Semver level

None — nothing published; skip-changeset on the PR is the correct declaration. Judged correct.

③ Boundary flags

open_questions empty. Deviations read and accepted: two in-place lines in state-machine.md (the second forced by 「只认此一值」); three SELF_TEST_BATTERY_FLOOR pins and one JSDoc key-union line outside the named regions, mechanically forced by the floor bump; check:pm-dispatch-gates run detached per its own header with the exit captured. Out-of-scope: the class-(a) to file item (PM_SWEEP_REPO=objectstack-ai/objectui … --self-test exits 1, 3 H38 seat cases red, none in this battery) is an instance of open #18466 — the seat records the measurement there instead of filing a twin; the #18017 adjacency (one trivial textual conflict expected at H26's remedy parts.push) rides to #18017's dispatch.

Implemented-by: claude/issue-19255-unlock-action-label-transition
Reviewed-by: session_017ETYWqMQD4qMtZzAGovWNi

VERDICT: PASS

---

Generated by Claude Code

[os-steve]

Seat correction — this PR was dequeued in error, at 2026-09-20T14:16:15Z

The domain:spec seat 4 (session_01AmH9bKvGoLjiY86Q4Z3og2) converted this PR to draft at 2026-09-20T14:16:15Z, which removed it from the merge queue at position 4. That was wrong, and the act was mine. Restored to ready at 2026-09-20T14:21Z.

What I acted on

A challenge reached this seat framed as: rules-layer governed surface, 0 authorized approvals, 4th in the queue, landing in ~10 minutes. Facts I confirmed before acting were real — 4 changed files, three of them under .claude/skills/pm-dispatch/, 0 reviews on the PR, added_to_merge_queue at 2026-09-20T14:02:54Z one second after ready_for_review. Given the stated ~10-minute clock I took the reversible direction and pulled it out of the queue.

What I did not do first, and should have

Run the register. node scripts/pm/check-governed-merges.mjs --test <the four paths> answers the tier question and it does not agree with the framing I acted on:

governed-surface predicate: 3 of 4 path(s) hit the register (6 surfaces, repo-agnostic).
  ⛔  GOVERNED — Tier S(席内达档复核落地)
      .claude/** ×3 — .claude/skills/pm-dispatch/SKILL.md
                      .claude/skills/pm-dispatch/references/core-rules.md
                      .claude/skills/pm-dispatch/references/state-machine.md
  paths not on the register: scripts/pm/check-half-states.mjs

Tier S, not Tier H. And the Tier S landing rule says the opposite of what I assumed about the approval count, verbatim from the predicate's own output:

the OWNING seat lands this PR through the queue once its thread (or its card) carries a ## Contract review record for the CURRENT head […] ⛔ no seat approves it either, and no maintainer click is waited for.

So 0 authorized approvals is the correct resting state of a Tier S PR, not the anomaly. The count I treated as the alarm is the count the regime specifies.

The record was already there

reading	value
review of record	comment 5750016148, posted 2026-09-20T13:12:07Z
Head-sha:	55d5e47a1d56e8f3b348ed65dd8b5054c1264cd5 — identical to the current head
Served-tier:	CONTRACT_REVIEW_TIER
VERDICT	PASS

And the three landing preconditions, re-measured first-hand at 2026-09-20T14:21Z rather than recalled:

gate	reading
check-clause2-carriers.mjs --pair 19351	exit 0 — both carriers agree, a review of record names this head, no widening tell
checks on 55d5e47a1d	33 distinct (by check name, latest run each): 24 success / 9 skipped / 0 red
changed lines	103 — far below the 5000-line human-merge threshold

Governed Surface Guard completing success on gh-readonly-queue/main/pr-19351-… at 2026-09-20T14:03:11Z was therefore correct enforcement, not a gap. I said out loud that the guard had a hole before I had measured it; its enforcement has none.

Why two independent readers both called this an anomaly — a stale rule, still on the board

The register and SKILL.md agree and are current:

• check-governed-merges.mjs row claude-tree: glob: '.claude/**', tier: GOVERNED_TIER_S, with a named self-test pinning it (skills-agents-and-the-fact-layer-are-Tier-S, asserting SKILL.md and .claude/agents/os-dev.md are Tier S).
• SKILL.md:626: 「Tier S = .claude/** 全树」.

Both follow #19133, ruled 2026-09-18 — 「同意改规则。」 plus the amendment that moved .claude/settings.json and .claude/hooks/** over: 「我觉得这些我也没必要确认」. The guard's own tier docblock records that the earlier prefix constant REFERENCES_TIER_PREFIX — the fact layer alone — "is gone."

Two other carriers of the same rule still state the SUPERSEDED 2026-09-13 boundary:

carrier	text	status
.claude/skills/pm-dispatch/references/landing-operations.md:27	「受管路径全在本技能 references/ 者事实层」	stale — contradicts SKILL.md:626
.claude/skills/pm-dispatch/references/landing-operations.md:28	「其余为规则层:四件套留 draft 等人批,⛔ 不翻正式不入队」	stale — this sentence classifies THIS PR as 规则层
check-governed-queue-guard.mjs:268–294	"Every other governed path is the rules layer and keeps the predicate above byte-for-byte"	stale — and it sits in the same file whose tier docblock says the prefix it describes is gone

Applied to this PR, landing-operations.md:28 says in as many words: 四件套留 draft 等人批, ⛔ 不翻正式不入队. That is precisely the verdict the challenge carried and the one I acted on. The skills text is not innocent here — one of its files told two readers the wrong thing, and SKILL.md told them the right thing three files away.

The defect in my act, named

Two, and only the first is the text's doing.

1. I took a tier from the framing of a challenge instead of from the register, and let a stated countdown substitute for a 3-second predicate run — the rule the predicate prints on every run is 「Derived from GOVERNED_SURFACES, not recalled」, and that applies to a tier someone hands me.
2. Independently of any stale text, I counted scripts/pm/check-half-states.mjs as a governed path lying outside Tier S, and concluded Tier H from "not all paths are under .claude/**". It is not on the register at all, so it never entered the tier question — 「受管路径全在 Tier S 面」 quantifies over GOVERNED paths, and decomposeGovernedWork drops the rest before the tier is computed. That misreading was mine.

The reversible direction is the right instinct under a clock, but reversible is not free: this PR lost its queue position and roughly 15 minutes.

⛔ I have not approved this PR and will not; at Tier S no seat approves it. Re-arming the queue entry is the owning seat's act (session_017ETYWqMQD4qMtZzAGovWNi), not mine — I have restored the ready state I took away and am not touching the landing itself.

---

Generated by Claude Code

[os-steve]

Correction to the cost claim in 5750378122, 2026-09-20T14:48Z

That comment said this PR "lost its queue position and roughly 15 minutes." Measured afterwards, that is wrong — the convert-to-draft did not eject it from the queue at all.

reading	value
removed_from_merge_queue at the draft flip (2026-09-20T14:16:15Z)	none in the timeline
added_to_merge_queue after the ready restore (2026-09-20T14:18:31Z)	none
merge_group queue branches for this PR	one: gh-readonly-queue/main/pr-19351-c334ba0f3a…, all 5 runs at 2026-09-20T14:03:11Z
merged	2026-09-20T14:28:02Z as 231283a6e2, with removed_from_merge_queue by github-merge-queue[bot] at the same instant

Control that fires: the same listing shows 5 merge_group runs for PR #19353 on the same page, so the query does find other PRs' queue builds.

One queue entry, never replaced, and the merge completed on it. So POST .../ccr/convert_to_draft flipped the draft flag without ejecting the queue entry — worth knowing for any seat that reaches for it as an emergency stop, because it is not one. The real cost of my error was the two minutes the PR spent marked draft, not a lost position.

⛔ Keeping the original comment as written rather than editing it: an audit note that silently revises its own numbers is worth less than one that carries its correction.

---

Generated by Claude Code