[finding] Nothing expires a block when its `Blocked-by:` target closes, and 3 of 3 executable `Restart-when:` predicates in one lane are runnable but measure the wrong thing

[os-elon]

Filed unassigned by the domain:cli execution seat (session session_019bmVFqoQPq63zhKrxdYG1r) during a full-lane sweep on maintainer instruction (2026-08-20, verbatim 「cli 车道的全部任务都排查一下」). Recording only — ⛔ not claiming, ⛔ no state changed on any card by this card.

Every hold and block in domain:cli was walked by hand: 13 pm:on-hold + 5 pm:blocked, exit condition read literally from the body and the comments, and every executable predicate actually run. Three independent defects fell out, none of which any existing gauge can see.

① No predicate anywhere asks whether a block's target is still open

The half-state sweep has two block-shaped rows, and neither expires a block:

• H4 — pm:blocked with a Blocked-by: line in neither channel. Asks whether the line exists.
• H14 — pm:blocking carried while no open card's Blocked-by: targets it. Asks about the reverse index.

Nothing asks the one question that actually ends a block: is the issue it names still open? So a block outlives its blocker in complete silence, with a well-formed line, a correct label, and no row anywhere.

Measured, this sweep:

card	blocker	blocker closed	noticed after
#10112	#10126	2026-08-20 09:03:37Z	~4.5 h, and only because a human walked the graph
#10063	#9612	(closed)	released only by a manual triage pass — and its line was also backtick-invisible (#10102)

Neither was found by a gauge. Both were found by reading.

② H9 is body-only while H4/H14 read both channels — and it cost a live restart

The 07:54:30Z sweep states plainly that Blocked-by: is read from body OR comment ("both were read", "either channel discharges the duty", "comment fallback read on 14 of 14 candidate(s)"). H9's Restart-when: is body only (check-half-states.mjs:739).

Measured cost — #8725. Its body carries an old prose restart condition that has not fired. A newer, narrower, machine-fireable one — Restart-when: closed objectstack-ai/objectstack#9380. — lives in comment 5320833607. #9380 closed 2026-08-18T05:34:58Z (PR #9458, merged). The exit fired two days ago; the card reads as legitimately held from every mechanical angle, and H9 structurally cannot see it.

⇒ An undocumented asymmetry between two adjacent rules is what manufactured this. Cross-linked with #10102, which carries the backtick half of the same "the gauge cannot see the line" family.

③ 3 of 3 executable predicates in this lane run, and measure the wrong thing

Every Restart-when: in the lane classified as containing a runnable command was executed at origin/main. All three are defective, each differently:

#8343 — docker run --rm ghcr.io/objectstack-ai/objectos-ee: sh -c "grep -rc OFFLINE_CONTROL_PLANE …"
The image reference ends in a bare colon with no tag. Docker rejects it as an invalid reference; it never reaches the grep. The error is indistinguishable from "condition not yet met" to anyone not reading closely. (The card's Measured section pins 4.0.5-rc.1, so a tag was clearly intended.)

#5969 — git grep -c "components/schemas" -- packages/rest/src returns non-zero
Run at head: zero matches. And "returns non-zero" is ambiguous between exit code and match count — which here are inverted. Zero matches ⇒ git grep exits 1 (non-zero) ⇒ a literal shell reading fires the restart exactly while the defect persists, and would stop firing once it is fixed. The parenthetical ("route registration starts carrying request/response schema names") shows match-count was intended, so the text and the command disagree.

#8140 — gh issue list --label pm:queue --label domain:cli --state open returns 0
The condition means "the lane has run dry, so do this filler work." The command counts labels, not dispatchability. Right now it returns 1 — #9483, which carries pm:queue but is assigned to another seat, i.e. taken. So the lane's dispatchable queue is genuinely empty and the hold still will not lift.

⭐ The generalisation. The hold protocol requires a machine-fireable exit and the gauge checks that a line exists. Nothing ever checks that the line runs, or that running it answers the question the prose beside it asks. A predicate can rot into unrunnability — or be born inverted — and score green forever. 3 for 3 in one lane is not bad luck; it is an unmeasured surface.

Directions, for triage/maintainer rather than as a recommendation

1. A blocker-liveness row (H-next). For every pm:blocked card, resolve the Blocked-by: target and report it if closed. Cheap, purely mechanical, and it would have caught both cards in ①. Highest value per line of code here.
2. Make H9 symmetric with H4/H14 — read Restart-when: from body OR comment. Closes ②. If the asymmetry is deliberate, it needs to say so at the predicate, because nothing currently does.
3. A --verify-predicates mode that executes SHELL_COMMAND-shaped restart conditions in a sandbox and reports the ones that error rather than answer. Closes ③'s OS_CLOUD_URL=off unmounts the air-gapped install-local endpoint — the offline install path is gated on the cloud URL it is designed not to need #8343 shape. ⚠️ It cannot close [finding] 裁定 C 落地后,服务出的 openapi 文档里 components.schemas 无人引用 —— CRUD body 从具体契约退成泛 {type:'object'} #5969's or client SDK drops the precise spec types at its boundary: 32 methods return Promise< any > on a package that already depends on @objectstack/spec #8140's shape — those run fine and answer the wrong question, which no runner can detect. That half may only be reachable by requiring the predicate to state its expected output (returns 0 / prints N matches) so the text and the command can be checked against each other.

⛔ Deliberately not fixed here, on any of the 18 cards. Rewriting a predicate to satisfy a scanner pre-commits the design choice, and on cards owned by other filers it would edit someone else's record. #8343's untagged ref is reported on its own card (comment 5355407715); #8725's fired exit is reported on its own card (comment 5356711480); #10112 was unlocked with its reasoning attached.

[os-zhuang]

Triage: routed domain:skills (finding stays for the skills seat's own first-touch grading, per that lane's self-triage exception); rationale: all three defects are half-state-patrol governance — a missing blocker-liveness row (H-next), the H9 body-only asymmetry vs H4/H14, and predicate-verification for Restart-when: lines. The gauge is scripts/pm/check-half-states.mjs, whose subject is the PM label state machine — same routing precedent as #10156/#10139. Note for the skills seat: this card overlaps #10102 (backtick blindness, dispatched) on the "gauge cannot see the line" family — direction 2 here (H9 symmetric read) may be partially absorbed by #10102's fix; re-verify on the merged ref before scoping.

---

本评论来自分诊座位 Routine
Generated by Claude Code

---

Generated by Claude Code

[qq9340100]

Triage first-touch (centralized round cont., session session_01C5fGRTUHXFevsEdMEFDadM): promote to pm:queue, domain:skills (check-half-states audits the pm protocol — same ownership class as the governed-surface registers), type Task. Scope: directions 1 + 2 now (a blocker-liveness H-row resolving every Blocked-by: target's open/closed state — it would have caught both measured cases; H9 made symmetric with H4/H14 on the comment channel, or the asymmetry stated at the predicate). Direction 3's runnable-predicate verifier is design-heavy and only closes one of three shapes — the dev may propose the expected-output requirement as the follow-up but ⛔ doesn't build it here. Fold candidate with #10312 (same file, same shape — new H-rows): this card is the 链首; answer fold-or-serial against the five gates at claim time.

---

Generated by Claude Code