pm(half-states): H66 lists a released pm:queue card whose remainder is not work (#18514)

Fixes #18299

A card released with a remainder **no dev can execute** — a maintainer
ruling, a reading only the reporter can take, a confirmation owed by
another seat — wears `pm:queue` with no assignee, which the queue view
and 「最老优先」 both read as ready to hand to a dev. The label cannot tell
that apart from real queue work; only the card's newest seat comment
can, and reading that costs a full card read per candidate.

H66 is the detector the card asks for: **report-only, a listing, never a
relabel and never a gate verdict**.

_Authored by `session_01Gqi43smmqjJ5sUrhfoPeKu` (Claude Code). Every
reading below was taken on this branch at **`301de97`**, the head this
body describes._

## The clause it enforces

Two lines of `.claude/skills/pm-dispatch/SKILL.md`, quoted verbatim in
the row's own sentence:

- 「`pm:queue` = 有具名落点或复现的具体缺陷,或范围明确的工具/门禁修复,无可问之事。」 — the label is a
**definition**, not a habit.
- 「释放是显式动作:让卡离手者同笔清 assignee + `Release:` 行(会话/因/去向);下一任重新认领。」 — the
release act, whose 去向 field is the only thing that can say where the
card went.

⛔ The row does **not** decide the state question. Whether these cards
belong in `needs-user-decision`, in `pm:awaiting-maintainer` or in a
spelling that does not exist yet is left open exactly as the card leaves
it; the remedy the row prints is 「judge by hand — this is a listing」.

## The measurement — the dispatch's A1 was falsified before anything was
built

A1 assumed the machine-readable half is the `Release:` line's third
field (去向). Measured 2026-09-16 over both boards the filing card names,
read-only:

| corpus | threads | `Release:` lines | release announced in a heading |
|:--|--:|--:|--:|
| objectui#7696 · #8167 · #8826 · #8938 (the filer's four) | 4 | **0** |
**3** |
| objectstack, 25 most recently updated open unassigned `pm:queue` cards
| 25 | **0** | 0 |

**Zero of 29.** The lit control for that zero is the prose leg read by
the same fetch over the same threads: it answers **three** on the same
four specimens, so the zero is a property of the board, not of a broken
reader.

⇒ Both legs ship, the canonical one **first**. It is kept, not dropped,
for a mechanical reason: H47 exists to report exactly that absence, and
as it is answered the canonical line starts appearing — on that day it
is the only reading that can tell a return-to-queue (去向 = `pm:queue`, ⛔
never a finding) from an exit, because both are written in the same
announcement heading otherwise. The summary clause publishes the zero on
every run.

The prose leg's three anchors are frozen beside the live comment each
was measured on — objectui#7696 `5664140343`, #8167 `5663517223`, #8938
`5668851500` — and the third anchor named by the filing card itself is
labelled `measured: false`, so nobody later reads it as a measurement.
Matching is **heading-anchored** (H58's fence/blockquote/table/code-span
refusals, reused): the filing card, this PR and the row's own docblock
all quote the spellings, and none of them may fire.

⚠️ `pm:queue` is **not** read over the whole comment body, and that is
measured rather than stylistic: the two live release comments on
objectui#8167 and #8938 both say 「`pm:dispatched` stripped, `pm:queue`
added」 in their state-write paragraph, so a body-wide read would clear
precisely the specimens this row exists to list.

## The bounded fetch leg — and why the first landing needed one

The row first shipped buying **nothing**: one `commentCache` lookup per
card. The first live sweep measured what that costs — **194 candidates,
a thread in hand for 1**. The corpus is thin *by construction*, not by
luck: the only row that buys a card thread for a pm-tracked card is H2's
claim read, and H2 buys one only for an **ASSIGNED** card, which is this
population's exact complement. A listing that cannot see 99.5% of its
own population is a row whose silence means nothing, and the filing
card's own criterion already asks for the fetch — 「fetch the newest
comment authored by a seat」.

So a **bounded buy pass** now sits at the foot of the sweep:

- **One page per card, the NEWEST one**, located from the card's own
`comments` count through H65's exported `h65NewestPagePlan` /
`h65CommentPagePath` rather than a second copy of the arithmetic. ⛔
Never page 1 on a long thread: GitHub serves issue comments
OLDEST-FIRST, so a page-less read returns the archive (the #18312
measurement — five weeks stale on a long thread).
- **Ordered newest-touched first** (`updated_at` descending, `number` as
a total-order tiebreak; an unreadable stamp sorts **last**, never
promoted ahead of a dated card). A release is a write on the card, so
that is where fresh evidence lives — deliberately the opposite of the
dispatch order 「最老优先」, which says which card to *work*, not where the
evidence *is*.
- **Capped** by a named, frozen `H66_THREAD_BUY_CAP = 100`. The standing
caller is `half-state-patrol.yml` on `PATROL_CRON` = `37 1,7,13,19 * *
*` — four runs a day — under the Actions token's 1000 requests/hour per
repository, beside the sweep's existing label pages, listings, PR
windows, H50 walks, H43 probes, H45 parent reads and seat pages.
- **A cap is not a coverage claim.** Candidates past it are NOT
ATTEMPTED and counted separately (H40's posture). A fetch that fails, or
a carrier whose `comments` count is unreadable *and* whose page 1 came
back FULL (so the newest comment cannot be located), leaves that card
**UNJUDGED** — never clean, the H4 three-state contract — and is counted
as such.
- **Placement is mechanical**: after every row that reads
`commentCache`, because a newest page is not the same object as the
first page that cache holds. The write-back is guarded to the one case
where the bought page **is** the whole thread (`plan.page === 1`);
`seatPostRowsFor` keeps its own window out of that map for exactly this
reason, and this applies the same rule to the one case where the two
coincide. A card whose thread is already in hand is judged in place,
free, and never deferred — so never re-bought.

`seatWindowAudit` gains **`seatPurchaseSites`**. The buy adds a second
located-page purchase, so rather than raise the file-wide pin from 1 to
2 and lose the argument behind it, the seat-post bound is split out and
stays at **1** — the new purchase is on a disjoint population (an
unassigned `pm:queue` CARD, never a `pm:seat` post), so it cannot be the
「same page bought twice」 the original bound is about.

## Disjointness (the dispatch's A3), and the one overlap stated rather
than hidden

- **H8** requires `pm:dispatched`; this population is `pm:queue` without
it. Disjoint by label.
- **H47** leg (a) requires an assignee; leg (b) is the **inverse** of
this row — it fires when a `Claim:` is the newest ownership record and
no `Release:` answers it. On the canonical leg `releaseAnswersClaim` is
true and H47 returns null.
- **H49** requires `pm:dispatched` and an assignee. Disjoint.
- **H58** reads the card's own declaration of what it IS; this reads the
release record of where it WENT. A card may wear both and fire both —
two readings, never one restated.
- ⚠️ **The overlap:** on the prose leg the release was never written as
a canonical line, so H47 leg (b) fires too. That is correct and is a
different defect (a record missing its canonical line) from this one (a
card in the dispatch pool with a remainder). Asserted as a case, not
hidden.

Population excludes an assigned card (H24's row) and any card carrying a
second member of `PM_EXCLUSIVE_STATE_LABELS` — that pair is H3's, H25's
or H29's contradiction. One vocabulary, ⛔ not a second list.

## Battery roster and floor

This file printed **one total** over a flat case list — the shape
AGENTS.md 「Writing a `--self-test`」 names as evidence rather than proof.
The handshake (`SELF_TEST_VERDICT`) was already here; the floor was not.
This PR adds the other half, copied from
`scripts/check-agent-model-declared.mjs` and ⛔ never imported:

| battery | registered at `301de97` | pin |
|:--|--:|--:|
| `H66 released queue card` | 183 | **172** |

Three failure conditions, each producing a real `process.exit(1)`: a
declared battery below its pin; a case registered against an undeclared
battery; the roster below `SELF_TEST_BATTERY_FLOOR`. ⚠️ The roster is
**partial and says so**: the several hundred pre-existing `t(...)` cases
stay unbatteried, and retrofitting them is a diff of its own.

Cases cover every clause the dispatch named — (a) a 去向 naming a
non-queue owner ⇒ listed · (b) 去向 = `pm:queue` ⇒ silent, including where
an announcement heading sits beside it · (c) both prose forms ⇒ listed ·
(d) any later comment ⇒ silent, structurally, because the row reads the
newest · (e) an assigned card ⇒ outside the population · (f) no comment
at all ⇒ silent — plus the seven quoting shapes that must not fire, the
anchor set's cap/freeze/provenance, the three-input-state contract,
band, registry coverage, and the summary clause in both media. The buy
leg adds: the cap respected when candidates exceed it, newest-touched
ordering with the undated card last, a bought page judged by the same
predicate as a cached one, a failed buy read as UNJUDGED, and the two
source-audited guarantees below.

## Measurements — all at `301de97`

**Gates** — `node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack` derived **40** commands at `301de97`; all 40
run, each exit code captured by redirect-then-`$?` and never through a
pipe, **40 exit 0**. Reconciled with `--ran`: 「40 derived famil(ies)
accounted for — 40 run, 0 NOT-MEASURED (a DERIVED zero — all 40 recorded
an exit code and none of them is 3)」.

**Lint** — the whole-repo run, not a narrowing: `pnpm lint` = `eslint .
--no-inline-config` over eslint's own population of **6,798 files**,
exit **0** at `301de97`.

**Self-test** — `node scripts/pm/check-half-states.mjs --self-test` and
`pnpm check:pm-half-states` at `301de97`: exit 0, 「4546 cases pass.
Batteries: H66 released queue card 183/172.」

**Live sweep** — report-only, from an agent container at `301de97`, exit
**0**: 465 half-states over 397 pm-labelled issues. The H66 clause, the
new **quadruple**:

> Released queue cards (H66): **197** open unassigned `pm:queue` card(s)
could be spoken about, **1** with a comment thread ALREADY in hand,
**100** NEWEST comment page(s) BOUGHT this run (cap 100, **96**
candidate(s) NOT ATTEMPTED at that cap), **0** listed. **0** card(s)
stayed UNJUDGED.

⇒ the leg works and costs what it declares: 100 pages bought, every one
read, nothing unjudged. The board genuinely has no card in this shape
right now — the filing card's own four specimens were all dispositioned
by hand between filing and this build. Before the leg the same sweep
read `194 / 1 / — / 0`, i.e. the row could see one card in two hundred.

**Request count** — the run total is **NOT MEASURED**: the script
exposes no request counter, and the container's `/rate_limit` proxy
reported a full 15000/15000 both before and after with the quota window
rolling between the two reads, so the delta is not a measurement either.
What *is* exposed is the leg's own cost, and it is exact:
`queueReleaseBought` = **100**, one request each, printed on the summary
line every run.

**Ablations** — three, each mutating the committed tree, proving the
mutation on disk by occurrence count, restoring with `git checkout HEAD
-- path` under a `trap`, and verifying the restore by blob hash against
`git rev-parse HEAD:path` plus an empty `git diff HEAD`:

1. the release-announcement anchor rewritten so it can never match ⇒
**29 named cases red**, suite runs to completion, exit 1.
2. the battery pin raised above the registered count ⇒ 「the battery
floor failed — battery 「H66 released queue card」 registered 183 case(s),
below its pin of 200」, exit 1.
3. the defer guard removed, so a thread already in hand would be
re-bought ⇒ exactly **one** named case red — 「⭐ …and that place is
guarded by the cache test, so a thread ALREADY in hand is never
re-bought (got 0, want 1)」 — exit 1.

Control after every restore: exit 0, 4546 cases pass. ⭐ The first
ablation also found two real defects in the battery it was measuring — a
direct `[0].heading` and a direct field read on a three-valued helper,
each of which **aborted the whole suite** with a TypeError instead of
reporting a case. Both are now read through describing readers, with the
measurement recorded beside them.

**Renderers** — both, offline over a synthetic finding: `renderPlain`
and `renderMarkdown` each render the `H66` row, the clause with its
counts, and the markdown family ledger names `H66`.

## Scope

`scripts/pm/check-half-states.mjs` only. ⛔ objectui's copy is
byte-pinned there and is not touched. `skip-changeset`: `scripts/pm/**`
is the fast lane and nothing in any package's `files[]` moves.

---
_Generated by [Claude Code](https://claude.ai/code)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-justin