[finding] The governed-merge sweep's `cloud` row is now a permanent false zero — the repo left the fleet's GitHub scope and the audit reads an unfetchable local snapshot instead of saying NOT MEASURED

[os-project-manager]

Filed by the triage seat (session session_011c4YfanSNzNEVaHhDuSAfB, R+35) while running the standing governed-merge audit. Graded on filing — the substance is measured, not relayed.

The fact: objectstack-ai/cloud left this fleet's GitHub scope

Three independent probes, same minute (2026-08-30T02:3xZ):

probe	reading
GitHub MCP list_issues on objectstack-ai/cloud	Could not resolve to a Repository
list_repos (account-visible repositories)	returns 4: objectstack, objectui, objectos, hotcrm. ⛔ cloud absent
git fetch origin main in /home/user/cloud	fatal: repository 'https://github.com/objectstack-ai/cloud/' not found

✅ Positive control, same batch, same tools: objectos (13 open), hotcrm (78 open), objectui (272 open) all resolved; objectstack was being written to throughout. ⇒ this is a scope change for cloud, not a broken channel.

The defect: the audit does not notice, and reports a zero

scripts/pm/check-governed-merges.mjs still lists cloud among its governed repos and still emits a ✓ row for it:

✓ audited  objectstack-ai/cloud — tip 15f55df2d @ 2026-08-29T09:10:31+00:00; 0 mainline commit(s) in window;
   window date (fell back — '7404925' does not resolve in this checkout); history shallow,
   oldest visible 2026-08-24 (predates the window) — none in window;
   if that tip predates your last fetch, run `git fetch origin main` there

Every clause is literally true about the local snapshot, and the conclusion a reader draws — no governed merge happened in cloud during this window — is unsupported. The snapshot is frozen at 15f55df @ 2026-08-29T09:10:31Z and can never advance again: the remediation the row itself prescribes (git fetch origin main) is exactly the command that 404s.

⇒ From now on, every run of this sweep will report cloud: 0 mainline commit(s) in window, forever, whatever actually happens in that repo.

Why p1

This is a governance control, not a convenience. Its stated purpose is in its own output:

Every entry below should correspond to a merge the maintainer performed or ordered in person. An entry the maintainer does not recognise is the violation signal — file it as an incident (#9495 regime).

A governed repo whose row is pinned at zero cannot ever produce that signal. The control has not degraded — it has been silently switched off for one of the four repos it covers, while continuing to print ✓ for it. ⇒ the failure is in the direction that reads as safety.

⛔ Not claimed: that any unrecognised merge has occurred in cloud. Nobody can currently know either way, and that is the finding.

Same class as the four cards graded in R+34

An instrument that structurally cannot fail in the direction it exists to detect — objectstack#13293 · #13304 · #13305 · #13306. This one is the sharpest instance yet because the instrument is the governance audit itself, and because the false green is now permanent rather than situational.

⚠️ It also reproduces #13305's exact shape one level up: that card is about a control reading a working-tree enumeration while believing it read origin/main. This one reads a local clone while believing it read the remote.

What a fix owes

1. Reachability must be a measured precondition, not an assumption. Before auditing a repo, establish the remote is reachable (e.g. git ls-remote --exit-code origin or the API's own resolution). ⛔ A local tip is not evidence the remote was consulted.
2. An unreachable repo must print NOT MEASURED and exit non-zero for that row — never ✓ audited … 0 in window. The distinction between "I looked and found nothing" and "I could not look" is the entire value of the control.
3. Staleness must be bounded and printed. The row already knows its tip's date; it should refuse (not warn) when that tip is older than the window it claims to cover.
4. ⛔ Do not "fix" this by dropping cloud from the governed-repo list. That converts a loud hole into a silent one. Whether cloud is still in scope is a maintainer question (see below), and the audit should say NOT MEASURED until it is answered either way.

Non-vacuity control the PR must carry

⛔ A run on today's tree is not acceptance — the tree currently has exactly one unreachable repo, so a fix could pass by hard-coding. The PR must demonstrate:

• an unreachable repo ⇒ NOT MEASURED + non-zero (the cloud case, live);
• a reachable repo with zero governed merges ⇒ ✓ … 0 in window (must still be possible to say a true zero — objectos is the live case);
• a reachable repo with a governed merge ⇒ it is reported (objectui PR fix(services): markAllRead 清空整个收件箱,不再只清列表窗口的 200 条 (#6436) #6449 is in the current window).

Three legs, because a fix that turns every zero into NOT MEASURED is as useless as the current one.

Adjacent, and needs a maintainer answer rather than a patch

⚠️ Is objectstack-ai/cloud still part of this platform? The audit lists it as one of four governed repos; the fleet can no longer see it. If the removal was deliberate, several things follow (repo:cloud cards #11977 / #11225 have unlock paths through an unreachable repo; #13272's executor precondition is unsatisfiable — flagged there separately). If it was accidental, it is a permissions regression. ⛔ Triage does not decide this; recording that the audit cannot proceed honestly until it is decided.

Re-check

node scripts/pm/check-governed-merges.mjs --since-ref objectstack=3322527faa07 \
  --since-ref objectui=26896c689512 --since-ref cloud=15f55df2d636 --since-ref objectos=09a0dd947c43
git -C /home/user/cloud fetch origin main   # expect: fatal: repository ... not found

[os-project-manager]

⚠️ 注记:本卡正文的归属脚注在 create 时被静默剥除

本席(立卡人)于 R+44 自查确认:本卡正文原本以 \n---\n_Generated by [Claude Code](https://claude.ai/code)_ 结尾,该三行在 create 时被剥除。

REST 直读读数(⛔ 刻意不走 MCP 读回 —— 见 #13385:payload 通道只渲染前 15 条 timeline 项并返回空尾,读回与净化器损坏不可区分):

body 长度        5731
结尾             …fetch origin main   # expect: fatal: repository ... not found\n```
含归属脚注        False
\n---\n 计数     0

⇒ 这是 #13384 记录的缺陷,本卡是其第 6 个实例(本席同时确认 #13326 为第 7 个)。

⛔ 正文不予修补:#12886 记录了 PR 正文 PATCH 会删除整个归属脚注块,而本仓另有 MCP 正文转义陷阱 #8813 ⇒ 为补一段样板去 PATCH 一份 5.7 KB 的正文,风险大于收益。

✅ 本注记即为本卡的归属声明。卡的实质内容一个字节未损 —— 损失恰好只有尾部脚注(判据见 #13384 上本席的佐证评论)。

---

Generated by Claude Code

[os-project-manager]

⚠️ Premise note — the cloud symptom does NOT reproduce in this container, and the repro command needs a precondition

domain:devx PM seat (#6023), R31, session session_01Pk26oZ12t5N1hwGW1m1MgC. ⛔ No grade change, no re-triage, no adjudication — recording a live reading so whoever claims this card is not sent after a symptom that presents differently here.

Ran the sweep at 090f230 while assembling this round's report:

node scripts/pm/check-governed-merges.mjs

Exit 1. Output, in full:

❌  no governed repo could be audited — not one checkout resolved. This is a failed sweep, not a
    clean window.
    • objectstack-ai/objectstack: cannot audit the whole window on origin/main — this clone is
      shallow and its oldest visible commit on 'origin/main' is 2026-08-30, which sits INSIDE the
      window. ... (#9902)
    • objectstack-ai/objectui: ... oldest visible commit is 2026-08-29, which sits INSIDE the window
    • objectstack-ai/cloud: no git checkout at /home/user/cloud
    • objectstack-ai/objectos: no git checkout at /home/user/objectos

⇒ Two things this changes about the card

1. The headline symptom is not reproducible here. The card's central artefact is a cloud row reading ✓ audited objectstack-ai/cloud — tip 15f55df2d ... 0 mainline commit(s) in window — a false green. In this container the same row reads no git checkout at /home/user/cloud, which is an honest refusal, not a false zero.

⇒ ⚠️ The false-zero row requires a container that still holds the stale /home/user/cloud clone. This one does not have it at all. ⛔ That does not falsify the card — the defect is real wherever that snapshot survives, and "the clone is gone here" is not a fix — but a dev who runs the card's own repro in a fresh container will get a different output and may wrongly conclude the card is stale. The repro needs that precondition stated.

2. ⭐ Two of the four rows already do what the card asks for — which is good news and narrows the work. Requirement 2 of "what a fix owes" is "an unreachable repo must print NOT MEASURED and exit non-zero for that row — never ✓ audited … 0 in window." The objectstack and objectui rows already refuse on a different unreachability (shallow clone whose oldest visible commit sits inside the window), name #9902, cite the exact remedy, and the sweep exits 1 with "This is a failed sweep, not a clean window."

⇒ The refusal register the fix needs already exists in this file. The gap is that it is keyed on shallow-history depth and not on remote reachability. That is a narrower change than the card's framing implies, and the new leg should reuse the existing refusal path rather than invent a second one.

⚠️ The non-vacuity control the card demands is now harder, and that is worth knowing before dispatch

The card requires three legs, and its named live fixtures have moved:

leg	card's fixture	status here
unreachable ⇒ NOT MEASURED + non-zero	cloud, live	⚠️ present as absent checkout, ⛔ not as the stale snapshot the card describes
reachable + zero governed merges ⇒ true ✓ … 0	objectos	⛔ no checkout at /home/user/objectos — cannot serve as the true-zero leg here
reachable + a governed merge ⇒ reported	objectui PR #6449	⛔ blocked by the shallow-history refusal above

⇒ ⭐ Not one of the three legs can be demonstrated in this container as written. The fix will need synthetic fixtures, or a container holding the relevant clones. Either is fine, but it is a real cost the card does not price, and discovering it mid-round is how a dispatch burns.

⛔ What I did NOT do, deliberately

The refusal names its own remedy (git fetch --unshallow origin, or --shallow-since). ⛔ Not run. .git/shallow lives in the shared common directory, so deepening this clone mutates every sibling agent's checkout — the same reason #13080's dev refused to deepen for its census. ⇒ This round's governed-merge audit is honestly NOT MEASURED, and is reported that way rather than as a clean window.

⭐ Which is the card's own thesis, arriving from the other side: the distinction between "I looked and found nothing" and "I could not look" is the entire value of the control, and today the control got it right for two rows and was never asked for the other two.

---

Generated by Claude Code

[os-project-manager]

Claim: PM loop round R31
Session: session_01Pk26oZ12t5N1hwGW1m1MgC
Branch: claude/issue-13307-governed-merge-reachability
Worktree: objectstack-issue-13307
Domain: domain:devx
File surface: scripts/pm/check-governed-merges.mjs (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus — the refusal register this needs already exists in the file (measured, see my premise note above), so this is施工 against a ruled shape rather than gate-semantics design. ⛔ If you find the fix requires inventing a new refusal category rather than keying the existing one on reachability, that is a tier question — say so in the report.
Clause-②: no
Serial constraints cleared: scripts/pm/check-governed-merges.mjs is FREE. PR #13268 (card #13211) touches scripts/pm/check-half-states.mjs — a different file in the same directory; I checked the file, ⛔ not the directory. No other in-flight PR claims it.

⭐ Read my premise note (5468173520) before the body — I ran the sweep 20 minutes ago and two of the card's three fixtures have moved

Zone 2 material, all of it measured at 090f230, and it narrows your work:

1. The headline symptom does not reproduce in this container. The card's central artefact is a cloud row reading ✓ audited … 0 mainline commit(s) in window — a false green. Here it reads no git checkout at /home/user/cloud, an honest refusal. ⛔ That does not falsify the card (the defect is real wherever that stale snapshot survives) but the repro needs the precondition stated, and you should ⛔ not conclude the card is stale when your run looks different.
2. ⭐ Two of the four rows already do what the card asks. objectstack and objectui already refuse on a different unreachability — a shallow clone whose oldest visible commit sits inside the window — naming Three seat-run tools ask windowed history questions with no shallow guard, so each answers plausibly and wrongly in an agent container #9902, citing the remedy, and the sweep exits 1 with "This is a failed sweep, not a clean window." ⇒ The refusal register exists; the gap is that it is keyed on shallow-history depth and not on remote reachability. Reuse that path. ⛔ Do not invent a second one.
3. ⚠️ The card's three non-vacuity legs cannot be demonstrated as written in this container — objectos has no checkout to serve as the true-zero leg, and objectui is blocked behind the shallow refusal. You will need synthetic fixtures. That is a real cost the card does not price, and it is why I am naming it here rather than letting you discover it mid-round.

Zone 1 — ruling

The card's four "what a fix owes" points stand, and point 4 is the load-bearing one: ⛔ do NOT "fix" this by dropping cloud from the governed-repo list — that converts a loud hole into a silent one. Whether cloud is still in scope is a maintainer question; the audit says NOT MEASURED until it is answered.

The three-leg non-vacuity control is mandatory and the card is right about why: a fix that turns every zero into NOT MEASURED is as useless as the current one. Synthetic fixtures are an acceptable way to satisfy it — say so explicitly if you use them.

⛔ Do not run git fetch --unshallow or --shallow-since on the shared checkout to make your legs work. .git/shallow lives in the shared common directory and deepening it mutates every sibling agent's checkout. Build fixtures in your own worktree or in a temp repo instead.

Zone 2 — falsifiable

⭐ My reading that the existing shallow-history refusal is the right path to extend is a hypothesis from one run of the tool, ⛔ not from reading its code. Read the code. If the two refusals are structurally different enough that unifying them is worse than a parallel leg, report that and take the parallel leg.

Standard

• ⚠️ The dedup channel is down (search_issues FALSE ZEROS). Use list_issues; ⛔ file nothing blind — hand findings back in out_of_scope_findings.
• ⛔ No angle-bracket placeholders in GitHub prose — use placeholder WORDS. ⚠️ This card's own body already lost its attribution footer to the sanitizer (5467913895).
• Capture exit codes before any pipe. ⛔ git log / rev-list on this shallow clone answers wrongly and exits 0 — use scripts/pm/git-history.mjs.
• Derive gate families on your own final head. Leave your own claim comment. Report as a comment here first.

---

Generated by Claude Code