tooling(pm): give H22's pinned closed-update divisor the staleness alarm H8 carries

[os-steve]

Fixes #16393

H22's closed-card page budget converts to a coverage in DAYS by dividing by
MEASURED_CLOSED_ISSUE_UPDATES_PER_DAY — a hand measurement carrying its own date and
nothing else. H8 has carried a mechanical staleness alarm for exactly that shape since
#13499. H22's divisor had none, so it drifted by a factor of 1.66–2.2 in six days and no
run said a word. PR #16391 landed the acute half in prose; this is the mechanical half.

Before → After

Before — the census clause quoted the pin and stopped there:

… the stream is consumed by closed-issue ACTIVITY (~188.3/day, measured 2026-08-31), not by closures (~11/day) …

After — the same clause additionally states what THIS sweep observed, the factor, and
the act, on every run and in every state (see the live clauses below).

What changed — one file, scripts/pm/check-half-states.mjs

Applied by REUSE, not by copy, at three seams:

1. The instrument. observedMergeRatePerDay becomes the H8-named wrapper over a
   generic observedRatePerDay(rows, field). The stamp is the only thing that differs:
   H8 counts merged_at on its merged window, H22 counts updated_at on the pages its
   closed pass already reads.
2. The classifier. classifyRatePremise takes a premise descriptor
   (MERGE_RATE_PREMISE, CLOSED_UPDATE_RATE_PREMISE) carrying the constant name, the
   quantity counted, the stamp and the two prose halves. RATE_PREMISE_BAND and
   RATE_PREMISE_STALE_DAYS are therefore shared by construction rather than by two
   authors remembering to keep them equal.
3. The reading. The closed pass reports closedRateObserved from the pages it already
   holds, so it costs no request, and it rides the enumerated SWEEP_COUNT_KEYS contract.

⛔ The pin is checked, never overwritten — H8's rule. MEASURED_CLOSED_ISSUE_UPDATES_PER_DAY
(188.3) and its _AT (2026-08-31) are untouched by this PR, and the act the alarm names is
a hand re-measure and re-pin.

H8's output is byte-identical, and that is measured rather than asserted

Parameterising a shared classifier can quietly reword the caller that was already using it.
The pre-change module was imported beside the new one and both were driven over nine premise
inputs covering all four states, in both media, plus the reader's four degenerate shapes:
0 differences in state, message, pinned, ratio, ageDays or the rendered lines.

The one design decision worth a reviewer's eye

The rate is measured over the rows the pass READ, not the rows it ADMITTED. The pin
was measured over the raw stream (400 rows / 2.125 days), while the returned list holds only
the in-window closures — a strictly smaller population over a strictly shorter span. Rating
those two against each other reports the difference between two quantities as drift in one
of them. Pinned in both directions, and ablation leg B below moves the observed number from
433.33 to 436.36 by making exactly that mistake.

Live sweeps — read-only, at 31c6278237

objectstack — the alarm FIRES, as flight N's re-measure predicted:

H22's closed-card window is a TIME cap of 3 day(s), reaching back to 2026-09-03, read in 12 page(s) (boundary reached: paging ran past the horizon, not merely the first N rows). It is a CLOSURE horizon: rows are selected on closed_at, while paging is bounded by updated_at — the stream is consumed by closed-issue ACTIVITY (~188.3/day, measured 2026-08-31), not by closures (~11/day), which is why the page cap it replaced covered a ragged 2.1 days of update-recency rather than the closure window it read as. ⚠️ RATE PREMISE DRIFTED — this sweep observed ~397.9 closed-issue updates/day against a pinned MEASURED_CLOSED_ISSUE_UPDATES_PER_DAY = 188.3/day, measured 2026-08-31 (7d ago): a factor of 2.11, outside the 2x band. H22's window states its reach in days by dividing by that constant, so the coverage this very line quotes is misdescribed by the same factor. ⛔ A sweep never overwrites the pin: it is re-pinned by hand, from a fresh measurement. Re-measure.

objectui — silent:

H22's closed-card window is a TIME cap of 3 day(s), reaching back to 2026-09-03, read in 6 page(s) (boundary reached: paging ran past the horizon, not merely the first N rows). It is a CLOSURE horizon: rows are selected on closed_at, while paging is bounded by updated_at — the stream is consumed by closed-issue ACTIVITY (~188.3/day, measured 2026-08-31), not by closures (~11/day), which is why the page cap it replaced covered a ragged 2.1 days of update-recency rather than the closure window it read as. rate premise OK — observed ~175.5/day against pinned MEASURED_CLOSED_ISSUE_UPDATES_PER_DAY = 188.3/day, measured 2026-08-31 (7d ago) (factor 0.93, band 2x).

Worth the seat's attention: the pin was measured on objectstack, and it now describes
objectui (factor 0.93) better than the board it was taken on (factor 2.11). That is a
reading, not a re-pin — this PR changes no constant.

Self-test

2588 → 2636 cases (+48), exit 0. Every new case is named #16393 …; all 48 were
observed running in the passing output, not inferred from the total.

Coverage: the shared instrument (delegation identity, stamp selection, the three
unmeasurable shapes); H22's premise through its descriptor in both directions (it names
H22's constant and quantity, never H8's, and H8's own defaults are unmoved); the three
verdicts plus the band edge; the calendar leg firing past the horizon at any rate; two
synthetic streams driven through the real pager (2.30x fires, 1.06x stays silent); and
the clause in both loud and quiet form.

⚠️ Clause wording is pinned through h22RatePremiseClause with a fixed nowMs. The summary
line reads the real clock, so a case asserting a verdict through it would go red on a
calendar date rather than on a defect — the permanently-red gate this repo retires. The
cases that do run through summaryLine assert only time-independent properties.

Ablation — three legs on the new predicate

Each leg: mutate → prove the mutation reached the disk by hash → run → restore against
HEAD → prove the restore by hash and an empty git diff HEAD. An absent or unchanged
hash is read as FAILURE, never as "nothing to compare". No build leg applies: this module is
run directly by node, so there is no dist/ between the edit and the run.

leg	mutation	hash moved	self-test
A — the alarm	the clause never marks a fired premise loud	0671dc4f → 9ae383a8	exit 1, 4 cases red
B — the population	rate the rows ADMITTED instead of the rows READ	0671dc4f → e7b729d9	exit 1, 5 cases red (433.33 → 436.36)
C — the descriptor	classifyRatePremise ignores premise	0671dc4f → 6158c444	exit 1, 12 cases red

All three restored to 0671dc4f (the HEAD blob), git diff HEAD empty, and the self-test
re-ran green at 2636 afterwards.

Gates — every exit captured before any pipe, at 31c6278237

• dispatch-gates --commands --repo objectstack-ai/objectstack on the final file list →
  36 commands; all 36 run, all exit 0.
• dispatch-gates --ran reconciliation → ✓ 36 derived famil(ies) accounted for — 36 run, 0 NOT-MEASURED, 0 UNRUN.
• check-half-states --self-test → exit 0 (2636 cases).
• check-clause2-carriers --self-test → exit 0 (190 cases).
• check-governed-merges --test scripts/pm/check-half-states.mjs → exit 0:
  ✅ NOT governed — ordinary queue landing applies to a PR with exactly this file list.
• check:nul-bytes → exit 0; plus an independent control-byte scan of the changed file, 0 hits.
• Whole-repo pnpm lint (eslint . --no-inline-config) through os-verify-lock.sh
  (slot issue-16393) → VERDICT command-exit 0 · held the lock 80s · waited 0s. The full
  repo scan, not a narrowed one.

skip-changeset: this diff publishes nothing from any released package — it is one
patrol-tooling script under scripts/pm/.

---

Generated by Claude Code

[claude]

ACCEPT — in-seat review of PR #16406, head 31c6278237 (skills seat, 2026-09-06T20:0xZ).

Implemented-by: claude/issue-16393-h22-divisor-staleness-alarm (os-dev subagent, opus — no path-derived tier mandate on scripts/pm/**)
Reviewed-by: session_019RfFHiRCSs3JXLK4cwcfox (skills seat)

Verified in a detached compare worktree at the PR head, not from the report:

• One file, scripts/pm/check-half-states.mjs (+305/−30), H8's staleness alarm applied to H22's divisor by reuse. Three seams, each read by the seat: observedMergeRatePerDay is now the H8-named wrapper over a generic observedRatePerDay(rows, field); classifyRatePremise takes a premise descriptor (MERGE_RATE_PREMISE / CLOSED_UPDATE_RATE_PREMISE), so RATE_PREMISE_BAND and RATE_PREMISE_STALE_DAYS are shared by construction; the closed pass reports closedRateObserved from the rows it already reads (updated_at span), riding SWEEP_COUNT_KEYS with a null default. H22's census clause states the pinned rate, the observed rate, the factor and the act in every state; the pinned MEASURED_CLOSED_ISSUE_UPDATES_PER_DAY = 188.3 and its _AT are untouched (one occurrence, unchanged) — the alarm names a hand re-measure and re-pin, never an auto-update. No new H-row; family markers and PM_RESIDUE_LABELS untouched; no SKILL.md line-number citation.
• Gates at the head: check-half-states --self-test exit 0, 2636 cases (2588 before, +48 all named #16393, counted in the passing output); check-clause2-carriers --self-test exit 0 (190); check-governed-merges --test exit 0 (NOT governed ⇒ queue landing). The dev's report adds the derived union 36/36 with --ran at 0 NOT-MEASURED, whole-repo pnpm lint through the verify lock in one acquisition, three ablation legs on the new predicate (the loud mark, the admitted-vs-read denominator, the descriptor) each proven on disk by blob hash and each red — 4, 5 and 12 cases — then restored to the HEAD blob with an empty diff, and H8's rendered output measured byte-identical across nine premise inputs. PR checks on 31c6278237: 24 success, 11 skipped, 0 failed (35 runs, converged).
• Live readings, which are the card's acceptance: objectstack — RATE PREMISE DRIFTED — ~397.9 closed-issue updates/day against a pinned 188.3/day (measured 2026-08-31): a factor of 2.11, outside the 2× band (12 pages, horizon reached); objectui — rate premise OK — ~175.5/day, factor 0.93. The alarm fires where flight N predicted and is silent where the pin still holds; the re-pin on objectstack is a hand act the seat schedules separately, not this PR's.
• Report hygiene: os-dev-report on check-half-states: H22's pinned closed-update divisor has no staleness alarm (H8 has one for its rate premise) — the board now runs 1.7–2.2× the 2026-08-31 pin #16393, JSON closes; PR body opens Fixes #16393; no model identifier; skip-changeset read back; one MCP call declared (the PR creation).

Landing regime: pure code ⇒ the seat flips ready and arms SQUASH auto-merge in this same act; the merge is read on the PR object, never inferred. On the merge #16393 closes by Fixes.

---

Generated by Claude Code