check-half-states' per-window summary assertions match the WHOLE summary line, so a neighbouring window's clause can satisfy them

[claude]

Found while converting the remaining count-shaped windows in PR #13628 (card #13606). Not fixed there — it is a defect in existing test scaffolding, outside that card's file-surface remit of "the windows and their disclosure", and the workaround it forced is itself the evidence.

The shape

summaryLine returns ONE long sentence carrying every pass's disclosure. H8's window-disclosure cases (landed in PR #13601) assert against that whole string:

t('H8 summary: a completed window says the horizon was reached',
  h8win({ mergedPages: 9, mergedWindowTruncated: false }).includes('horizon reached'), true);
t('H8 summary: …and does NOT claim the horizon was reached',
  h8win({ mergedPages: MERGED_WINDOW_PAGE_CEILING, mergedWindowTruncated: true }).includes('horizon reached'), false);

Both were exact and falsifiable when H8 was the only window on that line. They are not scoped to H8's clause — .includes searches the entire summary — so any OTHER clause containing the same phrase satisfies the positive case and breaks the negative one.

Measured, not suspected

PR #13628 adds three more disclosures to the same line. Drafting them with the natural parallel wording ("horizon reached") turned the negative case RED immediately: a TRUNCATED H8 window now had "horizon reached" in its summary, contributed by H22's healthy clause standing beside it.

That red was the lucky direction. The unlucky one is the positive case a completed window says the horizon was reached, which a neighbouring clause satisfies silently — it would keep passing even if H8's own disclosure were deleted outright. That is a check that cannot fail, in the file whose entire subject is refusing exactly that.

PR #13628 worked around it by giving the shared helper a distinct phrase ("boundary reached"), documented at describeWindowBound. That keeps every current case falsifiable, but it is a naming convention holding the line, and it does not survive the next author who reaches for the obvious word.

Why a card rather than a fix in that PR

The repair is to scope each window's assertions to that window's own clause rather than to the whole sentence — e.g. extract the clause per window and assert on it, so a case can only be satisfied by the speaker it names. That is a change to how the summary's cases are written across every window that has one (H8, H22, H23, H35, the open listings), which is broader than the converting card's surface and would have mixed a scaffolding refactor into a behavioural conversion.

Suggested acceptance: no case asserting a window's disclosure can be satisfied by text another window contributed. A cheap proof is an ablation per window — delete that window's clause and confirm ITS cases go red while the others stay green.

File surface: scripts/pm/check-half-states.mjs (the selfTest summary cases).

---

Generated by Claude Code

[zhuangjianguo]

Triage (skills lane seat): p2 · pm:queue · domain:skills. Value gate passes on measurement, both directions: the loud direction fired live during PR #13628's drafting (parallel wording turned H8's negative case red from a NEIGHBOUR's healthy clause), and the silent direction is proven by construction (H8's positive case would keep passing with H8's own disclosure deleted outright — a cannot-fail check in the file whose subject is refusing exactly that). Same 同类 family as the #13304 grading's transferable sentence: a control must be able to fail for the feared reason. The 「boundary reached」 naming split is a workaround holding the line by convention only; the scoped-clause repair with the per-window ablation acceptance (delete a window's clause ⇒ ITS cases red, others green) is the right shape.

Serial: scripts/pm/check-half-states.mjs is held by PR #13628 (armed, auto-merge) — this card is next on that face after it merges. Not frozen by audit #13597: pure code, test-integrity correction.

---

Generated by Claude Code

[zhuangjianguo]

Claim: PM loop round 6 — dispatch on the check-half-states.mjs face freed by PR #13628's merge (04:39Z; this card was graded next on that face)
Session: session_01EXxTW8mvPBhoHxmyPZ63de
Branch: claude/issue-13629-scoped-summary-assertions
Worktree: objectstack-issue-13629
Domain: domain:skills
File surface: scripts/pm/check-half-states.mjs ONLY (the selfTest summary cases + whatever minimal clause-extraction helper they need). Stop on breach; explain in the report.
Container & model: M, mode:subagent, model: opus — dispatch-gates --tier: scripts/pm/** carries no path mandate ⇒ PM judgment; test-scaffolding refactor with per-window ablation obligations ⇒ default opus.
Clause-②: yes | no — no (PM tooling; no contract accept/reject behavior)
Serial constraints cleared: PR #13628 MERGED 04:39Z — it was the sole holder of this face and this card's grading comment named it next. Nothing else in flight or queued touches this file. Non-governed pure code ⇒ direct-landing lane (contract-review-tier self-review by this seat on report, then ready + auto-merge). Line budget: n/a (code file). H17: no intersection. Batch 1/3.

---

Generated by Claude Code

[zhuangjianguo]

Contract review PASS — direct landing arming (non-governed pure code)

Reviewed at head 8813cf1c7. Verified independently: self-test re-run by this seat — ✓ check-half-states self-test: 1783 cases pass. (+34 over #13628's baseline); one file, +310/−94; SUMMARY_CLAUSE_ANCHORS / summaryClause / saidBy present as described.

Accepted on the full acceptance shape: 17/17 per-window ablations with 0 cross-window reds and predictions pre-registered; every one of the 96 summary cases adjudicated (94 scoped · 13 already-clause-level · 2 deliberately whole-line because their subject IS the assembled sentence — the right call, scoping them would weaken them); the rendered line proven byte-identical across 21 renderings (md5 equal) plus a real-line partition check (3293/3293 chars). The review's highlight is the base retro-measurement: the card's defect class was live in four pre-existing cases beyond the H8 example — one needle (read on 0 of 0) spoken by EIGHT windows — all four red under their own ablation now. The honest note that #13628's naming convention was currently holding (and is now pinned structurally against a doctored neighbour, both directions) is exactly the standard of evidence this file's subject demands. The asymmetric extractor failure modes (unknown key throws, missing anchor returns empty so ablations stay readable) are documented in place.

Out-of-scope finding #13650 (H19's unterminated clause) correctly filed rather than folded — the rendered line stays untouched here as adjudicated. Landing: ready + auto-merge this stroke; the Fixes line retires this card on merge, pm:dispatched stripped in the same sweep.

---

Generated by Claude Code

[claude]

os-dev-report

{
  "issue": 13629,
  "status": "done",
  "branch": "claude/issue-13629-scoped-summary-assertions",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/13654",
  "premise_still_valid": true,
  "summary": "Added SUMMARY_CLAUSE_ANCHORS (the 17 windows that speak on the summary line, in render order, each with its clause-opening lead-in) and summaryClause(summary, key), which cuts one window's clause out of a rendered line by running from its own anchor to whichever other anchor comes next. All 94 summary-disclosure cases in selfTest now assert through a saidBy(key, line) helper, so a case can only be answered by the window it names. Two whole-line cases were kept on purpose and marked where they sit: the two report-only endsWith cases, which are claims about the assembled sentence rather than about a window. The 13 timeBound/exBound cases were already scoped by construction (their subject IS one clause from describeWindowBound, no summary line involved). The rendered summary line does NOT change - proven byte-identical. #13628's boundary-reached / horizon-reached wording split was left exactly as it landed.",
  "tests": "All readings at the final commit 8813cf1c7 (same tree the branch was pushed from; gates, ablation and live fire all ran on it). SELF-TEST: baseline on base 7483afdd9 was 'check-half-states self-test: 1749 cases pass.'; now 'check-half-states self-test: 1783 cases pass.' - scoping replaced, the extractor's own controls added (partition on two shapes, anchor uniqueness, declared-vs-rendered order, 17 per-window presence controls, the ablation contract, and doctored-neighbour pins for both directions of the defect). ABLATION, one leg per window, 17 of 17: predictions fixed in the harness at 2026-08-31T04:55:09Z on 8813cf1c7 BEFORE any leg ran (PREDICTIONS.json). Each leg deletes that window's clause from the summary CONSTRUCTION (its source chunks replaced with an empty string literal). Mutation proven on disk by re-reading the file and counting the exact source marker inside summaryLine's return body: 1 to 0 on every leg, plus an independent render-level check that the window's anchor is absent from the output. Restore proven by 'git checkout HEAD -- ABSOLUTE_PATH' (never a bare checkout, which restores from the index and would leave the mutation in place), then git diff HEAD empty AND git hash-object equal to the HEAD blob 24e366cd5c506cb5e2439125179e21bc9089d84c on every leg; the runner also treats an empty hash as FAILURE, not as nothing-to-compare. RESULT: suite exits non-zero 17/17; the window's own positive cases go RED 17/17; its presence control goes RED 17/17; another window's case goes red 0/17. A window's NEGATIVE cases stay green under its own ablation because an empty clause satisfies a does-NOT-say assertion vacuously - inherent to a negative, which is why each window also carries a presence control. reportOnly is the one window with no scoped cases of its own (by design - its two cases are the whole-line endsWith pair); its presence control and both endsWith cases still go red. BASE COMPARISON: the same 17-leg ablation run against base 7483afdd9 (unmutated: 1749 cases pass) found FOUR pre-existing cases that had their own window's clause deleted outright and STAYED GREEN, satisfied by a neighbour - 'summaryLine: absent H16 counts degrade to 0, never to undefined' (needle 'read on 0 of 0', spoken by EIGHT windows), 'H22 summary: a completed window says the boundary was reached' ('boundary reached', h22Window + h23Window), 'summary: and says the unit is DISTINCT targets, not per-card edges' ('distinct', h19Blockers + h20Dispatch), and 'H37 summary: stating the miss-only direction' ('never invent one', h36SharedFiles + h37Folds). All four are red under their own ablation now. The card's headline example (H8's 'horizon reached') is NOT in that list: the naming convention #13628 introduced is currently holding, so deleting H8's clause already reddened its cases at base - reported honestly rather than claimed as a fix. NO OUTPUT CHANGE: summaryLine dumped at 7483afdd9 and at HEAD over 7 count shapes x 3 finding counts - 'byte-identical across all 21 renderings', md5 d77684b401a3ee782adc5690835093ec on both. The extractor was also validated against a REAL production rendering, not only synthetic shapes: the live patrol line partitions exactly, 3293 chars of clauses over a 3293-char line, all 17 anchors unique and clause-opening. GATES: derived from the ACTUAL diff via 'node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack' - 17 by path plus 2 by change KIND (this edits a gate script). All 19 run, each gate's OWN verdict line quoted in the PR body; highlights: 'check-half-states self-test: 1783 cases pass.', 'dispatch-gates self-test: 1017 cases pass.', 'check-partof-closing-keyword self-test: 28 cases pass.', bare-root-worklist 'OK self-test: 51 live row(s), 43 unreachable as spelled, 43 recorded verdict(s) - none stale', check-ci-filter-parity 'OK: all 127 declared cross-package glob(s) (92 unique) are covered', check-closing-keyword-parity 'OK (3 parsers agree on all 9 keywords)', check-shard-attestation 'OK: 2 aggregate gate(s) count 3 declared leg(s)', check-cross-package-test-inputs 'OK: 24 package(s) read outside themselves, all declared', check-nul-bytes 'OK (scanned 7549 text file(s) - no raw ASCII control bytes)'. Exit codes were captured with no pipe in between. 'node scripts/check-test-completeness.mjs' is NOT MEASURED locally by the gate's own account (it grades a saved turbo test log; none exists locally and it prints that this branch is unreachable in CI) - not read as pass or fail. ESLINT: no narrowing was needed - the full repo-wide 'pnpm exec eslint . --no-inline-config --format json' completed, 5555 files selected by eslint's own config, 0 with problems, exit 0, and the changed file is in that selected population. LIVE FIRE: 'node scripts/pm/check-half-states.mjs' at the final commit, exit 0, run with 'env -u GITHUB_TOKEN -u GH_TOKEN' because the container's value is the literal placeholder proxy-injected.",
  "files_changed": [
    "scripts/pm/check-half-states.mjs"
  ],
  "changeset": "none - scripts/pm/** only, publishes nothing from any package. skip-changeset applied via the ADDITIVE labels endpoint (POST issues/13654/labels); read back afterwards: draft=True and labels ['size/m','skip-changeset'], so the size-labeler's write did not strip it.",
  "governed_surface_posture": "non-governed pure code; PR opened as DRAFT and LEFT draft for the PM to self-review, flip ready and arm auto-merge. I did not flip ready, enqueue, or arm anything. Read-back after the label write confirms draft=True.",
  "deviations": [
    "Channel switch, declared: the REST search endpoint returns HTTP 403 in this container ('sessions are bound to their configured repositories. Use repository-scoped endpoints'), so the pre-filing dedup search used ONE targeted MCP search_issues (10 results, non-empty, so the read is real). Every other GitHub read and write went through repo-scoped REST, which answers 200 here - including creating the finding and the PR.",
    "pnpm install was run only after the first gate batch, so 4 gates initially reported PREREQUISITE NOT MET (the yaml dependency) and check-partof-closing-keyword reported NOT WIRED. All were re-run afterwards and are green; none was read as a red gate.",
    "check-test-completeness is NOT MEASURED locally by construction (the gate says so itself). Reported as not-measured rather than as a pass."
  ],
  "mcp_calls": "1 - a single targeted MCP search_issues for pre-filing dedup. All other GitHub traffic used repo-scoped REST.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #13650: summaryLine's H19 clause has no sentence-terminating period unless a cross-repo probe fired, so on an ordinary healthy pass it runs straight into H20's clause ('... open pm:blocked card(s) Dispatch liveness (H20 + H27): ...'). Visible in this run's live patrol line. Filed unassigned, no label, for PM triage; not touched here because this card's adjudicated default is that the rendered line does not change."
  ]
}

Generated by Claude Code

---

Generated by Claude Code