feat(pm): H22 judges closed cards against a dated closure floor (#12906)

* feat(pm): H22 judges closed cards against a dated closure floor

The half-state patrol's closed-card row reports a card that left the board
still carrying a `pm:*` state label. A sibling install measured its own closed
surface at ~87% residue density and had to ship with the row switched off: at
that density H22 reports the CONVENTION rather than a defect, and the rows
exhaust the anchor body budget every other predicate shares.

That install's card framed the choice as two-way — either stripping is the rule
and ~815 closed cards need a backfill first, or the row is simply not wanted.
`PM_SWEEP_CLOSED_FLOOR` is the third option both readings omit: judge only
cards closed on/after a cutover date. Historical `pm:*` on an old closed card
is inert (the loop reads state on open cards only), so the row gets its whole
value — residue produced from now on, while the paired write is still a live
duty — at zero backfill and zero historical noise. No code path here writes a
label, so no bulk rewrite of closed cards is reachable.

Unset is the default and preserves today's behaviour exactly. A malformed floor
is refused with exit 2 rather than degrading to "no floor", which on the
install that needs one would restore the flood four times a day; the parse is
round-tripped because `Date.parse` rolls `2026-02-31` to March rather than
rejecting it. The rendered summary names the floor, so a floored pass cannot
overstate what it judged.

* docs(pm): codify strip-`pm:*`-on-close in the label-discipline section

The convention was ambiguous enough that two seats read the same board and
landed on opposite rules. Fleet practice has since settled it — the 2026-08-27
/28 landing accounting stripped `pm:*` from every closed card as a hard step —
so this writes the answer down where the loop reads it, which is the cure the
original card asked for.

Ratchet is zero-headroom, so this is net 0 lines. Cut ledger in the PR body.

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-litant

.claude/skills/pm-dispatch/SKILL.md

@@ -120,10 +120,10 @@ seat-post-protocol);维护者明示召唤是仲裁:有简报径直坐席,无简
   默认不适用 `type:Bug` 的 hold**,三分支:可复现且用户可达 ⇒ 回 `pm:queue`(被 hold 的 Bug 就是
   被藏起的缺陷);declared≠enforced 观察类 ⇒ 转 enforce-or-remove 通道(不 hold 不裸关);真
   won't-fix 候选 ⇒ 逐卡进决策箱 —— 座位永不自行关闭真实缺陷。**机会主义重启条件必须
-  点名触发文件**(维护者 2026-08-11 接受):写侧即 `Restart-touch:` 行(行契约见
-  `references/state-machine.md`);派发/折叠检查时读半状态巡查锚(`half-state-patrol.yml` 的
-  `ANCHOR_ISSUE` 置顶 issue)的 H17 on-hold 触发文件索引、与本次派发文件面相交,命中 ⇒ 按该
-  hold 评论的 rider/restart 条款处置(点名该单、顺手活列为申报过的增项)。
+  点名触发文件**(维护者 2026-08-11 接受):派发/折叠检查时读半状态巡查锚(`half-state-patrol.yml`
+  的 `ANCHOR_ISSUE` 置顶 issue)的 H17 on-hold 触发文件索引、与本次派发文件面相交,命中 ⇒
+  按该 hold 评论的 rider/restart 条款处置(点名该单、顺手活列为申报过的增项)。
+- **关闭即摘 `pm:*` 状态标**(与关单同一笔;`domain:*`/类型标签留下 —— 归属不是状态)。
 - **`Blocked-by:` 行是机器可 grep 的反向索引**,一遍读喂三个职责:上游关单时放回被解锁的、
   按解锁扇出排序选择、**在合并后的 ref 上重验每张回队卡的文件面**(⛔ 只做第一件;关掉
   上游的那个合并最可能顺手把你这张卡也修掉)。**一个标签存在,当且仅当有具名读

scripts/pm/check-half-states.mjs

@@ -3809,9 +3809,30 @@ export const PM_RESIDUE_LABELS = [
  * predicate cannot double-report the population every other item already reads.
  * That gate is the predicate's own, not the caller's, because it is the one
  * thing separating this row from a restatement of H3.
+ *
+ * `floor` is the optional dated closure floor (see `resolveClosureFloor`): a
+ * `Date` before which a closed card is out of scope, or null for "judge every
+ * card in the window", which is the default and this repo's own behaviour.
+ *
+ * ⚠️ A card whose `closed_at` cannot be read is judged, NOT skipped. The floor
+ * is a scope decision that needs a date to make; without one the card's
+ * position relative to the cutover is UNKNOWN, and silently dropping it would
+ * narrow the pass on unread data — #4690 in the direction this file refuses
+ * everywhere else. The listing endpoint always carries `closed_at` on a closed
+ * issue, so fail-open costs no noise in practice; it just keeps the one
+ * unreadable card visible instead of disappeared.
+ *
+ * @param {any} issue
+ * @param {Date | null} [floor]
  */
-export function h22ClosedCardPmResidue(issue) {
+export function h22ClosedCardPmResidue(issue, floor = null) {
   if (issue?.state !== 'closed') return null;
+  if (floor) {
+    const closedAt = Date.parse(issue.closed_at ?? '');
+    // Strictly BEFORE the floor is out of scope; a card closed ON the cutover
+    // date is the first day the convention applies and is judged.
+    if (!Number.isNaN(closedAt) && closedAt < floor.getTime()) return null;
+  }
   const residue = labelNames(issue ?? {}).filter((l) => PM_RESIDUE_LABELS.includes(l));
   if (residue.length === 0) return null;
   const list = residue.map((l) => `\`${l}\``).join(', ');
@@ -6692,7 +6713,7 @@ export const SWEEP_COUNT_KEYS = [
  *   blockerTargets?: number, crossRepoProbed?: number,
  *   crossRepoUnreadable?: number, seatMarkersRead?: number,
  *   seatCandidates?: number, commits?: number, commitBindings?: number,
- *   commitBindingMessages?: number }} counts
+ *   commitBindingMessages?: number, closedFloor?: string }} counts
  * @param {number} findingCount
  */
 
@@ -6772,7 +6793,9 @@ export function summaryLine(counts, findingCount) {
     `(merge state read on ${probed} of ${candidates} H16 candidate(s)) ` +
     `and ${counts.merged} recently-merged PR(s) in ${counts.repo} — ${findingCount} half-state(s) found. ` +
     `H22 read ${counts.closed ?? 0} recently-closed issue(s) for \`pm:*\` state residue (bounded window; ` +
-    `older closed carriers are outside it by design). ` +
+    `older closed carriers are outside it by design` +
+    `${counts.closedFloor ? `, and only cards closed on/after ${counts.closedFloor} are judged — ` +
+      'earlier closures predate the strip-on-close convention and are NOT a reading about them' : ''}). ` +
     `H23 read ${commits} squash commit message(s) from the default branch's recent window, carrying ` +
     `${commitBindings} closing-keyword binding(s) across ${commitBindingMessages} message(s) ` +
     `(bounded window; a message that landed before it is invisible by design). ` +
@@ -7869,6 +7892,79 @@ async function listRecentlyMergedPullRequests() {
  */
 export const CLOSED_ISSUE_WINDOW_PAGES = 4;
 
+/**
+ * H22's DATED CLOSURE FLOOR — the cutover date at and after which a closed
+ * card's `pm:*` residue is judged (objectui#5985).
+ *
+ * ## The dilemma this dissolves
+ *
+ * The window above is bounded by UPDATE recency, which is the wrong axis for
+ * the one question a sibling install kept running into: "was this card closed
+ * under the convention, or before it existed?" Measured in objectui
+ * 2026-08-24, while porting this file: 815 closed cards there carry
+ * `pm:dispatched`, and ~347 of the 400 issues in the window above carry some
+ * `pm:*` residue (~87%, against the 26% this repo measured on its own board).
+ * At that density H22 reports the CONVENTION rather than a defect — ~347 rows
+ * that exhaust the anchor body budget and trim every other predicate's
+ * findings out of the report. That install therefore shipped with the closed
+ * reader switched off, and its card recorded the choice as a two-way one:
+ * either stripping is the rule (and ~815 cards need a BACKFILL before H22 can
+ * be honest) or it is not (and H22 is simply not a predicate that repo wants).
+ *
+ * The floor is the third option both readings omit. `pm:*` on a card closed
+ * before the convention was written is inert history: nothing queries it as a
+ * claim of in-flight-ness, because the loop reads state on OPEN cards only
+ * (`is:open` is in every one of its inventory queries). Judging only cards
+ * closed on/after a cutover date therefore buys the row's whole value — the
+ * residue produced from now on, while the paired write is still a live duty
+ * someone remembers — at zero backfill and zero historical noise. ⛔ The
+ * alternative this file must never grow is a bulk label rewrite of closed
+ * cards: 815 mutating writes to make a report quieter is machinery serving the
+ * instrument, and no code path here writes a label at all.
+ *
+ * ## Default: unset, which is exactly today's behaviour
+ *
+ * An install that wants every card in the window judged sets nothing, and this
+ * resolver returns a null floor that the predicate ignores. That keeps this
+ * repo's own patrol byte-identical across this change — it measured 26% and
+ * treats recent closed residue as a live duty — and makes the floor a
+ * per-install adaptation rather than a policy shipped to everyone.
+ *
+ * ## Malformed is REFUSED, never defaulted
+ *
+ * A typo'd floor that silently became "no floor" would restore the 87% flood
+ * on the one install that set it, four times a day, and the flood reads as a
+ * working patrol — the same trap `resolveSweepRepo` refuses by name. So an
+ * unparseable value is `valid: false` and the entrypoint exits 2 on it. Only
+ * the `YYYY-MM-DD` spelling is accepted: a bare `Date` parse would take
+ * "yesterday-ish" strings and timezone-bearing ones whose midnight is not the
+ * one the workflow author meant, and the value is written by hand in a
+ * workflow file exactly once.
+ */
+export function resolveClosureFloor(env = {}) {
+  const raw = String(env.PM_SWEEP_CLOSED_FLOOR ?? '').trim();
+  if (!raw) return { floor: null, source: 'default', valid: true, raw: '' };
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(raw)) {
+    return { floor: null, source: 'PM_SWEEP_CLOSED_FLOOR', valid: false, raw };
+  }
+  const at = Date.parse(`${raw}T00:00:00Z`);
+  if (Number.isNaN(at)) return { floor: null, source: 'PM_SWEEP_CLOSED_FLOOR', valid: false, raw };
+  // A shape-valid string can still name a date that does not EXIST, and
+  // `Date.parse` does not reject all of them: `2026-13-01` is NaN (the month
+  // is outside the ISO range) but `2026-02-31` silently ROLLS to 2026-03-03.
+  // So the parse is round-tripped rather than trusted. Letting a rolled date
+  // through would move the floor days past where its author wrote it and,
+  // worse, do it silently — the floor is the one input here whose whole job is
+  // to say which cards were judged.
+  const floor = new Date(at);
+  if (floor.toISOString().slice(0, 10) !== raw) {
+    return { floor: null, source: 'PM_SWEEP_CLOSED_FLOOR', valid: false, raw };
+  }
+  return { floor, source: 'PM_SWEEP_CLOSED_FLOOR', valid: true, raw };
+}
+
+const CLOSED_FLOOR = resolveClosureFloor(process.env);
+
 async function listRecentlyClosedIssues() {
   const out = [];
   for (let page = 1; page <= CLOSED_ISSUE_WINDOW_PAGES; page++) {
@@ -8351,9 +8447,10 @@ async function sweepInto(findings, seen, seenPrs, seenMerged, seenUnscoped, seen
   // line can say what this pass covered on its own terms.
   for (const issue of await listRecentlyClosedIssues()) {
     seenClosed.set(issue.number, issue);
-    const residue = h22ClosedCardPmResidue(issue);
+    const residue = h22ClosedCardPmResidue(issue, CLOSED_FLOOR.floor);
     if (residue) findings.push([issue, 'H22', residue]);
   }
+  stats.closedFloor = CLOSED_FLOOR.raw;
 
   // H23 — the commit-message surface (#10942). The counting is not incidental:
   // this row's measured yield is ~6 in 1,546, so a silent H23 is the normal
@@ -9557,10 +9654,75 @@ function selfTest() {
     t(`H22: \`${label}\` on a closed card is residue`, typeof h22ClosedCardPmResidue(closedCard([label])), 'string');
   }
 
+  // -- H22's DATED CLOSURE FLOOR (objectui#5985) ------------------------------
+  //
+  // The floor is what lets a sibling install re-enable this row without the
+  // backfill its own card thought was the only alternative: judge cards closed
+  // on/after a cutover date, leave the historical carriers unjudged, write no
+  // labels at all. The cases below pin the three properties that decision rests
+  // on — the floor is HONOURED, its absence changes nothing, and a malformed
+  // value is refused rather than silently becoming "no floor".
+  const FLOOR = new Date(Date.parse('2026-08-28T00:00:00Z'));
+  const closedOn = (labels, closed_at) => ({ ...closedCard(labels), closed_at });
+
+  // Honoured, both directions. The old card is the ~815-card backlog in
+  // miniature: it carries real residue and is deliberately NOT a finding.
+  t('H22 floor: a card closed BEFORE the floor is out of scope', h22ClosedCardPmResidue(closedOn(['pm:dispatched'], '2026-08-01T09:00:00Z'), FLOOR), null);
+  t('H22 floor: …however much residue it carries', h22ClosedCardPmResidue(closedOn(['pm:dispatched', 'pm:queue', 'pm:blocked'], '2026-01-01T00:00:00Z'), FLOOR), null);
+  t('H22 floor: a card closed AFTER the floor is judged', typeof h22ClosedCardPmResidue(closedOn(['pm:dispatched'], '2026-08-29T09:00:00Z'), FLOOR), 'string');
+  t('H22 floor: …and the row still names the residue label', h22row(closedOn(['pm:dispatched'], '2026-08-29T09:00:00Z'), FLOOR).includes('`pm:dispatched`'), true);
+  // The boundary is inclusive: the cutover date is the first day the convention
+  // applies, so a card closed within it is the convention's own population.
+  t('H22 floor: a card closed ON the floor date is judged', typeof h22ClosedCardPmResidue(closedOn(['pm:queue'], '2026-08-28T00:00:00Z'), FLOOR), 'string');
+  t('H22 floor: …and later the same day too', typeof h22ClosedCardPmResidue(closedOn(['pm:queue'], '2026-08-28T23:59:59Z'), FLOOR), 'string');
+  t('H22 floor: one second before the floor is out', h22ClosedCardPmResidue(closedOn(['pm:queue'], '2026-08-27T23:59:59Z'), FLOOR), null);
+  // The floor narrows scope; it never invents findings. A clean recent card is
+  // still clean, and an OPEN card is still not this row's.
+  t('H22 floor: a clean card after the floor is still clean', h22ClosedCardPmResidue(closedOn(['domain:cli'], '2026-08-29T09:00:00Z'), FLOOR), null);
+  t('H22 floor: the closed gate still outranks the floor', h22ClosedCardPmResidue({ ...issue(['pm:dispatched']), state: 'open', closed_at: null }, FLOOR), null);
+  // Fail-OPEN on an unreadable closure date: the floor cannot be applied, so
+  // the card stays visible rather than being dropped on unread data (#4690).
+  t('H22 floor: a card with no closed_at is judged, not dropped', typeof h22ClosedCardPmResidue(closedOn(['pm:dispatched'], null), FLOOR), 'string');
+  t('H22 floor: …and an unparseable one likewise', typeof h22ClosedCardPmResidue(closedOn(['pm:dispatched'], 'not-a-date'), FLOOR), 'string');
+
+  // Floor ABSENT — the default, and the property that makes this change a
+  // no-op for the install that wants every card in the window judged.
+  t('H22 floor: absent floor judges an old closed card exactly as before', typeof h22ClosedCardPmResidue(closedOn(['pm:dispatched'], '2026-01-01T00:00:00Z')), 'string');
+  t('H22 floor: …an explicit null is the same as omitting it', typeof h22ClosedCardPmResidue(closedOn(['pm:dispatched'], '2026-01-01T00:00:00Z'), null), 'string');
+  t('H22 floor: …and a clean old card is still clean', h22ClosedCardPmResidue(closedOn(['domain:cli'], '2026-01-01T00:00:00Z'), null), null);
+
+  // resolveClosureFloor — the env reading, including the loud refusal.
+  t('closure floor: unset means no floor', resolveClosureFloor({}).floor, null);
+  t('closure floor: …and that is a VALID reading, not an error', resolveClosureFloor({}).valid, true);
+  t('closure floor: …reported as the default source', resolveClosureFloor({}).source, 'default');
+  t('closure floor: whitespace is unset too', resolveClosureFloor({ PM_SWEEP_CLOSED_FLOOR: '  ' }).floor, null);
+  t('closure floor: a YYYY-MM-DD date resolves to UTC midnight', resolveClosureFloor({ PM_SWEEP_CLOSED_FLOOR: '2026-08-28' }).floor.toISOString(), '2026-08-28T00:00:00.000Z');
+  t('closure floor: …and is valid', resolveClosureFloor({ PM_SWEEP_CLOSED_FLOOR: '2026-08-28' }).valid, true);
+  t('closure floor: …and names its source', resolveClosureFloor({ PM_SWEEP_CLOSED_FLOOR: '2026-08-28' }).source, 'PM_SWEEP_CLOSED_FLOOR');
+  t('closure floor: surrounding whitespace is trimmed, not rejected', resolveClosureFloor({ PM_SWEEP_CLOSED_FLOOR: ' 2026-08-28 ' }).valid, true);
+  // Malformed is REFUSED. Each of these would otherwise become "no floor" and
+  // restore the flood on the one install that set the variable.
+  for (const bad of ['28-08-2026', '2026/08/28', 'yesterday', '2026-08-28T00:00:00Z', '2026-8-28', 'O', '0']) {
+    t(`closure floor: \`${bad}\` is refused, not defaulted`, resolveClosureFloor({ PM_SWEEP_CLOSED_FLOOR: bad }).valid, false);
+  }
+  // …including a well-SHAPED date that does not exist — the case a bare regex
+  // would pass and whose floor would exclude every card, rendering an empty
+  // H22 as a clean closed surface.
+  t('closure floor: a shape-valid impossible date is refused', resolveClosureFloor({ PM_SWEEP_CLOSED_FLOOR: '2026-02-31' }).valid, false);
+  t('closure floor: …and an impossible month likewise', resolveClosureFloor({ PM_SWEEP_CLOSED_FLOOR: '2026-13-01' }).valid, false);
+  t('closure floor: a refused value carries no floor to fall back on', resolveClosureFloor({ PM_SWEEP_CLOSED_FLOOR: 'yesterday' }).floor, null);
+  t('closure floor: …and is reported as itself for the error message', resolveClosureFloor({ PM_SWEEP_CLOSED_FLOOR: 'yesterday' }).raw, 'yesterday');
+
   // The summary line's H22 clause — a pass that read nothing must not read the
   // same as a board with no residue (#4690), so the count is always stated.
   t('summary: the H22 clause states what the closed pass read', summaryLine({ repo: 'r', issues: 1, unscoped: 1, prs: 0, merged: 0, closed: 200 }, 0).includes('H22 read 200 recently-closed issue(s)'), true);
   t('summary: an absent closed count degrades to 0, never to undefined', summaryLine({ repo: 'r', issues: 1, unscoped: 1, prs: 0, merged: 0 }, 0).includes('H22 read 0 recently-closed'), true);
+  // …and when a floor is in force the line SAYS so: "read 200" with a floor
+  // silently applied would overstate what was judged, which is the same
+  // unread-reads-as-clean defect the count itself exists to prevent.
+  t('summary: a floored pass names the floor date', summaryLine({ repo: 'r', issues: 1, unscoped: 1, prs: 0, merged: 0, closed: 200, closedFloor: '2026-08-28' }, 0).includes('only cards closed on/after 2026-08-28 are judged'), true);
+  t('summary: …and says the earlier closures are not a reading about them', summaryLine({ repo: 'r', issues: 1, unscoped: 1, prs: 0, merged: 0, closed: 200, closedFloor: '2026-08-28' }, 0).includes('NOT a reading about them'), true);
+  t('summary: an unfloored pass adds no floor clause', summaryLine({ repo: 'r', issues: 1, unscoped: 1, prs: 0, merged: 0, closed: 200 }, 0).includes('are judged'), false);
 
   // -- H23: the COMMIT-MESSAGE surface (#10942) -------------------------------
   //
@@ -12730,6 +12892,18 @@ if (isMain) {
     );
     process.exit(2);
   }
+  // A malformed closure floor is the same class and gets the same answer. It
+  // must not degrade to "no floor": the install that sets one is the install
+  // whose closed surface is ~87% residue, so a silent default would flood the
+  // anchor body four times a day and the flood renders as a working patrol.
+  if (!process.argv.includes('--self-test') && !CLOSED_FLOOR.valid) {
+    console.error(
+      `check-half-states: ${CLOSED_FLOOR.source}=${JSON.stringify(CLOSED_FLOOR.raw)} is not a ` +
+        '`YYYY-MM-DD` date. Refusing to fall back to an unfloored closed pass — on the install ' +
+        'that needs a floor, no floor is a report about the convention rather than about defects.',
+    );
+    process.exit(2);
+  }
   if (process.argv.includes('--self-test')) {
     selfTest();
   } else if (process.argv.includes('--probe')) {