PMAT-3445: no tag while the milestone being cut holds an open item — check_milestone_cut.sh at the freeze and before the tag

[noahgift]

Closes #3445

What

A release train may no longer cut a tag while the milestone being cut still has an open issue or PR.

• scripts/check_milestone_cut.sh <milestone>
  • Exit 0 only when the milestone has 0 open issues and PRs.
  • Exit 1 names each open item, with the exact carry or close command.
  • Exit 2 when it cannot judge: the title matches no milestone or several, the milestone is empty, the item list disagrees with open_issues, or gh is missing or unauthenticated.
  • Run with no arguments, it runs its self-test. guard_tree.sh picks it up.
• 06x-release-schedule.md §4 and APR-RELEASE-001 §4 (T-0 and T-3). The milestone is read at the freeze, before the bump PR opens, and read again immediately before the tag. The second read is binding.
  • A carried item is moved to the next milestone with a slipped_from: comment. It is never left open, because the milestone is closed on open_issues.
• Contract. contracts/release-schedule-06x-v1.yaml adds equation milestone_settled_at_cut, RS0-INV-007 and FALSIFY-REL-06X-009/010.

Why

v0.68.0 was tagged 06:35Z on 2026-09-17 while milestone 0.68.0 still had #3091 open (P1, reopened 85 min before the tag). The autopilot's tag step read no milestone. Its only read was the close step, after publish.

Evidence

Check	Result
bash scripts/check_milestone_cut.sh --self-test (also the bare run)	exit 0, 25 checks
mutation: judge always passes / count cross-check deleted / --paginate dropped / epic admission removed / admission widened	exit 1 each
live 0.67.0, 0.66.0 (first-green on real milestones)	exit 0, exit 0
live 0.68.0	exit 1, named #3091 (P1) and #3450
live 0.69.0	exit 1, 48 open (matches the milestone API)
rehearsal: the autopilot's tag block with the gate as its first line, write verbs stubbed	STOP … #3450, 0 write calls, no tag on the remote
pv validate (pinned pv 0.68.0) / pv lint	0 errors / PASS
cargo test -p aprender-core --test readme_contract	15 passed
check_guards_are_wired, check_no_timing_in_required, check_assertions_exclude, check_pass_grep_anchored, check_bashrs_gate	exit 0
cargo fmt --all -- --check / cargo test -p aprender-contracts --lib / cargo deny check advisories	exit 0 / 1538 passed / ok

The plan went through a width-3 grill. v1 got 3/3 do-not-implement-as-written, and v2 applies every consensus edit (docs/audits/impl-PMAT-3445-plan.md §6). Full receipt: docs/audits/impl-PMAT-3445-receipt.md.

Known gaps

• Autopilot still does not call the gate. The tag is cut by an untracked per-train autopilot copy, and no running autopilot calls this gate yet. Tracked in release train: the tag step lives in an untracked per-train autopilot copy — the #3445 milestone read is on no code path #3454 (0.70.0). The live 0.68.1 train was warned on release: 0.68.1 #3450; CPU: Qwen3.5 / Qwen3.8 hybrid GGUFs are refused entirely — no fallback exists #3091 was carried to 0.70.0 at 13:40Z.
• 0.69.0 cut. Its cut is due 18:00Z and it had 48 open items at the last read. Wherever the gate is called, that cut stops until each item is closed or carried.
• Pre-merge review found a defect, now fixed (b5a09b0ba). Each train's release epic is open in its own milestone until close (EPIC: release train 0.67.0 — 06x-release-schedule.md §3 (0.67.0) #3078 was open at the v0.67.0 tag), so the gate now admits exactly that one item and prints it as ADMITTED. Self-test is now 25 checks, with mutations (d) and (e). Round 1's 3/3 PASS at dfe085294 missed this, and lanes 2 and 3 had read lane 1's verdict first. Round 2 at b5a09b0ba: 3/3 PASS, and no lane read a sibling verdict.
• Host-only guard failures. On this host, guard_tree --no-cargo fails check_baseline_ratchets and check_complexity_ratchet with a tool_version mismatch only: baselines recorded under pmat 3.40.1, host runs 3.40.2. Complexity delta +0 and this PR changes no .rs file.

no-close: #3091, #3450, #3454 and #3448 are cited as evidence or follow-up, not fixed here.

ont-delta: none — the #3445 finding landed as a guard (scripts/check_milestone_cut.sh) and a contract equation (milestone_settled_at_cut, FALSIFY-REL-06X-009/010), not as prose; no ontology type, shape or known-red list changed

🤖 Generated with Claude Code

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=3455 head=fdbf19c7366c215099e1b2d9427d5cc9e63c25d2 verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

quorum-review (AD-04): three PASS — agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-3445",
 "head": "dfe0852941cd2ddeaca8a170c8b5e2c21efca0bf",
 "width": 3,
 "executor": "agy",
 "agreed": true,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 2,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 3,
   "verdict": "PASS",
   "findings": 0
  }
 ]
}

[noahgift]

quorum-review (AD-04): three PASS — agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-3445",
 "head": "b5a09b0ba0ce50f07b73f79019046eb975c87bcd",
 "width": 3,
 "executor": "agy",
 "agreed": true,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 2,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 3,
   "verdict": "PASS",
   "findings": 4
  }
 ]
}

[noahgift]

Operator triage — closing-reference defect (#3400), fired on this PR.

This PR's body line no-close: #3091, #3450, #3454 and #3448 … was parsed by GitHub as close: #3091. closingIssuesReferences listed issue 3091 next to the intended 3445, and the merge at 2026-09-17T15:00:01Z closed issue 3091 three seconds later — its third wrongful close. It has been reopened with an explanation; nothing here fixed it.

For the author session, on every future PR (this one is merged, so its body is left as is):

1. No closing keyword (close/closes/closed/fix/fixes/fixed/resolve/resolves/resolved), and no …close: #N pattern such as no-close: #N, may sit before a #-reference you do not intend to close. Write "issue 3091" (no #) when citing evidence or follow-ups.
2. Before arming auto-merge, read back gh pr view <n> --json closingIssuesReferences and require it to equal the intended set exactly.
3. After merge, verify each cited-but-not-fixed issue is still open.

Also check whether 3450 / 3454 / 3448 were caught by the same line.