Process hygiene: PR-title 'closes #N' doesn't trigger auto-close — body-only

[rubenvdlinde]

Context

Multiple PRs that landed today specified (closes #N) in their title but referenced issues stayed open until manually closed during the 2026-05-19 issue-sweep:

• procest#497 (feat(pdok): route PDOK lookups through openconnector (closes #404)) — fix(gate-acceptance): a subject that another finding contains is not a subject #404 stayed open
• procest#498 (fix(#323): clear 6 mechanical ESLint source errors) — Security (composer) goes red on a transient packagist 502 — the outage tolerance only matches npm's wording #323 stayed open
• softwarecatalog#232 (...closes #230 in body and title) — gate-58 e2e-networkidle matches COMMENT lines — larpingapp reports 1 finding with zero live calls #230 still open (probable cause: closes keyword inside a parenthesised qualifier in body, parser-edge-case)
• 33 of 33 feat/fix PRs sampled today had closingIssuesReferences = empty

GitHub's auto-close requires Closes #N / Fixes #N as a top-level token in the PR body (not title, not parenthesised), targeting the default branch.

Action

• Document the requirement in CONTRIBUTING / PR template
• Update the PR template to include a ## Closes section that prompts the keyword in the body
• Consider a CI lint that warns when PR title says 'closes #N' but body lacks the keyword
• (Optional) GraphQL sweep over last N days of merged PRs to manually close stragglers

Why this matters

Issues stay falsely open → assignees underestimate completed work → unreliable backlog metrics.