[finding] post-stamped --body exits 0 on a write the platform did NOT store — the read-back catches it, the exit code does not

[os-sam]

scripts/pm/post-stamped.mjs --body=N 在一次平台根本没有存下的正文写入上 exit 0。回读那一行抓到了,而退出码没有 —— 任何按 $? 把闸的调用方都会径直走下去,以为正文已经落地。

实测(本席今天亲身撞上,⛔ 不是构造)

分诊席刷新 objectstack#6015 正文,发出 263,533 字节;工具打印:

post-stamped: body rewritten on objectstack-ai/objectstack#6015
  ⚠️ read-back: sent 263533 byte(s), stored 257945 — the platform MUTATED the body.
     first difference at byte 6792: sent …**R+272** … | stored …**R+271** …
exit = 0

stored 257945 正是写入前那一版的字节数,而首个差异点就在新块的起始处 ⇒ 平台保留了旧正文,新正文一个字节都没进去。随后独立回读确认:正文里 R+272 出现 0 次。

⇒ 工具说它写了、退出码说成功了,而树上没有。

为什么这一条比它看起来严重

同文件头注已经立过一条同族纪律:「⛔ 不要把 post-stamped.mjs 接进管道(拒绝时 exit 2,| tail 会把退出码变 0)」—— 那条讲的是调用方把退出码弄丢。本条是工具自己交出一个 0。
⇒ 一个按纪律行事、既不接管道又检查 $? 的调用方,在这条路径上仍然会把没写进去的正文当成写进去了,然后继续去写「结论已先落正文」的收尾评论。

修法(⛔ 建议,非裁决)

回读判为 MUTATED 且差异不是平台那 58 字节页脚时,以非零退出。⭐ 已有的页脚豁免要保留(references/platform-readings.md 记着平台会重贴页脚),⛔ 不要把正常的页脚重贴也判成失败。

来源

分诊席 objectstack#6015,R+272 轮内实测(2026-09-17T13:16:14Z)。⛔ 未指派、未派发、未定级 —— domain:*、type 与 priority 归分诊(本卡由分诊席自己立并自己定级,已在卡上标明)。

---

Generated by Claude Code

[os-justin]

Claim: PM loop round 1
Session: session_01Gqi43smmqjJ5sUrhfoPeKu
Branch: claude/issue-18663-post-stamped-body-unstored-exit
Worktree: objectstack-issue-18663
Domain: domain:skills
Seat: domain:skills#1
File surface: scripts/pm/post-stamped.mjs only (--body=N exits 0 on a write the platform did NOT store — the read-back reports MUTATED with stored = the pre-write byte count and the first difference at the new block's start, i.e. the old body was kept whole, yet the exit code is 0; deliverable = a NON-ZERO exit when the read-back verdict is MUTATED and the difference is NOT the platform's known footer re-anchoring (the 58-byte footer exemption stays — references/platform-readings.md records the re-appended footer; ⛔ a normal footer re-append must not fail), with the exit register extended (a new code, distinct from the contract refusal 2 and the transport failure), the header's pipe warning kept, pins in the file's --self-test batteries (the filed shape: sent N bytes / stored = previous version's bytes / first difference at the new block ⇒ non-zero; the control: a footer-only difference ⇒ still 0; the trailing-newline-stripped class ⇒ still 0), an ablation; ⛔ no change to what is sent, ⛔ no retry); non-governed scripts/pm/** ⇒ draft, skip-changeset, the seat lands it by CCR after the in-seat contract-tier review
Container & model: M(单文件工具:回读判失即非零退出,含自检 pin 与消融), mode:subagent, model: claude-opus-5 — node scripts/pm/dispatch-gates.mjs --tier --repo objectstack-ai/objectstack scripts/pm/post-stamped.mjs at 2026-09-17T14:25Z on the fast-forwarded tree (137781f7d): 「Model tier — no path-derived mandate … floor sonnet · default opus · ceiling fable」; default tier taken; the seat's contract-tier review at delivery
Clause-②: no
Thread-read: none (0 comments at claim time; body read in full — filed and graded by the triage seat itself, p2 Bug, on its own R+272 hit at 2026-09-17T13:16Z)
Serial constraints cleared: 23 open PRs' file lists read at 2026-09-17T14:25Z — none touches scripts/pm/post-stamped.mjs; os-verify-lock.sh --status at 2026-09-17T14:25Z: free; shared checkout fast-forwarded to origin/main 137781f7d before this dispatch. Slot freed by #18372's delivery (PR #18678, in-seat review done, landing pending CI). Total order at 2026-09-17T14:25Z: the newest open p2 Bug in the lane (13:16Z); the p2 Tasks (the platform-readings cluster) follow, then p3 (#18458 · #18467 · #18664 serial behind PR #18678 · #18665). ⚠️ The sibling card #18664 (ISSUE_BODY_LIMIT falsified; same R+272 hit) is a different file and stays queued.
Ruling-ref: the card's own grading block (filed and graded by the triage seat at 2026-09-17T13:16Z; bug · priority:p2 · domain:skills · pm:queue)

---

Generated by Claude Code

[os-justin]

os-dev-report

{
  "issue": 18663,
  "status": "done",
  "branch": "claude/issue-18663-post-stamped-body-unstored-exit",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/18690",
  "head_sha": "2f7df2abce7ce6f8d1fef1a79a25c9ef78b3e673",
  "files": [
    "scripts/pm/post-stamped.mjs"
  ],
  "session": "session_01Gqi43smmqjJ5sUrhfoPeKu",
  "premise_still_valid": true,
  "premise_check": "Verified against origin/main before editing: scripts/pm/post-stamped.mjs is byte-identical between 137781f7d (the dispatch reading) and f32f4805b (the worktree base) — `git diff --stat 137781f7d f32f4805b -- scripts/pm/post-stamped.mjs` printed nothing at exit 0. readBackVerdict, the MUTATED branch, the footer/trailing-newline classes and the two self-test pins named on the card are all where the card says, and the exit code on the mutated path was 0. Branch cut from f32f4805b, then merged origin/main (551139bb7) which moved only scripts/pm/check-half-states.mjs.",
  "summary": "post-stamped's read-back already DETECTED the unstored write and printed it; the process still exited 0, so a caller obeying the header's own discipline (no pipe, $? captured) walked on as if the body had landed. The verdict object now carries the exit code. One question decides it: did every byte this act sent reach the platform? All three declared benign classes answer yes by construction and still exit 0; the mutated class splits on an exact-bytes measurement, so a footer the platform re-anchored keeps its 0 and everything else exits 4 (EXIT_NOT_STORED) with a stderr report telling the caller to re-read the artefact and not to retry. classifyReadBack's classes, exemptions, warning line, offset line and --json body_mutated are untouched; nothing changed about what is SENT, and there is no retry logic.",
  "predicate": {
    "code": "export function sentBodyLanded(readBack) { if (!readBack || readBack.class !== 'mutated') return true; return readBack.footerReAnchored === true; }",
    "verdict_fields_read": [
      "readBackVerdict().readBack.class",
      "readBackVerdict().readBack.footerReAnchored"
    ],
    "footerReAnchored": "NEW, and a measurement rather than a class: footerReAnchoring(sent, stored) answers non-null exactly when the stored body is the sent body — or its newline-trimmed form — followed by EXACTLY PLATFORM_COMMENT_FOOTER. It is the one spelling of that comparison, shared with classifyReadBack's comment-only footer-appended class rather than written a second time.",
    "why_not_a_byte_count": "The platform normalises blank lines around a trailing rule in both directions (platform-readings), so length answers a different question: 'stored is shorter' is neither necessary (a re-anchored footer is LONGER than the sent body) nor sufficient (an equal-length substitution loses just as much). The rule also needs no PRE-WRITE body, which only --body ever holds: 'the platform kept the old one' is one INSTANCE of the class — whatever is stored, a byte that differs at an offset before the end of the sent body is a byte this act did not get onto the platform — so one predicate covers the filed hit, a truncation, a sanitizer substitution and a --comment write.",
    "filed_shape_pinned": "stored = the pre-write body, first difference at an offset inside the sent body, stored length not equal to sent length ⇒ exit 4. Pinned as KEPT_OLD in the new battery.",
    "comment_path": "YES, --comment shares this verdict: main builds ONE readBackVerdict for both acts and passes mode, so the same predicate judges both. A chewed comment now exits 4; the comment footer append is already clean one class earlier (footer-appended), so it still exits 0. Both pinned."
  },
  "exit_register": {
    "before": {
      "0": "written — including every read-back the tool could not vouch for",
      "1": "EXIT_USAGE",
      "2": "EXIT_REFUSED — contract refusal, nothing written",
      "3": "EXIT_PREREQUISITE_NOT_MET — no route, no act at all",
      "4": "(unused)"
    },
    "after": {
      "0": "written, and everything sent is on the platform",
      "1": "EXIT_USAGE (unchanged)",
      "2": "EXIT_REFUSED (unchanged)",
      "3": "EXIT_PREREQUISITE_NOT_MET (unchanged)",
      "4": "EXIT_NOT_STORED — NEW: written, and the platform did NOT store it. Caller: re-read the artefact; do NOT retry blindly (the measured hit was a size refusal the platform never reported, so an identical second write reproduces it)."
    },
    "unreadable": "deliberately NOT widened into 4 — 'the platform returned no readable body' is a failure to VERIFY, not a measured failure to store; it keeps its UNVERIFIED line and its 0, and the boundary is recorded in the header. Pinned as a case."
  },
  "pins": {
    "battery": "the exit code: the read-back reaches `$?`, or it reaches nobody",
    "registered": 24,
    "pinned_floor": 24,
    "SELF_TEST_BATTERY_FLOOR": "10 -> 11",
    "what_they_pin": [
      "the filed shape ⇒ exit 4",
      "a body-mode footer re-anchoring ⇒ exit 0, and still class mutated with its offset (the shape the seat hits on every seat-post refresh)",
      "the same re-anchoring over a stripped trailing newline ⇒ 0",
      "a trailing-newline-stripped read-back ⇒ 0",
      "an identical read-back ⇒ 0",
      "a real mutation UNDERNEATH an appended footer ⇒ 4 (the footer masks no loss)",
      "a chewed --comment read-back ⇒ 4, and the --comment footer append ⇒ 0",
      "a truncation ⇒ 4",
      "unreadable ⇒ 0, not widened",
      "the five register values distinct, and 4 apart from both 2 and 3",
      "the footer measured as exactly the declared bytes, not as a 58-byte delta (58 bytes of 'x' answers null)"
    ]
  },
  "ablation": {
    "what": "From the committed fix, on disk, under a trap, absolute paths: sentBodyLanded's last line `return readBack.footerReAnchored === true;` replaced by `return true;` — exactly the pre-fix behaviour.",
    "proof_the_edit_landed": "PRE blob d0dc60f58e4ca3b2155b5c05e312649fd9ed5d3e (== HEAD:scripts/pm/post-stamped.mjs); anchor occurrences BEFORE 1, AFTER 0; inject occurrences AFTER 1; POST blob 428cfb46b3fd3d40037bc370a605ea9a2f3c5cef. A first attempt whose perl one-liner silently matched nothing was caught by the script's own no-op guard and its reading discarded, not re-run until something stuck.",
    "direction_predicted_then_observed": "turns red",
    "ablated_run": "EXIT=1 — 6 of 257 case(s) failed, 0 floor problem(s). The six: THE FILED SHAPE landed=false; its exit === EXIT_NOT_STORED; a real mutation underneath an appended footer; the chewed --comment; the predicate-over-fields case; the truncation. The ten pre-existing batteries stay green, so the ablation moves exactly what it claims to move; the footer-re-anchoring controls stay green under the ablation by construction, which is why the filed-shape pins and not the controls are the ones that prove the fix.",
    "restore": "git checkout HEAD -- scripts/pm/post-stamped.mjs (HEAD named explicitly, never a bare checkout). RESTORED blob d0dc60f58e4ca3b2155b5c05e312649fd9ed5d3e == HEAD blob, and `git diff HEAD` empty — the restore is proven by hash and by state, never by an exit code.",
    "restored_run": "EXIT=0 — 257 cases pass across 11 batteries."
  },
  "self_test": "node scripts/pm/post-stamped.mjs --self-test (= pnpm check:pm-post-stamped): EXIT=0, '257 cases pass across 11 batteries — offline, no network, no token'. 233 -> 257 cases, 10 -> 11 batteries.",
  "tests": "Derived with `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` from the worktree (no hand-fed path list; change set = 1 path, scripts/pm/post-stamped.mjs). 29 derived, 29 run, ALL exit 0; each code captured with redirect-then-$?, never across a pipe. Reconciled: '✓ dispatch-gates --ran: 29 derived famil(ies) accounted for — 29 run, 0 NOT-MEASURED (a DERIVED zero — all 29 recorded an exit code and none of them is 3)'. Plus repo-wide `pnpm lint` (eslint . --no-inline-config) EXIT=0, run whole and not narrowed, at head 2f7df2abc; plus the author-side control-byte scan on the changed file (grep -naP over the C0 set) with no hits. Ablation: see the ablation block. NOT MEASURED: the derivation also names 53 artifact-roster families, 11 declared-wide-population families, 14 pending-changeset families and 1 path-scheduled CI job, each outside the 29 — CI owns them. CI on the PR had not converged at report time.",
  "gates": [
    "node scripts/check-ci-filter-parity.mjs :: exit 0",
    "node scripts/check-closing-keyword-parity.mjs :: exit 0",
    "node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0",
    "node scripts/check-comment-mask-corpus.mjs :: exit 0",
    "node scripts/check-declaration-mirrors.mjs :: exit 0",
    "node scripts/check-declaration-mirrors.mjs --self-test :: exit 0",
    "node scripts/check-scripts-symbol-anchors.mjs :: exit 0",
    "node scripts/check-scripts-symbol-anchors.mjs --self-test :: exit 0",
    "node scripts/check-self-test-wired.mjs :: exit 0",
    "node scripts/check-self-test-wired.mjs --self-test :: exit 0",
    "node scripts/check-self-test-workflow-commands.mjs :: exit 0",
    "node scripts/check-self-test-workflow-commands.mjs --self-test :: exit 0",
    "node scripts/check-whole-set-label-write.mjs :: exit 0",
    "node scripts/check-whole-set-label-write.mjs --self-test :: exit 0",
    "node scripts/pm/bare-root-worklist.mjs --self-test :: exit 0",
    "pnpm check:agent-test-spelling :: exit 0",
    "pnpm check:bash32-floor :: exit 0",
    "pnpm check:cli-command-ids :: exit 0",
    "pnpm check:cross-package-test-inputs :: exit 0",
    "pnpm check:driver-memory-census :: exit 0",
    "pnpm check:entry-guard :: exit 0",
    "pnpm check:nul-bytes :: exit 0",
    "pnpm check:parse-guard :: exit 0",
    "pnpm check:pm-dispatch-gates :: exit 0",
    "pnpm check:pm-post-stamped :: exit 0",
    "pnpm check:pnpm-filter-targets :: exit 0",
    "pnpm check:ratchet-remedy-authority :: exit 0",
    "pnpm check:refd-timer-probe :: exit 0",
    "pnpm check:watch-hint-literal :: exit 0"
  ],
  "mcp_calls": "0 — no MCP GitHub tool was called, read or write.",
  "api_writes": "3 REST proxy writes: POST /repos/objectstack-ai/objectstack/pulls (draft PR 18690); POST /repos/objectstack-ai/objectstack/issues/18690/labels (skip-changeset, additive, read back: ['size/m','skip-changeset'] — size/m is the size-labeler's, not mine); POST /repos/objectstack-ai/objectstack/issues/18663/comments (this report). Plus 2 git pushes on the branch (the empty-branch routing probe, then the fix). No PATCH of any body. PR body read back after creation: byte-identical to what was sent except the platform's trailing-newline strip (sent 13442 B, stored 13441, first difference at the final byte), one attribution footer, the leading rule survived.",
  "open_questions": [],
  "out_of_scope_findings": [
    "to file (class b, contract violated; dedupe words: post-stamped, classifyReadBack, footer-appended, issue body, unmeasured cell, platform-readings): the file's header declares the issue-body footer cell UNMEASURED — quote: 'whether the platform synthesises a footer for a footer-less ISSUE BODY is unmeasured, and an unmeasured cell is not a cell this tool forgives — a footer on a body read-back stays MUTATED until somebody measures it' — and the skills seat now reports hitting exactly that shape (sent N, stored N+58, the difference being the declared footer) on EVERY seat-post refresh. The file's own stated condition for moving the cell is met and the cell has not moved, so --body prints a MUTATED warning on nearly every write, which is the noise #18296 removed for the other classes. Remedy: record the reading in references/platform-readings.md and move the cell into footer-appended, or stop calling it unmeasured. Deliberately NOT done here: the card pins the exemptions as they are.",
    "noted, not filed: an `unreadable` read-back still exits 0, so a caller checking $? walks on with a write the tool could not verify. No repro in hand (the platform would have to return a body-less object), so it is an observation, not a defect card; the boundary is now written into the header instead of left implicit. Successor: whoever lands the card above — it edits this same function."
  ]
}

---

Generated by Claude Code

[os-justin]

ACCEPT — in-seat contract-tier review of PR #18690 (head 2f7df2abc, report 5716492346) by the skills seat, 2026-09-17T15:16Z. Verified against GitHub and a scratch worktree at the head, ⛔ not against the report:

• Scope = the claim (5716020362): one file, +240 / −21 — scripts/pm/post-stamped.mjs; skip-changeset correct (scripts/pm/** ships in no released package); Clause-②: no on the PR body and the claim, check-clause2-carriers --pair 18690 0. Premise re-checked by the dev against origin/main before the edit (the file byte-identical between the dispatch reading 137781f7d and the branch base); the seat's own worktree at the head agrees.
• The fix, read in the diff: export const EXIT_NOT_STORED = 4 joins the register (0 written-and-stored · 1 usage · 2 refused · 3 prerequisite · 4 written-but-NOT-stored, the five distinct); footerReAnchoring(sent, stored) answers non-null exactly when the stored body is the sent body, or its newline-trimmed form, followed by exactly PLATFORM_COMMENT_FOOTER — one spelling, shared with classifyReadBack's comment-mode footer-appended class; sentBodyLanded(readBack) — 「if (!readBack || readBack.class !== 'mutated') return true; return readBack.footerReAnchored === true;」 — is the whole predicate, and main builds ONE readBackVerdict for both --body and --comment, so a chewed comment exits 4 too. Exit 4 prints a stderr report telling the caller to re-read the artefact and ⛔ not retry blindly (the filed hit was a size refusal the platform never reported). unreadable deliberately stays 0 — a failure to VERIFY, not a measured failure to store — and the header now says so. Classes, exemptions, the warning line, the offset line and --json body_mutated untouched; nothing changes what is sent; no retry logic.
• Self-test on the head, seat's own run: node scripts/pm/post-stamped.mjs --self-test exit 0 — 257 cases across 11 batteries (233 / 10 on the base); the new battery 「the exit code: the read-back reaches $?, or it reaches nobody」 registers 24 and pins 24, SELF_TEST_BATTERY_FLOOR 10 → 11. Pinned there: the filed shape (stored = the pre-write body, first difference inside the sent body) ⇒ 4; a body-mode footer re-anchor ⇒ 0 and still class mutated with its offset (the shape this seat hits on every seat-post refresh); the same over a stripped trailing newline ⇒ 0; identical ⇒ 0; a real mutation UNDERNEATH an appended footer ⇒ 4; a chewed --comment ⇒ 4 and the comment footer append ⇒ 0; a truncation ⇒ 4; unreadable ⇒ 0; the footer measured as the declared bytes, not as a 58-byte delta.
• Ablation (the dev's, accepted as read): return readBack.footerReAnchored === true; → return true; on disk, proven by blob hash before and after; exactly six cases red (the filed shape, its exit, the masked mutation, the chewed comment, the predicate-over-fields case, the truncation), the ten older batteries green; restore proven by blob hash and empty git diff HEAD, then 257 / 257.
• Gates: 29 derived from the tree, 29 run, 0 NOT-MEASURED, all exit 0, plus repo-wide pnpm lint exit 0 at the head — per the report; seat-side: self-test above, pair 0, harness CURRENT. CI on the head: 41 check runs read explicitly, every one completed — 27 success, 10 skipped (all in the expected-skips roster, exit 0), 4 cancelled superseded duplicates whose later run on the same head is success; commit status success; none failure.
• Writes: api_writes 3 (draft PR, skip-changeset via label-write read back, this report), mcp_calls 0, PR body written once at create and read back byte-identical bar the trailing-newline strip — within budget.
• Out-of-scope: (1) the header's issue-body footer cell is called unmeasured while the fact table measures it — raised here as class b and by the finding(platform-readings): three readings owed to the governed fact table — zod v4 parse-spying, a per-TOKEN (not per-channel) REST write identity, and a depth-wait command that is not repo-local #18426 dev alike, filed once by the seat as [finding] post-stamped.mjs's header declares the issue-body footer cell UNMEASURED while platform-readings carries the measurement — every seat-post refresh prints a MUTATED warning #18693 (bare finding; serial on this file behind this PR and pm(post-stamped): {{NOW}} is substituted inside a QUOTATION of the token, so a seat cannot quote the tool's own diagnostic through the tool — measured as a false quotation published on #14251 #18543); (2) unreadable exits 0 with no repro in hand — noted, the boundary is now in the header; the successor is [finding] post-stamped.mjs's header declares the issue-body footer cell UNMEASURED while platform-readings carries the measurement — every seat-post refresh prints a MUTATED warning #18693's dev.
• Landing: non-governed (scripts/pm/**) ⇒ this seat's ACCEPT is the review of record; ready + auto-merge SQUASH through the CCR route follow in the same act, then the queue and merged_at.

---

Generated by Claude Code

[os-justin]

LANDED — PR #18690 (#18663, post-stamped exits non-zero when the platform did not store the body) merged through the queue at 2026-09-17T15:58:47Z (merged_at), squash 2fd23d098 (single parent f8eaf6704, an ancestor of origin/main; EXIT_NOT_STORED = 4 :438, footerReAnchoring :931 and sentBodyLanded :952 read in scripts/pm/post-stamped.mjs on main, and --self-test on main answers 257 cases / 11 batteries); armed by this seat through the CCR route after the in-seat ACCEPT 5716785646 — ready 2026-09-17T15:16:34Z, added_to_merge_queue 2026-09-17T15:16:36Z, ~42 min in the queue behind PR #18676 / #18684 / #18678. The card auto-closed completed at 2026-09-17T15:58:48Z on the PR's Fixes; pm:dispatched is stripped in the same act. Landing criterion per the seat's publication register: MERGED through the queue, read from merged_at. Follow-ups on this file: #18543 (queued, now free of this serial) and the filed #18693 (the header's unmeasured cell), bare for triage.

---

Generated by Claude Code