fix(pm): the issue-body footer cell is measured — give each footer shape its own clean class

[os-justin]

Fixes #18693

Clause-②: no

What was left after PR #18758

PR #18758 (#18709) made $? answer 0 for both footer shapes and took the prescription out of the status line. What it explicitly did not touch is the CLASS: the body-mode footer append and the trailing-rule re-anchor stayed mutated, --json kept reporting body_mutated: true, and the header kept declaring the issue-body footer cell UNMEASURED with two pinned controls holding it there. So the tool said two things about one set of bytes on nearly every write a seat made — "everything sent is on the platform" in $?, "MUTATED" on stderr — and a warning that fires on nearly every write is one nobody reads, which is what the read-back exists to be read.

This PR moves the cell, on a measurement.

① The controlled contrast — the triage seat's first ask (5716957331)

Two --body sends to one artefact this act owns (the body of this PR, written through PATCH /repos/OWNER/NAME/issues/NUMBER, which is the endpoint --body uses for a card and for a PR alike), differing ONLY in whether the sent tail ends in the 58-byte footer block, each read back byte-exact by the tool itself:

arm	sent tail	sent	stored	delta	first differing byte	class on main 2085be2b2d	class on this branch	shape	$?
A	prose — no block at all	10749	10807	+58	10749 — the seam, where the stored body keeps going	mutated	footer-appended	appended	0
B	ends in the block plus one newline	10808	10808	0	10751	mutated	footer-re-anchored	re-anchored	0

Both arms are the same body; arm B is arm A plus 59 bytes at the tail (the 58-byte block and one newline) and nothing else — armB.startsWith(armA) holds. Each was sent by node scripts/pm/post-stamped.mjs --body=18786 --repo=objectstack-ai/objectstack --file=… --json, exit captured with redirect-then-$?, and the stored bytes were then fetched again independently and compared here:

• A: stored === sent + PLATFORM_COMMENT_FOOTER — exactly true. The platform synthesised the block on a footer-less body, once, 58 bytes, on this channel.
• B: stored === head + "\n" + PLATFORM_COMMENT_FOOTER — exactly true, and the stored body carries exactly ONE attribution block, not two. The newline this act sent after the block moved to before its rule: equal length, one byte moved, zero lost.

What the status line says on the same bytes, main against this branch:

ARM A  main  : ⚠️ read-back: sent 10749 byte(s), stored 10807 — the platform NORMALISED its own footer block
               and took nothing away. Class MUTATED, and ⛔ nothing here to go read the artefact for.   (4 lines)
ARM A  branch:   read-back: clean — the platform appended its footer (sent 10749, stored 10807)          (2 lines)

ARM B  main  : ⚠️ read-back: sent 10808 byte(s), stored 10808 — the platform NORMALISED its own footer block
               and took nothing away. Class MUTATED, and ⛔ nothing here to go read the artefact for.   (4 lines)
ARM B  branch:   read-back: clean — the platform re-anchored its own footer block: the newline this act sent
               after it moved to before its rule, and every byte sent IS stored (sent 10808, stored 10808)  (2 lines)

One more reading, taken for free on the way in and reported rather than acted on: the create of this PR (POST /pulls, body ending in the session-URL footer block plus a newline) stored 10840 against 10841 sent — the trailing newline stripped, nothing appended, exactly one attribution block. That is the trailing-newline-stripped cell, and it is a PR-body CREATE reading, which is #18622's surface, not this card's.

The variable that is NOT the sent tail, and the one that is left

The triage seat proposed "the sent tail ending in the block" as the trigger, from two --body=6015 sends that read IDENTICAL against this card's three --body=7623 sends at +58. That candidate is falsified in both directions, and neither reading needed re-taking:

• The skills seat's three --body=7623 refreshes on 2026-09-17 (cited as the seat's, in the claim 5720594990): 47699 to 47757, 49671 to 49729, 52030 to 52088. Their sent tails carried NO block, and the read-back is +58 each.
• This act re-read both stored bodies without writing to either. Card [PM seat] domain:skills — 🟢 os-tesla · session_01W5y9kRg1YtYaMQYExVLRc2 · R1 in seat · landed 5 (#18698 · #18862 fold · #18989 · #19091 · #19036) · in flight 0 · awaiting human merge 2 (objectui#9994 · objectui#9997) · queue 26 (p1 0 dispatchable, p2/p3 held by 北极星第 3 条) · decision box 1 · body r5e #7623's stored body ends in exactly one block, its sole occurrence of the attribution link, over the newline the seat sent: the platform synthesised it. Card [PM seat] triage (objectstack-wide) — ⚪ 座位空缺 · 前任 session_01Y6AwMBAN8zRUHgmgFdV1Qr 执「全板大扫除试运行」班 2026-09-19T01:5xZ 奉维护者令收班 · 收班简报 5738544201 · ⛔⛔ 本班一次影响 8 张卡的误判已全部回滚,接手先读正文「本班(大扫除试运行班)收班交接台账」再定级 · ⛔ 无自绑 Routine,座位不会自己醒 · 跨席请求欠 3 条 #6015's stored body contains zero occurrences of that link at all, so nothing was synthesised there either — the triage seat's IDENTICAL reading is confirmed from the artefact, not only from its transcript.

Same endpoint, same shape of sent body (no block in the tail), opposite outcomes. So the live variable is the WRITE CHANNEL, or the identity behind it.

This act cannot vary it, and says so rather than guessing. Both GitHub credentials in this container (GITHUB_TOKEN, GH_TOKEN) are byte-identical proxy-issued placeholders that resolve to one identity, os-justin; the MCP GitHub write tools are refused to an os-dev by contract. There is one channel here and no second one to compare against. Naming it is the deliverable; measuring it needs a seat that holds the other channel.

And the tool does not need to know which channel it is on, which is what lets the cell move. The read-back compares exact bytes: a footer-less body that comes back unchanged is identical, and one that comes back with exactly the declared block appended is footer-appended. Those two cells are not confusable — the objection "a cell the tool cannot tell apart must not be forgiven" simply does not apply to this cell. Whichever way the channel goes, the verdict is right.

② The class decision

The body-mode append and the re-anchor leave mutated, and each measured shape gets its OWN declared word:

• footer-appended — the stored body is the sent one, or its newline-trimmed form, plus exactly PLATFORM_COMMENT_FOOTER. Both acts now. The measurement it rests on: platform-readings.md :410 「建卡走 REST POST /issues:带页脚存活,无页脚合成恰一条(+58);回读后 PATCH 重送逐字节存下。」 and :411 「issue 正文 PATCH 识别按整块:送全块或不送页脚都存回恰一条,已有页脚归一末尾不复制。」 — :411 is the act --body performs — plus the live readings above.
• footer-re-anchored — NEW, because footer-appended says "plus exactly the footer" and a moved newline added nothing; borrowing that word would make the vocabulary say something untrue about the bytes, which the file refused for good reason. Its measurement is :356/:357 「平台在尾部 --- 前后正反两向归一空行」 / 「送全块即触发该归一 ⇒ post-stamped 的 body 档把这点空白判 mutated,净零字节良性告警。」 and the four live artefacts PR fix(pm): teach footerReAnchoring the second re-anchor shape — a moved newline is not a lost byte #18758 pinned.
• mutated now means one thing — nobody measured this — and sentBodyLanded reads the CLASS alone. body_mutated is false exactly where body_landed is true: one set of bytes, one answer, in $?, on stderr and in --json.

classifyReadBack therefore takes no mode. The act-shaped gate existed for exactly one reason — the issue-body cell was unmeasured — and an exact-bytes comparison cannot tell one act's write from another's anyway. Leaving the parameter behind would leave a knob a caller can set that decides nothing, which is the shape this repo files cards about; a pin asserts the signature carries no mode at all. The word for the surface survives where it is actually read: notStoredText still prints "comment" or "body", and the CLI hands options.mode to that.

Why this branch and not "rewrite the header to say what IS unmeasured": both were done. The cell moved because it is measured and distinguishable; the header now names the write channel as the thing nobody has measured, with the readings on each side, instead of naming the cell.

The card's sentence, split between two PRs

The card reads 「every seat-post refresh prints a MUTATED warning」.

• PR fix(pm): teach footerReAnchoring the second re-anchor shape — a moved newline is not a lost byte #18758 closed: the prescription half. The line no longer tells the seat to go read the artefact for a shape the tool measured as benign, and $? stopped answering 4.
• This PR closes: the word itself. The refresh prints read-back: clean — the platform appended its footer (sent N, stored N+58) and --json answers body_mutated: false. The interim reading the card carries — that the cell is unmeasured — is retired in the header, with the measurement and the channel caveat written in its place.

The pins, re-pointed

The two the card names, at their post-#18758 line numbers:

• :2409 「⭐ THE CONTROL: the same append in BODY mode stays MUTATED — an unmeasured cell is not forgiven」 becomes ⭐ THE MOVED CELL: those same bytes from a BODY write are CLEAN too — a MEASURED cell is not warned about, beside a second pin that the two answers are now one (not-mutated exactly where it landed).
• :2452's control, likewise: the seat-post refresh shape is footer-appended, no longer MUTATED, still exit 0, still measured as EXACTLY the declared footer and never as a 58-byte delta, and its line now names the append and carries both byte counts.
• The re-anchor battery from PR fix(pm): teach footerReAnchoring the second re-anchor shape — a moved newline is not a lost byte #18758 keeps all four live artefacts and re-points to the new class: the class is footer-re-anchored and never footer-appended; the recorded first-difference offsets are still pinned, read from firstDifferingByte — the clean class prints no offset line, the same as every other benign class, so the verdict is two lines and readBack.offset is null.
• sentBodyLanded is pinned on the class alone: a mutated verdict carrying footerReAnchored: true does NOT land. The field stays on the result as a measurement --json reports; it is no longer a second door to exit 0.
• The declared-vocabulary probe went from five inputs/five classes to six/six.

The exit-4 controls: every one re-run, every one still red

PR #18758's battery is unchanged and green: a byte lost before the rule; a byte changed at equal length (with the explicit assertion that both sides ARE equal length); a loss inside the footer block; a footer whose link was rewritten; a sanitizer chew under a moved newline; a newline that came from nowhere; a newline inserted somewhere other than immediately before the block; a truncation that happens to end in the block. All eight still exit 4, and unreadable still exits 0 as UNVERIFIED.

The ablation

Deleting the one branch that turns a measured footer shape into a class, from the committed fix at cb21adf430:

HEAD blob hash: 177eeb648b23a8148e825a33277e785df182aa7e
marker occurrences BEFORE mutation: 1
marker occurrences AFTER mutation:  0
mutated blob hash: d487450089e132f109602c570c1e9a9892663497
ON-DISK PROOF: marker 1 -> 0, hash 177eeb648b… -> d487450089…
ABLATED self-test exit: 1
✗ post-stamped self-test: 30 of 349 case(s) failed, 0 floor problem(s).
restored blob hash: 177eeb648b23a8148e825a33277e785df182aa7e
git diff HEAD after restore: (empty — no path listed)
RESTORED self-test exit: 0
✓ post-stamped self-test: 349 cases pass across 13 batteries

30 of 349 red, and they are the right 30: the moved cell, the new class, the lines that name them, and the four live re-anchor artefacts' "it LANDED" and "measured as the re-anchor by name". Every exit-4 control stays green with the branch deleted — which is what a control is for; one that went red here would have been testing the branch, not the contract. 0 floor problems, so no battery went quiet. Restore is proven by blob-hash equality against HEAD and by an empty git diff HEAD, never by an exit code, under a trap … EXIT INT TERM with absolute paths, and an empty hash is treated as failure.

Self-test

347 cases across 13 batteries becomes 349 across 13. No battery floor moved; SELF_TEST_BATTERY_FLOOR and every per-battery count are untouched.

Derived gates

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack from the worktree, no hand-fed path list; change set 1 path, scripts/pm/post-stamped.mjs. Each exit code captured with redirect-then-$?:

0  node scripts/check-ci-filter-parity.mjs
0  node scripts/check-closing-keyword-parity.mjs
0  node scripts/check-closing-keyword-parity.mjs --self-test
0  node scripts/check-comment-mask-corpus.mjs
0  node scripts/check-declaration-mirrors.mjs
0  node scripts/check-declaration-mirrors.mjs --self-test
0  node scripts/check-scripts-symbol-anchors.mjs
0  node scripts/check-scripts-symbol-anchors.mjs --self-test
0  node scripts/check-self-test-wired.mjs
0  node scripts/check-self-test-wired.mjs --self-test
0  node scripts/check-self-test-workflow-commands.mjs
0  node scripts/check-self-test-workflow-commands.mjs --self-test
0  node scripts/check-whole-set-label-write.mjs
0  node scripts/check-whole-set-label-write.mjs --self-test
0  node scripts/pm/bare-root-worklist.mjs --self-test
0  pnpm check:agent-test-spelling
0  pnpm check:bash32-floor
0  pnpm check:cli-command-ids
0  pnpm check:cross-package-test-inputs
0  pnpm check:driver-memory-census
0  pnpm check:entry-guard
0  pnpm check:nul-bytes
0  pnpm check:parse-guard
0  pnpm check:pm-dispatch-gates
0  pnpm check:pm-post-stamped
0  pnpm check:pnpm-filter-targets
0  pnpm check:ratchet-remedy-authority
0  pnpm check:refd-timer-probe
0  pnpm check:watch-hint-literal

All 29 exit 0. pnpm check:pm-dispatch-gates was run DETACHED with its output to a file (745.9s on this box), never under a foreground timeout. Reconciled with --ran: 29 derived, 29 run, 0 NOT-MEASURED, 0 UNRUN — a DERIVED zero, since all 29 records carry an exit code. The gate list was re-derived after a fresh git fetch origin main (2085be2b2d) and is byte-identical to the first derivation. Repo-wide pnpm lint (eslint . --no-inline-config): exit 0, no findings, at cb21adf430.

Read, not folded in

• [finding] A PR body EDIT appends the BARE attribution footer while CREATE stores the session-URL form verbatim — an edited body silently loses which session wrote it #18622 (p3 — a PR body EDIT appends the bare footer while CREATE stores the session-URL one) and [finding] platform-readings 的 PR 正文页脚格:第四形与「尾部横线连页脚一并被吃」的处方相互张力 —— 照处方写在建 PR 侧可能恰好触发追加 #18686 (p3 — the PR-body side of this same contrast gap). Read both. This PR's diff touches neither: what ① measured on this PR's body is reported on the card, not turned into a second fix. The --body act reaches a PR through the ISSUE endpoint, so the arms above are the issue-body cell's endpoint exercised on a PR object; an issue object on the same channel is the seat's [PM seat] domain:skills — 🟢 os-tesla · session_01W5y9kRg1YtYaMQYExVLRc2 · R1 in seat · landed 5 (#18698 · #18862 fold · #18989 · #19091 · #19036) · in flight 0 · awaiting human merge 2 (objectui#9994 · objectui#9997) · queue 26 (p1 0 dispatchable, p2/p3 held by 北极星第 3 条) · decision box 1 · body r5e #7623 reading, the same direction.

This body was written four times, on purpose

The create, the two contrast arms, and this one. ① could not be measured without two sends to an artefact this act owns, and writing another seat's post to measure it is refused; the dispatch named this PR's body as the target. The two arms are the timeline events between the create and this write. This is the last write this act makes to this body.

---

Generated by Claude Code