fix(scripts/pm): the read-back names the collapse OVER the strip instead of calling the write lost

[os-steve]

Fixes #19312

Clause-②: no

post-stamped --body answered exit 4 — WRITTEN BUT NOT STORED … the write did NOT land — on thirteen writes that had landed whole. The response a false NOT-STORED invites is the one that duplicates a card body: a re-post.

What was measured

Thirteen --body writes in one shift exited 4 on the same one-line difference: 7 of 11 at 2026-09-20T21:40Z (#19343 · #19360 · #19390 · #19392 · #19395 · #19396 · #19404) and 6 more at 22:31Z (#19179 · #19221 · #19309 · #19336 · #19439 · #19440). The body sent \n\n\n--- before its trailing footer rule and the platform stored \n\n---, content byte-identical on a fresh GET.

Reproduced offline on this branch's base (57ceb9d), with the stored tails read back from the cards themselves:

sent	stored	class at 57ceb9d	class here
H + \n + block	H + block	footer-blank-collapsed, exit 0	unchanged
H + \n + block + \n	H + block	mutated, exit 4	footer-blank-collapsed, exit 0
H + block + \n	H + \n + block	footer-re-anchored, exit 0	unchanged
H + \n\n + block + \n	H + block	mutated, exit 4	unchanged — exit 4

The failing row is the shape a seat post's --body write actually sends: the file ends in a newline and its last paragraph stands a blank line above the rule, so three newlines go out before the rule and one after the block. The platform strips the trailing newline and collapses the run back to the block's own two. Two acts, both already declared on their own; the classifier had no arm for the pair.

The one predicate that decided it

footerReAnchoring's collapse arm required strippedNewlines === 0 and read sentText. It now reads the trimmed body, so ONE arm covers the collapse alone and the collapse over the strip:

-  if (strippedNewlines === 0 && sentText.endsWith(PLATFORM_COMMENT_FOOTER)) {
-    const head = sentText.slice(0, sentText.length - PLATFORM_COMMENT_FOOTER.length);
-    if (stored === `${head}${PLATFORM_COMMENT_FOOTER_COLLAPSED}`) return { strippedNewlines: 0, shape: 'collapsed' };
+  if (trimmed.endsWith(PLATFORM_COMMENT_FOOTER)) {
+    const head = trimmed.slice(0, trimmed.length - PLATFORM_COMMENT_FOOTER.length);
+    if (stored === `${head}${PLATFORM_COMMENT_FOOTER_COLLAPSED}`) return { strippedNewlines, shape: 'collapsed' };

Still an exact === against a candidate BUILT from the sent bytes, and the head is still compared literally. ⛔ No multiset compare, ⛔ nothing position-insensitive, ⛔ no pattern, ⛔ no length test.

The DECLARED set, before and after

Only one row moved, and it moved by naming a cell that is now measured rather than by widening a comparison.

• before — footer-blank-collapsed: the stored body is that body with the blank line immediately before the footer block's rule collapsed — one newline of the block's own separator gone, and no content byte touched. The arm refused the pair in prose too: a sent body that carried trailing newlines AND came back collapsed is a cell nobody has measured, and an unmeasured cell is not one this tool forgives.
• after — the same row, …collapsed, over any trailing newline(s) the platform does not keep — one newline of the block's own separator gone, and no content byte touched.

identical, trailing-newline-stripped, footer-appended, footer-re-anchored, mutated are untouched, and no class was added: the vocabulary is still six words.

The rendered line had to move with it, because it said the one byte short is that separator newline about a body that is now two short. It names the second byte when there is one: COLLAPSED, over 1 stripped trailing newline(s), so the byte(s) short are that separator newline and the newline(s) the platform does not keep, and every CONTENT byte sent IS stored.

The three pinned fixtures

1. Today's pair, carried by the three cards whose stored byte counts were read back off the platform (removed_from_merge_queue fires on a SUCCESSFUL merge too — 3 of 5 on this board today were merges, so the event is not a failure signal #19343 · 3585, [finding] the spec-property-retirement playbook prescribes a major changeset that a live per-PR gate refuses — copy the checklist line verbatim and the PR reddens #19360 · 2892, [finding] a job log refused over REST is still readable through the MCP read tool — a seat mis-read one blocked channel as no channel and mis-diagnosed a queue ejection #19404 · 4623): classifies footer-blank-collapsed with strippedNewlines: 1, lands, exit 0.
2. One CONTENT byte different under the very same strip-and-collapse: exit 4.
3. The footer RELOCATED — the same bytes in another position, equal length, identical multiset: exit 4, with firstDifferingByte pinned at 0.

Plus the pin this change had to rewrite rather than delete: the case that asserted footerReAnchoring(sent + newline, collapsed) === null pinned exactly the branch being removed, so it now asserts the measured shape and its recorded strippedNewlines. Every other exit-4 control in both footer batteries is untouched and still green — a byte lost before the rule, a byte changed, a chewed footer, a rewritten link, a truncation ending in the block, a newline from nowhere, both separator newlines gone, and the whitespace-only truncation in the CONTENT (row 4 of the table above).

The relocation decision, on the four axes

The card's original claim was a pure RELOCATION of the footer — sent and stored differing by position while the multisets are identical — and suggested a multiset compare. That shape stays exit 4, pinned as fixture 3.

• 实际业务需求 — no relocation has ever been measured on this channel. The card's claim was inherited and explicitly not re-measured; when the seat did re-measure it today, what it found was the blank-line collapse, with the footer exactly where it was sent. A declared class for a cell nobody has read serves no write that exists.
• 项目长远合理性 — the tool's entire value is an exact compare against a named list of measured transformations. no workarounds: a positional exemption with no reading behind it is tolerance, not a contract.
• 防 AI 写错 — this is the decisive axis. Forgiving "same bytes, different order" is precisely what makes [finding] post-stamped reported read-back identical for a body the platform rewrote in 482 places — the one case read-back exists to catch #19350 worse: that card is the read-back going SILENT on a body the platform rewrote in 482 places, and a rewrite that happens to preserve the byte multiset would pass a multiset compare. Strictness on the loud side must not be bought with silence on the quiet one.
• 创业阶段不扩散 — zero measured instances, zero pull, so implementation-first: it is not declared. If the platform is ever measured relocating a footer, that reading adds its own arm with its own word.

The boundary this change holds

#19350 (closed) is the OPPOSITE direction of the same comparison and the reason widening is refused. The only newly forgiven shape here is stored === (sent minus its own trailing newlines, with the footer block's leading blank line collapsed). Any content rewrite — including a 482-place one — makes that === fail, so nothing in this change moves the read-back toward silence. The boundary is re-stated in prose in the classifier docblock; #19350 is not addressed here.

Verification

• node scripts/pm/post-stamped.mjs --self-test :: exit 0 — 544 cases across 18 batteries, up 14.
• Reverse verification (ablation): re-adding the single predicate strippedNewlines === 0 && — through scripts/ablation-replace.mjs, anchor hit 1 time, blob 46734b107fcd to b24615b0ab9a on disk — turns the self-test red in exactly the expected direction: 9 of 544 cases fail, all of them the new ones, 0 floor problems. Restore leg verified against HEAD's blob, not an exit code: blob == HEAD (46734b107fcd) and git diff HEAD empty.
• The derived gate union for this diff (node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, no paths): 30 families, each run with its exit captured BEFORE any pipe. Reconciled with --ran: 30 derived, 30 run, 0 UNRUN.
• NOT governed: the GOVERNED_SURFACES register in scripts/pm/check-governed-merges.mjs carries docs/adr/, .claude/, skills/, AGENTS.md, CLAUDE.md and docs/NORTH-STAR.md — scripts/pm/** is on none of them. The --pair reading is in the report on the card.

Acceptance notes

• .claude/skills/pm-dispatch/references/platform-readings.md :360 records the tool's pre-fix behaviour as a fact — 「送全块即触发该归一 ⇒ post-stamped 的 body 档把这点空白判 mutated,净零字节良性告警。」 — and is stale once this lands. That file is a governed fact table and outside this card's declared file surface; carrier: the domain:skills seat, alongside this PR. Line :359 (「平台在尾部 --- 前后正反两向归一空行」) is unaffected and is in fact the reading this change acts on.
• \n\n\n--- reaches the platform because the body FILE carries the extra blank line, not because the tool adds one. Whether the seat's body composition should normalise its own tail before the write is a separate question from whether the read-back should name what the platform does with it; noted, not filed — this PR changes only the instrument's reading.
• Net +49 lines in one file, inside the PM's +60 budget.

---

Generated by Claude Code

[os-steve]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 8cc37b7a57b71f023fd445ea44e4f22adc7adcc7

① Derived judgments

• Published accept set / public surface: none moves — the seat's own write tool (scripts/pm/post-stamped.mjs, +73 / −24, net +49 against the ≤ +60 budget): one arm of the one shared read-back predicate footerReAnchoring, the class description it feeds, the rendered line, docblocks and 14 self-test cases; no class added or removed, the exit-4 text unchanged, the --comment keyed-line reader (PR fix(pm): refuse a claim's unreadable keyed lines before post-stamped writes the comment #19435) and the stamp contract (post-stamped refuses a {{WAS:}}-declared stamp inside a fenced code block, and its refusal prescribes the declaration that is already there #19319) untouched. check-governed-merges --pr 19456: NOT governed — ordinary queue landing. Judged correct.
• The fix, read line by line: the collapse arm used to require strippedNewlines === 0 and read the RAW sent text — a deliberate refusal of a then-unmeasured cell — so a body that sent both a trailing newline and the blank line above its rule (\n\n\n---…\n, what every --body write of a seat post sends) came back mutated and exit 4 when the platform stored the block's own \n\n---…. The arm now reads the TRIMMED body, so ONE arm covers the collapse alone and the collapse over the strip, the strip count recorded on the verdict and named on the line (「over 1 stripped trailing newline(s)」); the comparison stays an exact === against a candidate BUILT from the sent bytes, the head compared literally. The seat's two mechanism assumptions were refined by measurement, correctly: the collapse ALONE was already clean on origin/main (the seat's claim conflated the two acts), and there is no separate --comment classifier to share — since [finding] post-stamped.mjs's header declares the issue-body footer cell UNMEASURED while platform-readings carries the measurement — every seat-post refresh prints a MUTATED warning #18693 one predicate judges both acts, the comment writes passed on their BYTES (the re-anchored shape), so no second parser was written. Bounded exactly as [finding] post-stamped reported read-back identical for a body the platform rewrote in 482 places — the one case read-back exists to catch #19350's close requires: a content byte differing under the same strip-and-collapse still exits 4, a footer RELOCATED (the card's original claim — equal bytes in another position) still exits 4, a multiset compare is refused by pin, two extra blank lines stay an unmeasured cell. Judged correct.
• Evidence, seat-run on this head in a detached worktree: --self-test exit 0 — 544 cases across 18 batteries (530 on origin/main, +14, none removed); the seat's own offline probes through classifyReadBack on this head: today's pair → footer-blank-collapsed, landed; the collapse alone → landed; a content byte differing → mutated, not landed; two extra blank lines → mutated; identical → identical. merge-tree vs origin/main 8e368dc: 0 conflicts; CI on 8cc37b7: 34 check runs, 2 still running, 0 red. The dev's ablation (the strippedNewlines === 0 guard re-added on disk → 9 of 544 red, all among the 14 added; blob restored and proven), the three FILED stored byte counts (removed_from_merge_queue fires on a SUCCESSFUL merge too — 3 of 5 on this board today were merges, so the event is not a failure signal #19343 3585, [finding] the spec-property-retirement playbook prescribes a major changeset that a live per-PR gate refuses — copy the checklist line verbatim and the PR reddens #19360 2892, [finding] a job log refused over REST is still readable through the MCP read tool — a seat mis-read one blocked channel as no channel and mis-diagnosed a queue ejection #19404 4623) pinned as the transformation's own arithmetic, the 30-family derived union 30 / 30 exit 0 with --ran reconciled, repo-wide pnpm lint exit 0, check:pm-dispatch-gates exit 0 (foreground, 16 min).

② Semver level

None — nothing published; skip-changeset on the PR is the correct declaration. Judged correct.

③ Boundary flags

open_questions empty. Assumptions 1 and 2 REFINED as above (the refinements are the fix's precision, not a premise failure); 3 and 4 confirmed (the only open PR on the file; NOT governed; origin/main moved under the run without touching this file, derivations three-dot against the unchanged merge base). Deviations read and accepted (the slow gate re-run in the foreground after the detached wrapper left no exit file; repo-wide lint run rather than narrowed). One carrier: item the seat takes: references/platform-readings.md :360 records the PRE-fix verdict (「body 档把这点空白判 mutated,净零字节良性告警」) and is stale the moment this lands — a Tier S row outside this card's surface; the seat adds it to the platform-readings family (#19343 entry) as the row to rewrite. Two noted, not filed items stay notes (a seat's body composition normalising its own tail; two extra blank lines as a deliberately unmeasured cell).

Implemented-by: claude/issue-19312-read-back-declares-footer-relocation
Reviewed-by: session_017ETYWqMQD4qMtZzAGovWNi

VERDICT: PASS

---

Generated by Claude Code