fix(pm): the issue-body footer cell is measured — give each footer shape its own clean class (#18786)

Fixes #18693

`Clause-②: no`

## What was left after PR #18758

PR #18758 (#18709) made `$?` answer 0 for both footer shapes and took
the prescription out of the status line. What it explicitly did not
touch is the CLASS: the body-mode footer append and the trailing-rule
re-anchor stayed `mutated`, `--json` kept reporting `body_mutated:
true`, and the header kept declaring the issue-body footer cell
UNMEASURED with two pinned controls holding it there. So the tool said
two things about one set of bytes on nearly every write a seat made —
"everything sent is on the platform" in `$?`, "MUTATED" on stderr — and
a warning that fires on nearly every write is one nobody reads, which is
what the read-back exists to be read.

This PR moves the cell, on a measurement.

## ① The controlled contrast — the triage seat's first ask (5716957331)

Two `--body` sends to one artefact this act owns (the body of this PR,
written through `PATCH /repos/OWNER/NAME/issues/NUMBER`, which is the
endpoint `--body` uses for a card and for a PR alike), differing ONLY in
whether the sent tail ends in the 58-byte footer block, each read back
byte-exact by the tool itself:

| arm | sent tail | sent | stored | delta | first differing byte | class
on `main` `2085be2b2d` | class on this branch | shape | `$?` |
|---|---|--:|--:|--:|--:|---|---|---|--:|
| **A** | prose — no block at all | 10749 | 10807 | **+58** | 10749 —
the seam, where the stored body keeps going | `mutated` |
`footer-appended` | `appended` | 0 |
| **B** | ends in the block plus one newline | 10808 | 10808 | **0** |
10751 | `mutated` | `footer-re-anchored` | `re-anchored` | 0 |

Both arms are the same body; arm B is arm A plus 59 bytes at the tail
(the 58-byte block and one newline) and nothing else —
`armB.startsWith(armA)` holds. Each was sent by `node
scripts/pm/post-stamped.mjs --body=18786
--repo=objectstack-ai/objectstack --file=… --json`, exit captured with
redirect-then-`$?`, and the stored bytes were then fetched again
independently and compared here:

- **A**: `stored === sent + PLATFORM_COMMENT_FOOTER` — exactly true. The
platform synthesised the block on a footer-less body, once, 58 bytes, on
this channel.
- **B**: `stored === head + "\n" + PLATFORM_COMMENT_FOOTER` — exactly
true, and the stored body carries exactly ONE attribution block, not
two. The newline this act sent after the block moved to before its rule:
equal length, one byte moved, zero lost.

What the status line says on the same bytes, `main` against this branch:

```
ARM A  main  : ⚠️ read-back: sent 10749 byte(s), stored 10807 — the platform NORMALISED its own footer block
               and took nothing away. Class MUTATED, and ⛔ nothing here to go read the artefact for.   (4 lines)
ARM A  branch:   read-back: clean — the platform appended its footer (sent 10749, stored 10807)          (2 lines)

ARM B  main  : ⚠️ read-back: sent 10808 byte(s), stored 10808 — the platform NORMALISED its own footer block
               and took nothing away. Class MUTATED, and ⛔ nothing here to go read the artefact for.   (4 lines)
ARM B  branch:   read-back: clean — the platform re-anchored its own footer block: the newline this act sent
               after it moved to before its rule, and every byte sent IS stored (sent 10808, stored 10808)  (2 lines)
```

One more reading, taken for free on the way in and reported rather than
acted on: the **create** of this PR (`POST /pulls`, body ending in the
session-URL footer block plus a newline) stored 10840 against 10841 sent
— the trailing newline stripped, nothing appended, exactly one
attribution block. That is the `trailing-newline-stripped` cell, and it
is a PR-body CREATE reading, which is #18622's surface, not this card's.

### The variable that is NOT the sent tail, and the one that is left

The triage seat proposed "the sent tail ending in the block" as the
trigger, from two `--body=6015` sends that read IDENTICAL against this
card's three `--body=7623` sends at +58. That candidate is falsified in
both directions, and neither reading needed re-taking:

- The skills seat's three `--body=7623` refreshes on 2026-09-17 (cited
as the seat's, in the claim 5720594990): 47699 to 47757, 49671 to 49729,
52030 to 52088. Their sent tails carried NO block, and the read-back is
+58 each.
- This act re-read both stored bodies without writing to either. Card
#7623's stored body ends in exactly one block, its sole occurrence of
the attribution link, over the newline the seat sent: the platform
synthesised it. Card #6015's stored body contains zero occurrences of
that link at all, so nothing was synthesised there either — the triage
seat's IDENTICAL reading is confirmed from the artefact, not only from
its transcript.

Same endpoint, same shape of sent body (no block in the tail), opposite
outcomes. So the live variable is the WRITE CHANNEL, or the identity
behind it.

**This act cannot vary it, and says so rather than guessing.** Both
GitHub credentials in this container (`GITHUB_TOKEN`, `GH_TOKEN`) are
byte-identical proxy-issued placeholders that resolve to one identity,
`os-justin`; the MCP GitHub write tools are refused to an os-dev by
contract. There is one channel here and no second one to compare
against. Naming it is the deliverable; measuring it needs a seat that
holds the other channel.

**And the tool does not need to know which channel it is on, which is
what lets the cell move.** The read-back compares exact bytes: a
footer-less body that comes back unchanged is `identical`, and one that
comes back with exactly the declared block appended is
`footer-appended`. Those two cells are not confusable — the objection "a
cell the tool cannot tell apart must not be forgiven" simply does not
apply to this cell. Whichever way the channel goes, the verdict is
right.

## ② The class decision

The body-mode append and the re-anchor leave `mutated`, and each
measured shape gets its OWN declared word:

- **`footer-appended`** — the stored body is the sent one, or its
newline-trimmed form, plus exactly `PLATFORM_COMMENT_FOOTER`. Both acts
now. The measurement it rests on: `platform-readings.md` :410 「建卡走 REST
`POST /issues`:带页脚存活,无页脚合成恰一条(+58);回读后 `PATCH` 重送逐字节存下。」 and :411 「issue
正文 `PATCH` 识别按整块:送全块或不送页脚都存回恰一条,已有页脚归一末尾不复制。」 — :411 is the act `--body`
performs — plus the live readings above.
- **`footer-re-anchored`** — NEW, because `footer-appended` says "plus
exactly the footer" and a moved newline added nothing; borrowing that
word would make the vocabulary say something untrue about the bytes,
which the file refused for good reason. Its measurement is :356/:357
「平台在尾部 `---` 前后正反两向归一空行」 / 「送全块即触发该归一 ⇒ `post-stamped` 的 `body` 档把这点空白判
`mutated`,净零字节良性告警。」 and the four live artefacts PR #18758 pinned.
- **`mutated`** now means one thing — nobody measured this — and
`sentBodyLanded` reads the CLASS alone. `body_mutated` is false exactly
where `body_landed` is true: one set of bytes, one answer, in `$?`, on
stderr and in `--json`.

**`classifyReadBack` therefore takes no `mode`.** The act-shaped gate
existed for exactly one reason — the issue-body cell was unmeasured —
and an exact-bytes comparison cannot tell one act's write from another's
anyway. Leaving the parameter behind would leave a knob a caller can set
that decides nothing, which is the shape this repo files cards about; a
pin asserts the signature carries no `mode` at all. The word for the
surface survives where it is actually read: `notStoredText` still prints
"comment" or "body", and the CLI hands `options.mode` to that.

Why this branch and not "rewrite the header to say what IS unmeasured":
both were done. The cell moved because it is measured and
distinguishable; the header now names the write channel as the thing
nobody has measured, with the readings on each side, instead of naming
the cell.

## The card's sentence, split between two PRs

The card reads 「every seat-post refresh prints a MUTATED warning」.

- **PR #18758 closed**: the prescription half. The line no longer tells
the seat to go read the artefact for a shape the tool measured as
benign, and `$?` stopped answering 4.
- **This PR closes**: the word itself. The refresh prints `read-back:
clean — the platform appended its footer (sent N, stored N+58)` and
`--json` answers `body_mutated: false`. The interim reading the card
carries — that the cell is unmeasured — is retired in the header, with
the measurement and the channel caveat written in its place.

## The pins, re-pointed

The two the card names, at their post-#18758 line numbers:

- :2409 「⭐ THE CONTROL: the same append in BODY mode stays MUTATED — an
unmeasured cell is not forgiven」 becomes ⭐ THE MOVED CELL: those same
bytes from a BODY write are CLEAN too — a MEASURED cell is not warned
about, beside a second pin that the two answers are now one (not-mutated
exactly where it landed).
- :2452's control, likewise: the seat-post refresh shape is
`footer-appended`, no longer MUTATED, still exit 0, still measured as
EXACTLY the declared footer and never as a 58-byte delta, and its line
now names the append and carries both byte counts.
- The re-anchor battery from PR #18758 keeps all four live artefacts and
re-points to the new class: the class is `footer-re-anchored` and never
`footer-appended`; the recorded first-difference offsets are still
pinned, read from `firstDifferingByte` — the clean class prints no
offset line, the same as every other benign class, so the verdict is two
lines and `readBack.offset` is null.
- `sentBodyLanded` is pinned on the class alone: a `mutated` verdict
carrying `footerReAnchored: true` does NOT land. The field stays on the
result as a measurement `--json` reports; it is no longer a second door
to exit 0.
- The declared-vocabulary probe went from five inputs/five classes to
six/six.

## The exit-4 controls: every one re-run, every one still red

PR #18758's battery is unchanged and green: a byte lost before the rule;
a byte changed at equal length (with the explicit assertion that both
sides ARE equal length); a loss inside the footer block; a footer whose
link was rewritten; a sanitizer chew under a moved newline; a newline
that came from nowhere; a newline inserted somewhere other than
immediately before the block; a truncation that happens to end in the
block. All eight still exit 4, and `unreadable` still exits 0 as
UNVERIFIED.

## The ablation

Deleting the one branch that turns a measured footer shape into a class,
from the committed fix at `cb21adf430`:

```
HEAD blob hash: 177eeb6
marker occurrences BEFORE mutation: 1
marker occurrences AFTER mutation:  0
mutated blob hash: d487450089e132f109602c570c1e9a9892663497
ON-DISK PROOF: marker 1 -> 0, hash 177eeb6… -> d487450089…
ABLATED self-test exit: 1
✗ post-stamped self-test: 30 of 349 case(s) failed, 0 floor problem(s).
restored blob hash: 177eeb6
git diff HEAD after restore: (empty — no path listed)
RESTORED self-test exit: 0
✓ post-stamped self-test: 349 cases pass across 13 batteries
```

30 of 349 red, and they are the right 30: the moved cell, the new class,
the lines that name them, and the four live re-anchor artefacts' "it
LANDED" and "measured as the re-anchor by name". **Every exit-4 control
stays green with the branch deleted** — which is what a control is for;
one that went red here would have been testing the branch, not the
contract. 0 floor problems, so no battery went quiet. Restore is proven
by blob-hash equality against `HEAD` and by an empty `git diff HEAD`,
never by an exit code, under a `trap … EXIT INT TERM` with absolute
paths, and an empty hash is treated as failure.

## Self-test

347 cases across 13 batteries becomes **349 across 13**. No battery
floor moved; `SELF_TEST_BATTERY_FLOOR` and every per-battery count are
untouched.

## Derived gates

`node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack` from the worktree, no hand-fed path list;
change set 1 path, `scripts/pm/post-stamped.mjs`. Each exit code
captured with redirect-then-`$?`:

```
0  node scripts/check-ci-filter-parity.mjs
0  node scripts/check-closing-keyword-parity.mjs
0  node scripts/check-closing-keyword-parity.mjs --self-test
0  node scripts/check-comment-mask-corpus.mjs
0  node scripts/check-declaration-mirrors.mjs
0  node scripts/check-declaration-mirrors.mjs --self-test
0  node scripts/check-scripts-symbol-anchors.mjs
0  node scripts/check-scripts-symbol-anchors.mjs --self-test
0  node scripts/check-self-test-wired.mjs
0  node scripts/check-self-test-wired.mjs --self-test
0  node scripts/check-self-test-workflow-commands.mjs
0  node scripts/check-self-test-workflow-commands.mjs --self-test
0  node scripts/check-whole-set-label-write.mjs
0  node scripts/check-whole-set-label-write.mjs --self-test
0  node scripts/pm/bare-root-worklist.mjs --self-test
0  pnpm check:agent-test-spelling
0  pnpm check:bash32-floor
0  pnpm check:cli-command-ids
0  pnpm check:cross-package-test-inputs
0  pnpm check:driver-memory-census
0  pnpm check:entry-guard
0  pnpm check:nul-bytes
0  pnpm check:parse-guard
0  pnpm check:pm-dispatch-gates
0  pnpm check:pm-post-stamped
0  pnpm check:pnpm-filter-targets
0  pnpm check:ratchet-remedy-authority
0  pnpm check:refd-timer-probe
0  pnpm check:watch-hint-literal
```

All 29 exit 0. `pnpm check:pm-dispatch-gates` was run DETACHED with its
output to a file (745.9s on this box), never under a foreground timeout.
Reconciled with `--ran`: **29 derived, 29 run, 0 NOT-MEASURED, 0 UNRUN**
— a DERIVED zero, since all 29 records carry an exit code. The gate list
was re-derived after a fresh `git fetch origin main` (`2085be2b2d`) and
is byte-identical to the first derivation. Repo-wide `pnpm lint`
(`eslint . --no-inline-config`): **exit 0**, no findings, at
`cb21adf430`.

## Read, not folded in

- **#18622** (p3 — a PR body EDIT appends the bare footer while CREATE
stores the session-URL one) and **#18686** (p3 — the PR-body side of
this same contrast gap). Read both. This PR's diff touches neither: what
① measured on this PR's body is reported on the card, not turned into a
second fix. The `--body` act reaches a PR through the ISSUE endpoint, so
the arms above are the issue-body cell's endpoint exercised on a PR
object; an issue object on the same channel is the seat's #7623 reading,
the same direction.


## This body was written four times, on purpose

The create, the two contrast arms, and this one. ① could not be measured
without two sends to an artefact this act owns, and writing another
seat's post to measure it is refused; the dispatch named this PR's body
as the target. The two arms are the timeline events between the create
and this write. This is the last write this act makes to this body.


---
_Generated by [Claude Code](https://claude.ai/code)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-justin