docs(agents): record how GitHub mangles agent-written bodies, and the per-query search control (#6970)

[yinlianghui]

Fixes#6970
Fixes#6452
Part of #7185 (option A only — the diagnosis half, option B, stays open on that card by its author's instruction; changed from a closing line by the PM seat after the dev flagged it)

One governed edit to AGENTS.md (46 added lines, no deletions), folding three devx cards that all land in the same instrument-discipline area of the file. One authoritative wording beats three riders.

What landed, and where

Two clauses, inserted between the existing control/measurement subsections and the governed-surface section:

• #### 对照挂在通道上,不只挂在查询上 — AGENTS.md lines 401-414. The channel-control rule. The control belongs on the CHANNEL, not only on the query, and it is run PER query: a non-empty result is self-validating and needs no control, an empty one ALWAYS needs a known-must-hit control. Recorded with the measured asymmetry — a long, near-verbatim title query returned total_count: 0 for an issue that reads fine directly, while a short keyword query in the same container within the same hour returned 3 hits — so the rule reads "never trust an empty search without a control", not "never use search". The zero-quota web payload channel is recorded as the measured fallback, under the same control requirement and with the caveat that it is one day in one container, not a permanent answer.
• ### GitHub 会改写你写进 issue/PR 正文的字节 — AGENTS.md lines 416-445. The mangling enumeration, one line per class, plus the four mitigations measured working, plus the placeholder clause described below.

Both sit inside section 9's measurement/instrument area, immediately before the governed-surface section.

The six classes, one line each

1. Tag-shaped fragments stripped on save, including inside backticks and fences, and an HTML-comment marker alone on a comment's first line (first-line placement is not protection).
2. PATCH downgrades the session-URL attribution footer to the bare form.
3. PATCH appends a second footer unconditionally — measured at exactly +58 bytes, with the unified diff being only the appended lines, so this one adds rather than removes.
4. issue_write create strips the attribution footer block entirely. Sentinel proof: tail kept, middle deleted, so it is a targeted strip and not a truncation — without the sentinel the only available conclusion points at length limits, which is the wrong direction.
5. PR create normalises a bare footer to the session-URL form, so create-then-edit loses the session reference altogether; and the id carried there is the seat's, not the implementer's.
6. The linked-issue parser ignores negation — a negated keyword sitting next to a card reference still acts at merge time. Recorded safe forms: Part of, Refs:, Related:, and the bare objectui prefix form, plus a pre-open grep of your own body for the three keyword stems near a hash.

Mitigations recorded as measured: generics and placeholders written in words, the session URL carried in prose as a backticked code span, attribution written as prose on issue bodies, and a read-back to the tail with an angle-bracket count after every publish.

The placeholder clause

Landed as the triage ruling asked: a SHORT objectui clause plus a pointer to the objectstack AGENTS.md wording rather than a copy of it, so there is one authoritative text and no duplicated prose to drift. It states explicitly that placeholders in ordinary prose and in fenced code are covered — the case that was actually measured — and it carries the load-bearing caveat verbatim:

A body reading short only through the API is probably intact — check the rendered page before "repairing" it; a rewrite destroys a correct card.

I did not judge the upstream wording to need widening, so no objectstack skills-lane card is filed. The pointer plus the explicit placeholder sentence covers the measured case without touching the upstream text.

Deliberately not built here

Named as options only, per the dispatch:

• a shared publish helper that reads back and diffs automatically, making the check mechanical rather than remembered;
• a check that scans recent agent-authored bodies for the tells (identical before/after columns, a doubled footer).

Also not attempted: the diagnosis of why the issue-search path goes blind. The clause records it as unresolved, naming both candidate causes and the point that only one of them self-heals. That diagnosis is the half of #7185 this PR does not close.

Governance

AGENTS.md is a governed surface. node scripts/check-governed-queue-guard.mjs --test AGENTS.md exits 3, which is the correct verdict for this PR:

One governed path governs the WHOLE pull request — proportion is not a question.

This PR therefore stays a DRAFT with hotlong and os-zhuang requested. Not flipped ready, not enqueued, no auto-merge.

Verification, all on head 3083d3e

gate	verdict
pnpm check:control-bytes	exit 0 — "OK (scanned 6014 tracked text file(s); skipped 85 binary)"
node scripts/check-shell-escape-residue.mjs	exit 0 — "OK (4/4 root(s) resolved -- AGENTS.md: 1 file(s), 15 fence(s) ...)"
node scripts/check-governed-queue-guard.mjs --self-test	exit 0 — "132 cases pass"
node scripts/check-governed-queue-guard.mjs --test AGENTS.md	exit 3 — expected, quoted above
node scripts/check-changeset-presence.mjs	exit 0 — "No source or published contract of a released package changed in this range, so no changeset is owed."
pnpm docs:check-links	exit 0 — "Links are valid across 17 scan roots."
vitest, the 4 suites that read AGENTS.md from disk	exit 0 — 4 files, 157 tests passed

The four suites are scripts/__tests__/check-doc-links.test.ts, check-governed-queue-guard.test.ts, check-shell-escape-residue.test.ts and site-next-agent-files-4160.test.ts, run from the repo root. A scan of scripts/ found no line ratchet or line budget over AGENTS.md; check-doc-links carries the file with the disk rule, and the file has no markdown links at all because its paths are code spans, which the checker blanks — the new text keeps that convention.

Merge-tree proofs, both exit 0, each producing a tree oid with no conflict block:

• against origin/main
• against PR 7242's head e362056bf, the other open claim on this file. It adds one line to a different section (the multi-agent discipline bullets under section 9); this edit is 130 lines below it.

Card 6325, listed as a possible placement constraint, is CLOSED (completed 2026-08-27) and constrains nothing here. origin/main was merged in, never rebased; the diff against main is still exactly the 46-line addition.

Session reference, carried here as prose because the footer form is not durable across a body edit: https://claude.ai/code/session_01BGMDbrVa8JjZcCQ7DWYH1b

🤖 Generated with Claude Code

https://claude.ai/code/session_01BGMDbrVa8JjZcCQ7DWYH1b

[yinlianghui]

Fixes#6970
Fixes#6452
Part of #7185 (option A only — the diagnosis half, option B, stays open on that card by its author's instruction; changed from a closing line by the PM seat after the dev flagged it)

One governed edit to AGENTS.md (46 added lines, no deletions), folding three devx cards that all land in the same instrument-discipline area of the file. One authoritative wording beats three riders.

What landed, and where

Two clauses, inserted between the existing control/measurement subsections and the governed-surface section:

• #### 对照挂在通道上,不只挂在查询上 — AGENTS.md lines 401-414. The channel-control rule. The control belongs on the CHANNEL, not only on the query, and it is run PER query: a non-empty result is self-validating and needs no control, an empty one ALWAYS needs a known-must-hit control. Recorded with the measured asymmetry — a long, near-verbatim title query returned total_count: 0 for an issue that reads fine directly, while a short keyword query in the same container within the same hour returned 3 hits — so the rule reads "never trust an empty search without a control", not "never use search". The zero-quota web payload channel is recorded as the measured fallback, under the same control requirement and with the caveat that it is one day in one container, not a permanent answer.
• ### GitHub 会改写你写进 issue/PR 正文的字节 — AGENTS.md lines 416-445. The mangling enumeration, one line per class, plus the four mitigations measured working, plus the placeholder clause described below.

Both sit inside section 9's measurement/instrument area, immediately before the governed-surface section.

The six classes, one line each

1. Tag-shaped fragments stripped on save, including inside backticks and fences, and an HTML-comment marker alone on a comment's first line (first-line placement is not protection).
2. PATCH downgrades the session-URL attribution footer to the bare form.
3. PATCH appends a second footer unconditionally — measured at exactly +58 bytes, with the unified diff being only the appended lines, so this one adds rather than removes.
4. issue_write create strips the attribution footer block entirely. Sentinel proof: tail kept, middle deleted, so it is a targeted strip and not a truncation — without the sentinel the only available conclusion points at length limits, which is the wrong direction.
5. PR create normalises a bare footer to the session-URL form, so create-then-edit loses the session reference altogether; and the id carried there is the seat's, not the implementer's.
6. The linked-issue parser ignores negation — a negated keyword sitting next to a card reference still acts at merge time. Recorded safe forms: Part of, Refs:, Related:, and the bare objectui prefix form, plus a pre-open grep of your own body for the three keyword stems near a hash.

Mitigations recorded as measured: generics and placeholders written in words, the session URL carried in prose as a backticked code span, attribution written as prose on issue bodies, and a read-back to the tail with an angle-bracket count after every publish.

The placeholder clause

Landed as the triage ruling asked: a SHORT objectui clause plus a pointer to the objectstack AGENTS.md wording rather than a copy of it, so there is one authoritative text and no duplicated prose to drift. It states explicitly that placeholders in ordinary prose and in fenced code are covered — the case that was actually measured — and it carries the load-bearing caveat verbatim:

A body reading short only through the API is probably intact — check the rendered page before "repairing" it; a rewrite destroys a correct card.

I did not judge the upstream wording to need widening, so no objectstack skills-lane card is filed. The pointer plus the explicit placeholder sentence covers the measured case without touching the upstream text.

Deliberately not built here

Named as options only, per the dispatch:

• a shared publish helper that reads back and diffs automatically, making the check mechanical rather than remembered;
• a check that scans recent agent-authored bodies for the tells (identical before/after columns, a doubled footer).

Also not attempted: the diagnosis of why the issue-search path goes blind. The clause records it as unresolved, naming both candidate causes and the point that only one of them self-heals. That diagnosis is the half of #7185 this PR does not close.

Governance

AGENTS.md is a governed surface. node scripts/check-governed-queue-guard.mjs --test AGENTS.md exits 3, which is the correct verdict for this PR:

One governed path governs the WHOLE pull request — proportion is not a question.

This PR therefore stays a DRAFT with hotlong and os-zhuang requested. Not flipped ready, not enqueued, no auto-merge.

Verification, all on head 3083d3e

gate	verdict
pnpm check:control-bytes	exit 0 — "OK (scanned 6014 tracked text file(s); skipped 85 binary)"
node scripts/check-shell-escape-residue.mjs	exit 0 — "OK (4/4 root(s) resolved -- AGENTS.md: 1 file(s), 15 fence(s) ...)"
node scripts/check-governed-queue-guard.mjs --self-test	exit 0 — "132 cases pass"
node scripts/check-governed-queue-guard.mjs --test AGENTS.md	exit 3 — expected, quoted above
node scripts/check-changeset-presence.mjs	exit 0 — "No source or published contract of a released package changed in this range, so no changeset is owed."
pnpm docs:check-links	exit 0 — "Links are valid across 17 scan roots."
vitest, the 4 suites that read AGENTS.md from disk	exit 0 — 4 files, 157 tests passed

The four suites are scripts/__tests__/check-doc-links.test.ts, check-governed-queue-guard.test.ts, check-shell-escape-residue.test.ts and site-next-agent-files-4160.test.ts, run from the repo root. A scan of scripts/ found no line ratchet or line budget over AGENTS.md; check-doc-links carries the file with the disk rule, and the file has no markdown links at all because its paths are code spans, which the checker blanks — the new text keeps that convention.

Merge-tree proofs, both exit 0, each producing a tree oid with no conflict block:

• against origin/main
• against PR 7242's head e362056bf, the other open claim on this file. It adds one line to a different section (the multi-agent discipline bullets under section 9); this edit is 130 lines below it.

Card 6325, listed as a possible placement constraint, is CLOSED (completed 2026-08-27) and constrains nothing here. origin/main was merged in, never rebased; the diff against main is still exactly the 46-line addition.

Session reference, carried here as prose because the footer form is not durable across a body edit: https://claude.ai/code/session_01BGMDbrVa8JjZcCQ7DWYH1b

🤖 Generated with Claude Code

https://claude.ai/code/session_01BGMDbrVa8JjZcCQ7DWYH1b

[yinlianghui]

Fixes#6970
Fixes#6452
Part of #7185 (option A only — the diagnosis half, option B, stays open on that card by its author's instruction; changed from a closing line by the PM seat after the dev flagged it)

One governed edit to AGENTS.md (46 added lines, no deletions), folding three devx cards that all land in the same instrument-discipline area of the file. One authoritative wording beats three riders.

What landed, and where

Two clauses, inserted between the existing control/measurement subsections and the governed-surface section:

• #### 对照挂在通道上,不只挂在查询上 — AGENTS.md lines 401-414. The channel-control rule. The control belongs on the CHANNEL, not only on the query, and it is run PER query: a non-empty result is self-validating and needs no control, an empty one ALWAYS needs a known-must-hit control. Recorded with the measured asymmetry — a long, near-verbatim title query returned total_count: 0 for an issue that reads fine directly, while a short keyword query in the same container within the same hour returned 3 hits — so the rule reads "never trust an empty search without a control", not "never use search". The zero-quota web payload channel is recorded as the measured fallback, under the same control requirement and with the caveat that it is one day in one container, not a permanent answer.
• ### GitHub 会改写你写进 issue/PR 正文的字节 — AGENTS.md lines 416-445. The mangling enumeration, one line per class, plus the four mitigations measured working, plus the placeholder clause described below.

Both sit inside section 9's measurement/instrument area, immediately before the governed-surface section.

The six classes, one line each

1. Tag-shaped fragments stripped on save, including inside backticks and fences, and an HTML-comment marker alone on a comment's first line (first-line placement is not protection).
2. PATCH downgrades the session-URL attribution footer to the bare form.
3. PATCH appends a second footer unconditionally — measured at exactly +58 bytes, with the unified diff being only the appended lines, so this one adds rather than removes.
4. issue_write create strips the attribution footer block entirely. Sentinel proof: tail kept, middle deleted, so it is a targeted strip and not a truncation — without the sentinel the only available conclusion points at length limits, which is the wrong direction.
5. PR create normalises a bare footer to the session-URL form, so create-then-edit loses the session reference altogether; and the id carried there is the seat's, not the implementer's.
6. The linked-issue parser ignores negation — a negated keyword sitting next to a card reference still acts at merge time. Recorded safe forms: Part of, Refs:, Related:, and the bare objectui prefix form, plus a pre-open grep of your own body for the three keyword stems near a hash.

Mitigations recorded as measured: generics and placeholders written in words, the session URL carried in prose as a backticked code span, attribution written as prose on issue bodies, and a read-back to the tail with an angle-bracket count after every publish.

The placeholder clause

Landed as the triage ruling asked: a SHORT objectui clause plus a pointer to the objectstack AGENTS.md wording rather than a copy of it, so there is one authoritative text and no duplicated prose to drift. It states explicitly that placeholders in ordinary prose and in fenced code are covered — the case that was actually measured — and it carries the load-bearing caveat verbatim:

A body reading short only through the API is probably intact — check the rendered page before "repairing" it; a rewrite destroys a correct card.

I did not judge the upstream wording to need widening, so no objectstack skills-lane card is filed. The pointer plus the explicit placeholder sentence covers the measured case without touching the upstream text.

Deliberately not built here

Named as options only, per the dispatch:

• a shared publish helper that reads back and diffs automatically, making the check mechanical rather than remembered;
• a check that scans recent agent-authored bodies for the tells (identical before/after columns, a doubled footer).

Also not attempted: the diagnosis of why the issue-search path goes blind. The clause records it as unresolved, naming both candidate causes and the point that only one of them self-heals. That diagnosis is the half of #7185 this PR does not close.

Governance

AGENTS.md is a governed surface. node scripts/check-governed-queue-guard.mjs --test AGENTS.md exits 3, which is the correct verdict for this PR:

One governed path governs the WHOLE pull request — proportion is not a question.

This PR therefore stays a DRAFT with hotlong and os-zhuang requested. Not flipped ready, not enqueued, no auto-merge.

Verification, all on head 3083d3e

gate	verdict
pnpm check:control-bytes	exit 0 — "OK (scanned 6014 tracked text file(s); skipped 85 binary)"
node scripts/check-shell-escape-residue.mjs	exit 0 — "OK (4/4 root(s) resolved -- AGENTS.md: 1 file(s), 15 fence(s) ...)"
node scripts/check-governed-queue-guard.mjs --self-test	exit 0 — "132 cases pass"
node scripts/check-governed-queue-guard.mjs --test AGENTS.md	exit 3 — expected, quoted above
node scripts/check-changeset-presence.mjs	exit 0 — "No source or published contract of a released package changed in this range, so no changeset is owed."
pnpm docs:check-links	exit 0 — "Links are valid across 17 scan roots."
vitest, the 4 suites that read AGENTS.md from disk	exit 0 — 4 files, 157 tests passed

The four suites are scripts/__tests__/check-doc-links.test.ts, check-governed-queue-guard.test.ts, check-shell-escape-residue.test.ts and site-next-agent-files-4160.test.ts, run from the repo root. A scan of scripts/ found no line ratchet or line budget over AGENTS.md; check-doc-links carries the file with the disk rule, and the file has no markdown links at all because its paths are code spans, which the checker blanks — the new text keeps that convention.

Merge-tree proofs, both exit 0, each producing a tree oid with no conflict block:

• against origin/main
• against PR 7242's head e362056bf, the other open claim on this file. It adds one line to a different section (the multi-agent discipline bullets under section 9); this edit is 130 lines below it.

Card 6325, listed as a possible placement constraint, is CLOSED (completed 2026-08-27) and constrains nothing here. origin/main was merged in, never rebased; the diff against main is still exactly the 46-line addition.

Session reference, carried here as prose because the footer form is not durable across a body edit: https://claude.ai/code/session_01BGMDbrVa8JjZcCQ7DWYH1b

🤖 Generated with Claude Code

https://claude.ai/code/session_01BGMDbrVa8JjZcCQ7DWYH1b

[yinlianghui]

Fixes#6970
Fixes#6452
Part of #7185 (option A only — the diagnosis half, option B, stays open on that card by its author's instruction; changed from a closing line by the PM seat after the dev flagged it)

One governed edit to AGENTS.md (46 added lines, no deletions), folding three devx cards that all land in the same instrument-discipline area of the file. One authoritative wording beats three riders.

What landed, and where

Two clauses, inserted between the existing control/measurement subsections and the governed-surface section:

• #### 对照挂在通道上,不只挂在查询上 — AGENTS.md lines 401-414. The channel-control rule. The control belongs on the CHANNEL, not only on the query, and it is run PER query: a non-empty result is self-validating and needs no control, an empty one ALWAYS needs a known-must-hit control. Recorded with the measured asymmetry — a long, near-verbatim title query returned total_count: 0 for an issue that reads fine directly, while a short keyword query in the same container within the same hour returned 3 hits — so the rule reads "never trust an empty search without a control", not "never use search". The zero-quota web payload channel is recorded as the measured fallback, under the same control requirement and with the caveat that it is one day in one container, not a permanent answer.
• ### GitHub 会改写你写进 issue/PR 正文的字节 — AGENTS.md lines 416-445. The mangling enumeration, one line per class, plus the four mitigations measured working, plus the placeholder clause described below.

Both sit inside section 9's measurement/instrument area, immediately before the governed-surface section.

The six classes, one line each

1. Tag-shaped fragments stripped on save, including inside backticks and fences, and an HTML-comment marker alone on a comment's first line (first-line placement is not protection).
2. PATCH downgrades the session-URL attribution footer to the bare form.
3. PATCH appends a second footer unconditionally — measured at exactly +58 bytes, with the unified diff being only the appended lines, so this one adds rather than removes.
4. issue_write create strips the attribution footer block entirely. Sentinel proof: tail kept, middle deleted, so it is a targeted strip and not a truncation — without the sentinel the only available conclusion points at length limits, which is the wrong direction.
5. PR create normalises a bare footer to the session-URL form, so create-then-edit loses the session reference altogether; and the id carried there is the seat's, not the implementer's.
6. The linked-issue parser ignores negation — a negated keyword sitting next to a card reference still acts at merge time. Recorded safe forms: Part of, Refs:, Related:, and the bare objectui prefix form, plus a pre-open grep of your own body for the three keyword stems near a hash.

Mitigations recorded as measured: generics and placeholders written in words, the session URL carried in prose as a backticked code span, attribution written as prose on issue bodies, and a read-back to the tail with an angle-bracket count after every publish.

The placeholder clause

Landed as the triage ruling asked: a SHORT objectui clause plus a pointer to the objectstack AGENTS.md wording rather than a copy of it, so there is one authoritative text and no duplicated prose to drift. It states explicitly that placeholders in ordinary prose and in fenced code are covered — the case that was actually measured — and it carries the load-bearing caveat verbatim:

A body reading short only through the API is probably intact — check the rendered page before "repairing" it; a rewrite destroys a correct card.

I did not judge the upstream wording to need widening, so no objectstack skills-lane card is filed. The pointer plus the explicit placeholder sentence covers the measured case without touching the upstream text.

Deliberately not built here

Named as options only, per the dispatch:

• a shared publish helper that reads back and diffs automatically, making the check mechanical rather than remembered;
• a check that scans recent agent-authored bodies for the tells (identical before/after columns, a doubled footer).

Also not attempted: the diagnosis of why the issue-search path goes blind. The clause records it as unresolved, naming both candidate causes and the point that only one of them self-heals. That diagnosis is the half of #7185 this PR does not close.

Governance

AGENTS.md is a governed surface. node scripts/check-governed-queue-guard.mjs --test AGENTS.md exits 3, which is the correct verdict for this PR:

One governed path governs the WHOLE pull request — proportion is not a question.

This PR therefore stays a DRAFT with hotlong and os-zhuang requested. Not flipped ready, not enqueued, no auto-merge.

Verification, all on head 3083d3e

gate	verdict
pnpm check:control-bytes	exit 0 — "OK (scanned 6014 tracked text file(s); skipped 85 binary)"
node scripts/check-shell-escape-residue.mjs	exit 0 — "OK (4/4 root(s) resolved -- AGENTS.md: 1 file(s), 15 fence(s) ...)"
node scripts/check-governed-queue-guard.mjs --self-test	exit 0 — "132 cases pass"
node scripts/check-governed-queue-guard.mjs --test AGENTS.md	exit 3 — expected, quoted above
node scripts/check-changeset-presence.mjs	exit 0 — "No source or published contract of a released package changed in this range, so no changeset is owed."
pnpm docs:check-links	exit 0 — "Links are valid across 17 scan roots."
vitest, the 4 suites that read AGENTS.md from disk	exit 0 — 4 files, 157 tests passed

The four suites are scripts/__tests__/check-doc-links.test.ts, check-governed-queue-guard.test.ts, check-shell-escape-residue.test.ts and site-next-agent-files-4160.test.ts, run from the repo root. A scan of scripts/ found no line ratchet or line budget over AGENTS.md; check-doc-links carries the file with the disk rule, and the file has no markdown links at all because its paths are code spans, which the checker blanks — the new text keeps that convention.

Merge-tree proofs, both exit 0, each producing a tree oid with no conflict block:

• against origin/main
• against PR 7242's head e362056bf, the other open claim on this file. It adds one line to a different section (the multi-agent discipline bullets under section 9); this edit is 130 lines below it.

Card 6325, listed as a possible placement constraint, is CLOSED (completed 2026-08-27) and constrains nothing here. origin/main was merged in, never rebased; the diff against main is still exactly the 46-line addition.

Session reference, carried here as prose because the footer form is not durable across a body edit: https://claude.ai/code/session_01BGMDbrVa8JjZcCQ7DWYH1b

🤖 Generated with Claude Code

https://claude.ai/code/session_01BGMDbrVa8JjZcCQ7DWYH1b

[yinlianghui]

Fixes#6970
Fixes#6452
Part of #7185 (option A only — the diagnosis half, option B, stays open on that card by its author's instruction; changed from a closing line by the PM seat after the dev flagged it)

One governed edit to AGENTS.md (46 added lines, no deletions), folding three devx cards that all land in the same instrument-discipline area of the file. One authoritative wording beats three riders.

What landed, and where

Two clauses, inserted between the existing control/measurement subsections and the governed-surface section:

• #### 对照挂在通道上,不只挂在查询上 — AGENTS.md lines 401-414. The channel-control rule. The control belongs on the CHANNEL, not only on the query, and it is run PER query: a non-empty result is self-validating and needs no control, an empty one ALWAYS needs a known-must-hit control. Recorded with the measured asymmetry — a long, near-verbatim title query returned total_count: 0 for an issue that reads fine directly, while a short keyword query in the same container within the same hour returned 3 hits — so the rule reads "never trust an empty search without a control", not "never use search". The zero-quota web payload channel is recorded as the measured fallback, under the same control requirement and with the caveat that it is one day in one container, not a permanent answer.
• ### GitHub 会改写你写进 issue/PR 正文的字节 — AGENTS.md lines 416-445. The mangling enumeration, one line per class, plus the four mitigations measured working, plus the placeholder clause described below.

Both sit inside section 9's measurement/instrument area, immediately before the governed-surface section.

The six classes, one line each

1. Tag-shaped fragments stripped on save, including inside backticks and fences, and an HTML-comment marker alone on a comment's first line (first-line placement is not protection).
2. PATCH downgrades the session-URL attribution footer to the bare form.
3. PATCH appends a second footer unconditionally — measured at exactly +58 bytes, with the unified diff being only the appended lines, so this one adds rather than removes.
4. issue_write create strips the attribution footer block entirely. Sentinel proof: tail kept, middle deleted, so it is a targeted strip and not a truncation — without the sentinel the only available conclusion points at length limits, which is the wrong direction.
5. PR create normalises a bare footer to the session-URL form, so create-then-edit loses the session reference altogether; and the id carried there is the seat's, not the implementer's.
6. The linked-issue parser ignores negation — a negated keyword sitting next to a card reference still acts at merge time. Recorded safe forms: Part of, Refs:, Related:, and the bare objectui prefix form, plus a pre-open grep of your own body for the three keyword stems near a hash.

Mitigations recorded as measured: generics and placeholders written in words, the session URL carried in prose as a backticked code span, attribution written as prose on issue bodies, and a read-back to the tail with an angle-bracket count after every publish.

The placeholder clause

Landed as the triage ruling asked: a SHORT objectui clause plus a pointer to the objectstack AGENTS.md wording rather than a copy of it, so there is one authoritative text and no duplicated prose to drift. It states explicitly that placeholders in ordinary prose and in fenced code are covered — the case that was actually measured — and it carries the load-bearing caveat verbatim:

A body reading short only through the API is probably intact — check the rendered page before "repairing" it; a rewrite destroys a correct card.

I did not judge the upstream wording to need widening, so no objectstack skills-lane card is filed. The pointer plus the explicit placeholder sentence covers the measured case without touching the upstream text.

Deliberately not built here

Named as options only, per the dispatch:

• a shared publish helper that reads back and diffs automatically, making the check mechanical rather than remembered;
• a check that scans recent agent-authored bodies for the tells (identical before/after columns, a doubled footer).

Also not attempted: the diagnosis of why the issue-search path goes blind. The clause records it as unresolved, naming both candidate causes and the point that only one of them self-heals. That diagnosis is the half of #7185 this PR does not close.

Governance

AGENTS.md is a governed surface. node scripts/check-governed-queue-guard.mjs --test AGENTS.md exits 3, which is the correct verdict for this PR:

One governed path governs the WHOLE pull request — proportion is not a question.

This PR therefore stays a DRAFT with hotlong and os-zhuang requested. Not flipped ready, not enqueued, no auto-merge.

Verification, all on head 3083d3e

gate	verdict
pnpm check:control-bytes	exit 0 — "OK (scanned 6014 tracked text file(s); skipped 85 binary)"
node scripts/check-shell-escape-residue.mjs	exit 0 — "OK (4/4 root(s) resolved -- AGENTS.md: 1 file(s), 15 fence(s) ...)"
node scripts/check-governed-queue-guard.mjs --self-test	exit 0 — "132 cases pass"
node scripts/check-governed-queue-guard.mjs --test AGENTS.md	exit 3 — expected, quoted above
node scripts/check-changeset-presence.mjs	exit 0 — "No source or published contract of a released package changed in this range, so no changeset is owed."
pnpm docs:check-links	exit 0 — "Links are valid across 17 scan roots."
vitest, the 4 suites that read AGENTS.md from disk	exit 0 — 4 files, 157 tests passed

The four suites are scripts/__tests__/check-doc-links.test.ts, check-governed-queue-guard.test.ts, check-shell-escape-residue.test.ts and site-next-agent-files-4160.test.ts, run from the repo root. A scan of scripts/ found no line ratchet or line budget over AGENTS.md; check-doc-links carries the file with the disk rule, and the file has no markdown links at all because its paths are code spans, which the checker blanks — the new text keeps that convention.

Merge-tree proofs, both exit 0, each producing a tree oid with no conflict block:

• against origin/main
• against PR 7242's head e362056bf, the other open claim on this file. It adds one line to a different section (the multi-agent discipline bullets under section 9); this edit is 130 lines below it.

Card 6325, listed as a possible placement constraint, is CLOSED (completed 2026-08-27) and constrains nothing here. origin/main was merged in, never rebased; the diff against main is still exactly the 46-line addition.

Session reference, carried here as prose because the footer form is not durable across a body edit: https://claude.ai/code/session_01BGMDbrVa8JjZcCQ7DWYH1b

🤖 Generated with Claude Code

https://claude.ai/code/session_01BGMDbrVa8JjZcCQ7DWYH1b

[yinlianghui]

Fixes#6970
Fixes#6452
Part of #7185 (option A only — the diagnosis half, option B, stays open on that card by its author's instruction; changed from a closing line by the PM seat after the dev flagged it)

One governed edit to AGENTS.md (46 added lines, no deletions), folding three devx cards that all land in the same instrument-discipline area of the file. One authoritative wording beats three riders.

What landed, and where

Two clauses, inserted between the existing control/measurement subsections and the governed-surface section:

• #### 对照挂在通道上,不只挂在查询上 — AGENTS.md lines 401-414. The channel-control rule. The control belongs on the CHANNEL, not only on the query, and it is run PER query: a non-empty result is self-validating and needs no control, an empty one ALWAYS needs a known-must-hit control. Recorded with the measured asymmetry — a long, near-verbatim title query returned total_count: 0 for an issue that reads fine directly, while a short keyword query in the same container within the same hour returned 3 hits — so the rule reads "never trust an empty search without a control", not "never use search". The zero-quota web payload channel is recorded as the measured fallback, under the same control requirement and with the caveat that it is one day in one container, not a permanent answer.
• ### GitHub 会改写你写进 issue/PR 正文的字节 — AGENTS.md lines 416-445. The mangling enumeration, one line per class, plus the four mitigations measured working, plus the placeholder clause described below.

Both sit inside section 9's measurement/instrument area, immediately before the governed-surface section.

The six classes, one line each

1. Tag-shaped fragments stripped on save, including inside backticks and fences, and an HTML-comment marker alone on a comment's first line (first-line placement is not protection).
2. PATCH downgrades the session-URL attribution footer to the bare form.
3. PATCH appends a second footer unconditionally — measured at exactly +58 bytes, with the unified diff being only the appended lines, so this one adds rather than removes.
4. issue_write create strips the attribution footer block entirely. Sentinel proof: tail kept, middle deleted, so it is a targeted strip and not a truncation — without the sentinel the only available conclusion points at length limits, which is the wrong direction.
5. PR create normalises a bare footer to the session-URL form, so create-then-edit loses the session reference altogether; and the id carried there is the seat's, not the implementer's.
6. The linked-issue parser ignores negation — a negated keyword sitting next to a card reference still acts at merge time. Recorded safe forms: Part of, Refs:, Related:, and the bare objectui prefix form, plus a pre-open grep of your own body for the three keyword stems near a hash.

Mitigations recorded as measured: generics and placeholders written in words, the session URL carried in prose as a backticked code span, attribution written as prose on issue bodies, and a read-back to the tail with an angle-bracket count after every publish.

The placeholder clause

Landed as the triage ruling asked: a SHORT objectui clause plus a pointer to the objectstack AGENTS.md wording rather than a copy of it, so there is one authoritative text and no duplicated prose to drift. It states explicitly that placeholders in ordinary prose and in fenced code are covered — the case that was actually measured — and it carries the load-bearing caveat verbatim:

A body reading short only through the API is probably intact — check the rendered page before "repairing" it; a rewrite destroys a correct card.

I did not judge the upstream wording to need widening, so no objectstack skills-lane card is filed. The pointer plus the explicit placeholder sentence covers the measured case without touching the upstream text.

Deliberately not built here

Named as options only, per the dispatch:

• a shared publish helper that reads back and diffs automatically, making the check mechanical rather than remembered;
• a check that scans recent agent-authored bodies for the tells (identical before/after columns, a doubled footer).

Also not attempted: the diagnosis of why the issue-search path goes blind. The clause records it as unresolved, naming both candidate causes and the point that only one of them self-heals. That diagnosis is the half of #7185 this PR does not close.

Governance

AGENTS.md is a governed surface. node scripts/check-governed-queue-guard.mjs --test AGENTS.md exits 3, which is the correct verdict for this PR:

One governed path governs the WHOLE pull request — proportion is not a question.

This PR therefore stays a DRAFT with hotlong and os-zhuang requested. Not flipped ready, not enqueued, no auto-merge.

Verification, all on head 3083d3e

gate	verdict
pnpm check:control-bytes	exit 0 — "OK (scanned 6014 tracked text file(s); skipped 85 binary)"
node scripts/check-shell-escape-residue.mjs	exit 0 — "OK (4/4 root(s) resolved -- AGENTS.md: 1 file(s), 15 fence(s) ...)"
node scripts/check-governed-queue-guard.mjs --self-test	exit 0 — "132 cases pass"
node scripts/check-governed-queue-guard.mjs --test AGENTS.md	exit 3 — expected, quoted above
node scripts/check-changeset-presence.mjs	exit 0 — "No source or published contract of a released package changed in this range, so no changeset is owed."
pnpm docs:check-links	exit 0 — "Links are valid across 17 scan roots."
vitest, the 4 suites that read AGENTS.md from disk	exit 0 — 4 files, 157 tests passed

The four suites are scripts/__tests__/check-doc-links.test.ts, check-governed-queue-guard.test.ts, check-shell-escape-residue.test.ts and site-next-agent-files-4160.test.ts, run from the repo root. A scan of scripts/ found no line ratchet or line budget over AGENTS.md; check-doc-links carries the file with the disk rule, and the file has no markdown links at all because its paths are code spans, which the checker blanks — the new text keeps that convention.

Merge-tree proofs, both exit 0, each producing a tree oid with no conflict block:

• against origin/main
• against PR 7242's head e362056bf, the other open claim on this file. It adds one line to a different section (the multi-agent discipline bullets under section 9); this edit is 130 lines below it.

Card 6325, listed as a possible placement constraint, is CLOSED (completed 2026-08-27) and constrains nothing here. origin/main was merged in, never rebased; the diff against main is still exactly the 46-line addition.

Session reference, carried here as prose because the footer form is not durable across a body edit: https://claude.ai/code/session_01BGMDbrVa8JjZcCQ7DWYH1b

🤖 Generated with Claude Code

https://claude.ai/code/session_01BGMDbrVa8JjZcCQ7DWYH1b

[yinlianghui]

Fixes#6970
Fixes#6452
Part of #7185 (option A only — the diagnosis half, option B, stays open on that card by its author's instruction; changed from a closing line by the PM seat after the dev flagged it)

One governed edit to AGENTS.md (46 added lines, no deletions), folding three devx cards that all land in the same instrument-discipline area of the file. One authoritative wording beats three riders.

What landed, and where

Two clauses, inserted between the existing control/measurement subsections and the governed-surface section:

• #### 对照挂在通道上,不只挂在查询上 — AGENTS.md lines 401-414. The channel-control rule. The control belongs on the CHANNEL, not only on the query, and it is run PER query: a non-empty result is self-validating and needs no control, an empty one ALWAYS needs a known-must-hit control. Recorded with the measured asymmetry — a long, near-verbatim title query returned total_count: 0 for an issue that reads fine directly, while a short keyword query in the same container within the same hour returned 3 hits — so the rule reads "never trust an empty search without a control", not "never use search". The zero-quota web payload channel is recorded as the measured fallback, under the same control requirement and with the caveat that it is one day in one container, not a permanent answer.
• ### GitHub 会改写你写进 issue/PR 正文的字节 — AGENTS.md lines 416-445. The mangling enumeration, one line per class, plus the four mitigations measured working, plus the placeholder clause described below.

Both sit inside section 9's measurement/instrument area, immediately before the governed-surface section.

The six classes, one line each

1. Tag-shaped fragments stripped on save, including inside backticks and fences, and an HTML-comment marker alone on a comment's first line (first-line placement is not protection).
2. PATCH downgrades the session-URL attribution footer to the bare form.
3. PATCH appends a second footer unconditionally — measured at exactly +58 bytes, with the unified diff being only the appended lines, so this one adds rather than removes.
4. issue_write create strips the attribution footer block entirely. Sentinel proof: tail kept, middle deleted, so it is a targeted strip and not a truncation — without the sentinel the only available conclusion points at length limits, which is the wrong direction.
5. PR create normalises a bare footer to the session-URL form, so create-then-edit loses the session reference altogether; and the id carried there is the seat's, not the implementer's.
6. The linked-issue parser ignores negation — a negated keyword sitting next to a card reference still acts at merge time. Recorded safe forms: Part of, Refs:, Related:, and the bare objectui prefix form, plus a pre-open grep of your own body for the three keyword stems near a hash.

Mitigations recorded as measured: generics and placeholders written in words, the session URL carried in prose as a backticked code span, attribution written as prose on issue bodies, and a read-back to the tail with an angle-bracket count after every publish.

The placeholder clause

Landed as the triage ruling asked: a SHORT objectui clause plus a pointer to the objectstack AGENTS.md wording rather than a copy of it, so there is one authoritative text and no duplicated prose to drift. It states explicitly that placeholders in ordinary prose and in fenced code are covered — the case that was actually measured — and it carries the load-bearing caveat verbatim:

A body reading short only through the API is probably intact — check the rendered page before "repairing" it; a rewrite destroys a correct card.

I did not judge the upstream wording to need widening, so no objectstack skills-lane card is filed. The pointer plus the explicit placeholder sentence covers the measured case without touching the upstream text.

Deliberately not built here

Named as options only, per the dispatch:

• a shared publish helper that reads back and diffs automatically, making the check mechanical rather than remembered;
• a check that scans recent agent-authored bodies for the tells (identical before/after columns, a doubled footer).

Also not attempted: the diagnosis of why the issue-search path goes blind. The clause records it as unresolved, naming both candidate causes and the point that only one of them self-heals. That diagnosis is the half of #7185 this PR does not close.

Governance

AGENTS.md is a governed surface. node scripts/check-governed-queue-guard.mjs --test AGENTS.md exits 3, which is the correct verdict for this PR:

One governed path governs the WHOLE pull request — proportion is not a question.

This PR therefore stays a DRAFT with hotlong and os-zhuang requested. Not flipped ready, not enqueued, no auto-merge.

Verification, all on head 3083d3e

gate	verdict
pnpm check:control-bytes	exit 0 — "OK (scanned 6014 tracked text file(s); skipped 85 binary)"
node scripts/check-shell-escape-residue.mjs	exit 0 — "OK (4/4 root(s) resolved -- AGENTS.md: 1 file(s), 15 fence(s) ...)"
node scripts/check-governed-queue-guard.mjs --self-test	exit 0 — "132 cases pass"
node scripts/check-governed-queue-guard.mjs --test AGENTS.md	exit 3 — expected, quoted above
node scripts/check-changeset-presence.mjs	exit 0 — "No source or published contract of a released package changed in this range, so no changeset is owed."
pnpm docs:check-links	exit 0 — "Links are valid across 17 scan roots."
vitest, the 4 suites that read AGENTS.md from disk	exit 0 — 4 files, 157 tests passed

The four suites are scripts/__tests__/check-doc-links.test.ts, check-governed-queue-guard.test.ts, check-shell-escape-residue.test.ts and site-next-agent-files-4160.test.ts, run from the repo root. A scan of scripts/ found no line ratchet or line budget over AGENTS.md; check-doc-links carries the file with the disk rule, and the file has no markdown links at all because its paths are code spans, which the checker blanks — the new text keeps that convention.

Merge-tree proofs, both exit 0, each producing a tree oid with no conflict block:

• against origin/main
• against PR 7242's head e362056bf, the other open claim on this file. It adds one line to a different section (the multi-agent discipline bullets under section 9); this edit is 130 lines below it.

Card 6325, listed as a possible placement constraint, is CLOSED (completed 2026-08-27) and constrains nothing here. origin/main was merged in, never rebased; the diff against main is still exactly the 46-line addition.

Session reference, carried here as prose because the footer form is not durable across a body edit: https://claude.ai/code/session_01BGMDbrVa8JjZcCQ7DWYH1b

🤖 Generated with Claude Code

https://claude.ai/code/session_01BGMDbrVa8JjZcCQ7DWYH1b

[yinlianghui]

Fixes#6970
Fixes#6452
Part of #7185 (option A only — the diagnosis half, option B, stays open on that card by its author's instruction; changed from a closing line by the PM seat after the dev flagged it)

One governed edit to AGENTS.md (46 added lines, no deletions), folding three devx cards that all land in the same instrument-discipline area of the file. One authoritative wording beats three riders.

What landed, and where

Two clauses, inserted between the existing control/measurement subsections and the governed-surface section:

• #### 对照挂在通道上,不只挂在查询上 — AGENTS.md lines 401-414. The channel-control rule. The control belongs on the CHANNEL, not only on the query, and it is run PER query: a non-empty result is self-validating and needs no control, an empty one ALWAYS needs a known-must-hit control. Recorded with the measured asymmetry — a long, near-verbatim title query returned total_count: 0 for an issue that reads fine directly, while a short keyword query in the same container within the same hour returned 3 hits — so the rule reads "never trust an empty search without a control", not "never use search". The zero-quota web payload channel is recorded as the measured fallback, under the same control requirement and with the caveat that it is one day in one container, not a permanent answer.
• ### GitHub 会改写你写进 issue/PR 正文的字节 — AGENTS.md lines 416-445. The mangling enumeration, one line per class, plus the four mitigations measured working, plus the placeholder clause described below.

Both sit inside section 9's measurement/instrument area, immediately before the governed-surface section.

The six classes, one line each

1. Tag-shaped fragments stripped on save, including inside backticks and fences, and an HTML-comment marker alone on a comment's first line (first-line placement is not protection).
2. PATCH downgrades the session-URL attribution footer to the bare form.
3. PATCH appends a second footer unconditionally — measured at exactly +58 bytes, with the unified diff being only the appended lines, so this one adds rather than removes.
4. issue_write create strips the attribution footer block entirely. Sentinel proof: tail kept, middle deleted, so it is a targeted strip and not a truncation — without the sentinel the only available conclusion points at length limits, which is the wrong direction.
5. PR create normalises a bare footer to the session-URL form, so create-then-edit loses the session reference altogether; and the id carried there is the seat's, not the implementer's.
6. The linked-issue parser ignores negation — a negated keyword sitting next to a card reference still acts at merge time. Recorded safe forms: Part of, Refs:, Related:, and the bare objectui prefix form, plus a pre-open grep of your own body for the three keyword stems near a hash.

Mitigations recorded as measured: generics and placeholders written in words, the session URL carried in prose as a backticked code span, attribution written as prose on issue bodies, and a read-back to the tail with an angle-bracket count after every publish.

The placeholder clause

Landed as the triage ruling asked: a SHORT objectui clause plus a pointer to the objectstack AGENTS.md wording rather than a copy of it, so there is one authoritative text and no duplicated prose to drift. It states explicitly that placeholders in ordinary prose and in fenced code are covered — the case that was actually measured — and it carries the load-bearing caveat verbatim:

A body reading short only through the API is probably intact — check the rendered page before "repairing" it; a rewrite destroys a correct card.

I did not judge the upstream wording to need widening, so no objectstack skills-lane card is filed. The pointer plus the explicit placeholder sentence covers the measured case without touching the upstream text.

Deliberately not built here

Named as options only, per the dispatch:

• a shared publish helper that reads back and diffs automatically, making the check mechanical rather than remembered;
• a check that scans recent agent-authored bodies for the tells (identical before/after columns, a doubled footer).

Also not attempted: the diagnosis of why the issue-search path goes blind. The clause records it as unresolved, naming both candidate causes and the point that only one of them self-heals. That diagnosis is the half of #7185 this PR does not close.

Governance

AGENTS.md is a governed surface. node scripts/check-governed-queue-guard.mjs --test AGENTS.md exits 3, which is the correct verdict for this PR:

One governed path governs the WHOLE pull request — proportion is not a question.

This PR therefore stays a DRAFT with hotlong and os-zhuang requested. Not flipped ready, not enqueued, no auto-merge.

Verification, all on head 3083d3e

gate	verdict
pnpm check:control-bytes	exit 0 — "OK (scanned 6014 tracked text file(s); skipped 85 binary)"
node scripts/check-shell-escape-residue.mjs	exit 0 — "OK (4/4 root(s) resolved -- AGENTS.md: 1 file(s), 15 fence(s) ...)"
node scripts/check-governed-queue-guard.mjs --self-test	exit 0 — "132 cases pass"
node scripts/check-governed-queue-guard.mjs --test AGENTS.md	exit 3 — expected, quoted above
node scripts/check-changeset-presence.mjs	exit 0 — "No source or published contract of a released package changed in this range, so no changeset is owed."
pnpm docs:check-links	exit 0 — "Links are valid across 17 scan roots."
vitest, the 4 suites that read AGENTS.md from disk	exit 0 — 4 files, 157 tests passed

The four suites are scripts/__tests__/check-doc-links.test.ts, check-governed-queue-guard.test.ts, check-shell-escape-residue.test.ts and site-next-agent-files-4160.test.ts, run from the repo root. A scan of scripts/ found no line ratchet or line budget over AGENTS.md; check-doc-links carries the file with the disk rule, and the file has no markdown links at all because its paths are code spans, which the checker blanks — the new text keeps that convention.

Merge-tree proofs, both exit 0, each producing a tree oid with no conflict block:

• against origin/main
• against PR 7242's head e362056bf, the other open claim on this file. It adds one line to a different section (the multi-agent discipline bullets under section 9); this edit is 130 lines below it.

Card 6325, listed as a possible placement constraint, is CLOSED (completed 2026-08-27) and constrains nothing here. origin/main was merged in, never rebased; the diff against main is still exactly the 46-line addition.

Session reference, carried here as prose because the footer form is not durable across a body edit: https://claude.ai/code/session_01BGMDbrVa8JjZcCQ7DWYH1b

🤖 Generated with Claude Code

https://claude.ai/code/session_01BGMDbrVa8JjZcCQ7DWYH1b