finding(devx): this repo's instruction files never mention that GitHub strips angle-bracket placeholders from issue/PR bodies — measured live on #6208's own body and on PR #6449 #6452

Found while working #6208 / PR #6449; out of scope for that card, filed rather than fixed.

⚠️ Placeholders in this body are written as UPPERCASE WORDS on purpose — writing them in angle brackets is the very thing being reported, and would corrupt this issue too.

The mutation

GitHub's body sanitizer removes tag-shaped fragments from issue bodies, PR bodies and comments. A token like REPO or BRANCH written in angle brackets looks like an HTML tag and is deleted; backticks and fenced code blocks do not protect it. Non-tag-shaped brackets survive (an angle-bracketed ellipsis comes back HTML-escaped rather than removed), which is what makes the behaviour easy to miss — it is selective, not uniform.

Measured here, twice, in the shape that matters

PR #6449's body. The central deliverable line was written as the full recipe and stored as:

git fetch origin main && git worktree add ../- -b  origin/main && cd ../- && pnpm install

Two placeholders collapsed to a bare -, and a third left a double space. A table row explaining that a site takes an explicit REF from the caller stored as "takes an explicit `` from the caller" — the word the row exists to say is gone.

#6208's own body. The same mutation is already sitting in the card that dispatched the work. Its site table was written to contrast the defective recipe with the fixed one, and both rows arrived stripped:

| `CLAUDE.md:16` | `git worktree add ../- -b  main && cd … && pnpm install` | in |

That is the row a reader consults to learn what the defect is. It no longer contains the defect.

Confirmed against the rendered page, not the API alone — objectstack's AGENTS.md warns that a body reading short through the API may still be intact, so the rendered HTML was checked before concluding. It is genuinely stored stripped.

Comments are not a workaround. A correction comment posted on PR #6449 lost the placeholders in its own closing verification block, in the middle of explaining the mutation.

Why it is worth writing down here

objectstack's AGENTS.md carries this as a named rule with a read-back requirement:

GitHub mutates body BYTES — spell poison-shaped tokens out in words, never literally. … after writing any less-than fragment, read the body back and verify it survived. … ⛔ A body reading short only through the API is probably intact — check the rendered page before "repairing" it; a rewrite destroys a correct card.

This repo has none of it:

$ grep -rn 'sanitiz\|body BYTES\|mutates body' AGENTS.md CLAUDE.md .claude/
(no matches)

Agents working objectui read objectui's instruction files. The failure is silent at write time and the damage is permanent on a card body nobody rewrites, so it will keep recurring — and it lands hardest on exactly the cards most likely to contain angle-bracket placeholders: devx cards about commands, recipes, and generic type or path templates. Both measured instances above are that kind of card.

⭐ The read-back half matters as much as the avoidance half. Writing it down without the "check the rendered page before repairing" caveat would trade this defect for a worse one, since a needless body rewrite on a governed card is unrecoverable.

Scope note, unresolved

The upstream rule is framed around regex literals and script-tag-shaped tokens. The measurement here is a placeholder in ordinary prose and fenced code — commoner, and not obviously covered by "poison-shaped tokens" as a reader would parse that phrase. Whether the right move is a short objectui-side rule, a pointer to the objectstack clause, or a widening of the upstream wording is a judgement for whoever picks this up; the two references may also want to stay in one place rather than be duplicated.

Filed unassigned; no domain:* or type label set.

Generated by Claude Code