[finding] The session-URL PR-body footer does NOT survive an edit — a PATCH normalises it down to the bare form, the opposite of what os-dev.md/AGENTS.md promise

[os-trump]

Provenance: rebuilt from objectstack-ai/objectui#6483 by the triage seat (session session_01NxyjjkJKBjpfTQa5GJ8WJo, 2026-08-26) — repo transfer unavailable to this seat, so re-filed per file-at-destination: the operating text this finding falsifies lives in THIS repo. Original measurement by session session_011SfZeFWrhGLHmfq61xbz4q while updating objectstack-ai/objectui#6472 (objectstack-ai/objectui#6051). Filed unassigned, observational — skills-lane finding, self-triaged by that seat. ⛔ Not graded here.

The rule as written (verified on origin/main this round)

• .claude/agents/os-dev.md:461-462:

_Generated by [Claude Code](https://claude.ai/code)_ ← stripped on every edit
_Generated by [Claude Code](https://claude.ai/code/session_)_ ← survives both paths

• AGENTS.md:476 prescribes the session-URL form for PR bodies, and AGENTS.md:480 states "session-URL survives both write paths, and create_pull_request rewrites bare into it".

What was measured (deterministic, 3 writes)

Three writes against objectstack-ai/objectui PR #6472, each read back via GET /repos/objectstack-ai/objectui/pulls/6472:

#	write	body ended with	read back as
1	POST /pulls (create)	session form	session form
2	PATCH /pulls/6472 (edit)	session form	bare form
3	PATCH /pulls/6472 (edit)	session form	bare form

Write 3 confirmed write 2 was not a one-off.

Both halves of the rule are wrong for the EDIT path

1. The session form does not survive an edit — it is normalised DOWN to the bare form (the opposite of the promise, on the exact spelling the rule prescribes because it survives).
2. The bare form is not stripped by a subsequent edit — write 3 read the bare form back intact.

Why it matters

Silent loss of attribution in the direction nobody checks: an agent follows the rule, sees the session URL after POST, and never looks again; the first body edit (a review fixup, a PM ruling written into the body) quietly drops the session id while the footer stays present. On objectstack-ai/objectui#6472 the edit that lost it was a PM ruling being recorded — exactly the edit class the rule exists to survive.

The create path is unaffected. Comments are a separate channel, not re-measured here.

Adjacent prior art

#11273 (closed, domain:skills) measured the other half of PATCH footer behaviour at that time (bare footers accreting on edit). This card's measurement is 2026-08-26 and contradicts the standing "survives both write paths" text — whichever platform behaviour is current, the operating text's stated ground is falsified for the edit path.

What a fix would look like

Correct .claude/agents/os-dev.md and AGENTS.md to state what the edit path actually does, and say what an agent should do when attribution must survive edits (e.g. treat the session link as create-only; put the session URL in body prose or a comment). No product code change. ⚠️ Both files are governed instruction-architecture surfaces — draft PR, maintainer merge; protocol-semantics face rules apply to the dispatch tier.