os-dev: prove the restore leg, scope the concurrency flag, break the park tiebreak, and make the report contract sanitizer-safe

[claude]

Closes#11539
Closes#11648
Closes#11419
Closes#11463
Closes#11923

Five amendments to .claude/agents/os-dev.md, one file. Four of them are the same
shape — an instrument that reports success while measuring the wrong thing — and the
fifth makes the report contract agree with the sanitizer reality every dispatch brief
already encodes.

Governed surface ⇒ draft, human merge. Not marked ready.

Per-item checklist

card	落点 (landing site)	before	after
#11648	reverse-verification, 标准条款 §	the section taught git checkout origin/main -- <path> for the mutation and nothing about how to undo it; zero occurrences of the HEAD spelling	new 通则 bullet ①: restore with git checkout HEAD -- <path>, ⛔ never bare git checkout -- <path> — a ref-checkout writes the index, so a bare restore reads the mutation back and exits 0. ②: the restore is proved by git diff HEAD empty, symmetric with the mutation-proof the contract already demands
#11539	same bullet	no hash-proof text anywhere in the file	③ trap paths are absolute (REPO_ROOT="$(git rev-parse --show-toplevel)"), with the trust ordering stated outright — the trap is the crash-path convenience, the byte/hash comparison is the proof; a trap that fired only proves a shell ran a function. ④ an emptygit hash-object read is FAILURE, not "nothing to compare"; compare against the path's HEAD blob; a mismatch exits non-zero and loudly
#11539 (riders)	本地验证范围, after the gate-reading paragraph	absent	new paragraph naming two "ran but measured nothing" classes: a package typecheck that excludes **/*.test.ts (verify with --listFiles before claiming "typecheck clean" covers your edit), and MODULE_NOT_FOUND-class exit-1s that never reached the gate body — filed alongside exit 99 / queue-timeout / PREREQUISITE NOT MET as NOT MEASURED
#11539 + #11648	the general principle, stated once	absent	a cleanup step whose failure mode is "exits 0 and does nothing" is verified by observing state, never by reading exit codes — the sentence that makes both cards one rule
#11419	Toolchain traps, first entry	the placement rule stated unscoped	scoped to filtered run-commands (run / build), with the install rejection in the same breath: pnpm 10 answers ERROR Unknown option: 'workspace-concurrency', and install is the first command in a fresh worktree — the rule's most expensive misuse point
#11463	never-park clause 4, 干净收尾 §	the clause forbade the destination but named no compliant road, so it lost the tiebreak to "don't poll in a sleep loop"	added tiebreak: anti-polling and never-park are satisfied together by exactly one shape — a FOREGROUND blocking wait (Monitor with an until-condition, or running the suite in the foreground); ⛔ ending the turn is never the anti-polling remedy
#11923	report contract, both statements of it (header + 干净收尾 §)	`<!-- os-dev-report -->` — the marker the sanitizer eats	the report is posted as a card comment first, first line the literal plain text os-dev-report, ⛔ no HTML comments anywhere; the same report then goes out as the final message. The restart incident (three devs killed mid-final-message, zero work lost because the card copies existed) is carried as the reason this is durability, not ceremony

The ratchet cost, and how it was paid

.claude/agents/os-dev.md sits under check:pm-skill-ratchet at ceiling 470, headroom 0. ⛔ The ceiling is untouched — no raise, and no maintainer ruling was needed.

	lines
origin/main	470
after the five amendments	501
after paying by compression	461 (headroom 9)

Payment is a re-flow of orphaned continuation lines in the four sections the amendments land in, using the gate's ownwrapLine — the same canonical wrap check:pm-skill-ratchet measures against, so the result is a fixed point of the gate rather than a hand-wrap that happens to fit. 28 blocks re-flowed, 40 lines reclaimed.

Proof that the re-flow moved only whitespace

Content-preservation was measured, not asserted. Walking the before/after texts as token streams (non-whitespace chars, plus whitespace runs tagged newline-vs-literal-space):

content chars compared in lockstep to the end: true
line breaks REMOVED: 117
...of which sit at a junction that is NOT CJK-to-CJK: 0
line breaks ADDED: 114
literal (non-newline) spaces added or removed: 0

Every removed break sat between two Han characters, where the CSS segment-break transformation removes it — the property the ratchet header names as what makes the corpus's CJK wrapping legal. Every added break was produced by wrapLine, which offers a spaceless break only when a.cjk && b.cjk. Not one literal space was added or removed, and not one non-whitespace byte moved.

⚠️ One check is reported and not claimed as evidence: an attempt to validate the join rule by round-tripping corpus paragraphs through wrapLine scored 27/61 against a deliberately-wrong control's 29/61. The control failed to discriminate, so that test proves nothing and is not offered as support. What replaced it is the direct measurement above, which assumes nothing about the join rule and instead measures what actually changed — plus a direct count of the failure mode it would have caused: literal spaces between two wide characters, 0 before and 0 after.

Gates

All nine families derived from the real changeset by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (the tool read the changeset from the merge base itself; no hand-built path list was fed to it). Run at b964b3269, exit codes captured before any pipe, each quoted from the gate's own verdict line:

gate	exit	verdict line
check:pm-skill-ratchet	0	✓ check-skill-line-ratchet: .claude/agents/os-dev.md is 461 lines (ceiling 470; headroom 9).
check:doc-authoring	0	✓ doc authoring guard: 389 files clean — no bare metadata literals.
check:agent-test-spelling	0	✓ check-agent-test-spelling: 0 violations — 367 file(s) · 3686 bare `--` token(s) · 1141 launcher-rooted run(s)
check:nul-bytes	0	check-nul-bytes: OK (scanned 6704 text file(s) … no raw ASCII control bytes).
check:skill-frame-sync	0	✓ check-skill-frame-sync: 4 copies of the decision frame are structurally isomorphic across 3 files
check:agent-model-declared	0	✓ check-agent-model-declared: 1 agent definition(s) … all declare a model
check:pm-skill-id-lint	0	✓ check-skill-id-lint: 22 file(s) clean (pattern /#[0-9]{3,}/g).
check:pm-governed-merges	0	✓ check-governed-merges --self-test: 129 assertions …
check:doc-formula-expressions	0	✓ check:doc-formula-expressions: 22 record-scoped formula example(s) across 421 files / 1449 TS blocks judged clean

The last one is worth a line, because it is this PR's own subject matter appearing in its own verification: it first exited 1 twice, both times PREREQUISITE NOT MET (no typescript installed; then @objectstack/formula not built). Neither exit-1 was a red gate — the gate had not run a single check. Both were resolved (pnpm install, then two targeted builds under scripts/pm/os-verify-lock.sh) and the gate then measured green. That is exactly the NOT MEASURED class this PR adds to the standard.

#11419's premise was re-verified live rather than taken from the card, on pnpm 10.31.0:

$ pnpm install --workspace-concurrency=2 --filter '@objectstack/spec'
ERROR Unknown option: 'workspace-concurrency'
Did you mean 'network-concurrency'? …

No changeset: the diff is one .claude/ file and publishes nothing — skip-changeset applies.

Out of scope, filed not fixed

Recorded while paying the ratchet cost, filed unassigned as #12081: the corpus carries 45 soft breaks sitting directly after an ASCII comma between Chinese clauses, each rendering as a stray mid-sentence space (invisible in source, visible in the render). ⛔ Deliberately untouched here — closing them is a corpus-wide typography decision, not part of these five cards, and #12081 remains open.

---

Generated by Claude Code