Reconcile os-dev contract and pm-dispatch channel references with measured seat reality

[os-steve]

Fixes#12123
Fixes#12111
Fixes#12229
Fixes#12204
Fixes#12226
Fixes#12133
Fixes#12188
Fixes#12341

Family dispatch (8 folded members, one PR): every member reconciles written channel/contract text with measured platform reality on the same three-file surface — .claude/agents/os-dev.md, .claude/skills/pm-dispatch/references/platform-readings.md, .claude/skills/pm-dispatch/references/rest-channel.md. GOVERNED surface: opened as DRAFT, stays draft, no auto-merge — maintainer reviews and merges by hand.

Ratchet readings (gate: check:pm-skill-ratchet, run at head 2377fb33)

file	before (tree db8c2881)	after	ceiling
.claude/agents/os-dev.md	468	469	470
references/platform-readings.md	314	314	314
references/rest-channel.md	87	87	87

All adds paid by same-file cuts; every line within the 120-byte budget. Gate verdict lines: "os-dev.md is 469 lines (ceiling 470; headroom 1)", "platform-readings.md is 314 lines (ceiling 314; headroom 0)", "rest-channel.md is 87 lines (ceiling 87; headroom 0)".

Per-member coverage

• [finding] os-dev subagent seats have no direct GitHub REST channel — GITHUB_TOKEN is a placeholder, curl gets the session-gate 403, gh is absent — while dispatch protocol text assumes REST list endpoints are reachable #12123 (chain head): per-session-class channel matrix in platform-readings (probe must be repo-scoped; rate-limit endpoint answers 200 even on gated seats, so it is demoted from channel probe to the one-call credential discriminator — 15000/hr means live credential refused by repo-scoping, 60/hr or auth error means no credential). Per PM review, the matrix row records the measured VARIANCE rather than a uniform claim: 2026-08-25 five-plus dev seats all gated (reads AND writes — additive label POST and comment PATCH on the same dead channel, no comment-edit route), 2026-08-26 counterexample from this fold's own seat (os-dev seat, gate open, additive POST 200, rate-limit 15000/hr), top-level seats split in one window — gate state varies per container and the repo-scoped probe is the only safe read. rest-channel check marks qualified by session class instead of asserted globally; os-dev.md label step names the measured fallback (MCP read, union, whole-set write, MANDATORY read-back, declared deviation).
• [finding] The os-dev quota fix (#11365/#11364) is inert on container seats — REST is 403 there; a zero-quota read channel gets a dev from ~5,658 points to 3 MCP calls (measured) #12111: REST-first policy precondition moved INTO the policy line; zero-quota public-web JSON payload channel added as tier 2 of the default read order with both boundaries (covers reads NOT issue search; never size a lane from the rendered list — it silently pages, 12 shown vs 147 authoritative); os-dev.md standing read-channel clause with the dedup exemption plus zero-hit control-word rule; mcp_calls added as a required report field.
• [finding] Dev agents conclude "no browser available" after playwright install 403s — Chromium is pre-installed #12229: pre-installed Chromium fact in os-dev.md toolchain traps (never run playwright install; a CDN 403 is not evidence of absence; launch via the explicit executable path); the generalizable half in platform-readings: a blocked download is not proof of absence — check for the artifact first.
• [finding] The hardened restore idiom destroys UNCOMMITTED work — git checkout HEAD -- PATH wipes the implementation under test, and #11648's fix made this more likely, not less #12204: commit-before-ablation companion clause in the reverse-verification section: a restore leg targets HEAD; if HEAD predates the fix, a perfect restore deletes the fix while every existing post-restore check passes cleanly. The HEAD-explicit restore idiom itself stands untouched.
• The os-dev contract says skip-changeset "does not exist" in objectui — the label object DOES exist and nothing reads it, so an agent that verifies the claim will draw the wrong conclusion #12226: objectui skip-changeset sentence states the MECHANISM, not the existence — the label object exists (minted by a past application) but zero workflows/scripts read it (census re-derived locally in both repos; objectui pin test scripts/__tests__/ci-cd-pipeline-doc.test.ts pins exactly this), so it exempts nothing; empty-frontmatter changeset is the declaration there; read-back verifies the write landed but is blind to phantom gates.
• [finding] The prescribed HTML-comment report marker does not survive the comment sanitizer — measured twice in one shift, and the recovery leaves orphaned report comments a marker scan cannot see #12133: the literal-text first-line marker is already the sole prescribed form on base (verified: PM-side SKILL.md treats both spellings as equivalent, so the dev-side retirement is safe); this PR adds the remaining scope — read the report comment back to its TAIL, extend the read-back obligation to the PR body, and the placeholder-word spelling rule for angle-bracket-shaped fragments in any GitHub-bound text.
• [finding] os-dev background-wait stall RECURRED after the written remedy — 2 of 5 devs in one wave, both under verify-lock contention; the rule exists and is not holding #12188: mechanical stall self-check in the clean-shutdown clause: the final message MUST be the report JSON or a blocked report; any other final text is a stall by definition — stated with the recurrence fact (the prose ban alone measurably did not hold: 2 of 5 devs in one wave, both under lock contention).
• [finding] The verify-lock slot mechanism is discoverable only from --help and an exit-99 message, so no agent will use it — the fix lands in skills-owned files #12341: OS_VERIFY_LOCK_SLOT=NAME parking taught in the queueing rule itself (park keeps the original arrival stamp; without it every departure re-queues at the back), meeting the card's executable criterion — the instruction reaches an agent from its own definition, not from help text or an exit-99 message. Premise re-verified on this tree: 9 occurrences in scripts/pm/os-verify-lock.sh, control probe 0.

Merge-queue readings: the arm-verification sequence in platform-readings now carries the superseding procedure — queue-ref positive is the decisive read (also when PR reads are stale for ~15 minutes after a human merge); on absence run update-branch first to surface a hidden conflict (a silent conflict never enters the queue and does not eject the armed PR); only then re-arm, where a 405 "already in the merge queue" on retry is the decisive positive. The superseded empty-fields no-op signature is explicitly recorded as refuted ("空回显≠未挂上").

Cut ledger (adds paid by same-file cuts; every dropped detail survives in git history at db8c2881)

• os-dev.md: superseded curl additive-label spelling dropped (endpoint spelling lives in rest-channel.md); falsified "measured reachable from dev seats" claim replaced by the session-class conditional; clean-shutdown incident narrative (four same-shape stalls in one day) replaced by the newer post-remedy recurrence measurement; model-pin comment, filing-discipline passage, verify-lock rule 1, foreground rule 6, NUL paragraph and footer paragraph tightened in wording with all facts kept.
• platform-readings.md: rate-limit-as-probe dual-duty claim (falsified by measurement) replaced; WebFetch rendered-page row folded into the payload row; churn-then-flip verification heuristic superseded by the augment procedure; evidence-detail compressions (exact timestamps, one of three OR-side examples, downgrade chain model names, second character-count figure, five-shape probe wording, GH-debug spelling) in rows otherwise untouched in meaning. Review amend: the seat-matrix row now records the gate variance (both dated readings plus the top-level split) instead of a uniform per-class claim; the net add is paid by tightening the silent-downgrade row's wording (facts kept).
• rest-channel.md: global check-mark assertion replaced by the session-class-qualified header; merge-group counter tombstone, merged-by row, three-readings row and the draft-flip / issue-transfer items tightened.

Verification

• check:pm-skill-ratchet green at head 2377fb33 (readings above; exit captured before any pipe).
• Derived gate union (from node scripts/pm/dispatch-gates.mjs, no paths passed; derivation header named this repo) re-run as one AND-chain under the verify lock at head 2377fb33: check:agent-model-declared, check:agent-test-spelling, check:doc-authoring, check:doc-formula-expressions (after building its two prerequisite packages), check:nul-bytes, check:pm-governed-merges, check:pm-skill-id-lint, check:pm-skill-ratchet, check:skill-frame-sync — lock verdict line: "VERDICT command-exit 0 · held the lock 18s". check-governed-queue-guard is NOT MEASURED locally by design (it reads the CI event payload and refuses to pass without one); it runs in CI, and this PR's landing path (draft, no queue, no auto-merge) is the state it guards.
• skip-changeset applied via the additive endpoint (HTTP 200 from this seat — the open-gate counterexample now recorded in the matrix row itself) and read back after the size-labeler ran: documentation, size/m, skip-changeset.

Generated by Claude Code