Instruction-text alignment: five governed-protocol clauses restated to measured reality

[os-litant]

Fixes#12553
Fixes#12520
Fixes#11960
Fixes#12455
Fixes#12627

Family dispatch: five cards aligning the governed instruction files (pm-dispatch SKILL.md, os-dev.md, AGENTS.md) with measured reality on the claim/label/recovery discipline face. One commit per member; every edit stays inside the zero-headroom ratchets (SKILL.md 1005/1005, os-dev.md 470/470, AGENTS.md 1158/1158; widest SKILL.md table row unchanged at 765/765). All landing sites were re-verified against the post-merge main (the protocol-hardening chain rewrote os-dev.md rule 2 and SKILL.md's claim passages this morning); edits reconcile with the merged text, not with the cards' pre-merge quotes.

Per-member deliverables and check criteria

Chain head — comparative label read-back (protocol-text half only).
SKILL.md's hard-step label rule and os-dev.md's whole-set fallback now require the read-back to be diffed against union(read set, intended change), re-adding and reporting any label the whole-set write stripped; both texts state that the comparison detects the loss and does not prevent it. Criterion: grep both files for the union-diff spelling — union(现集, 目标增删) in SKILL.md, union(读集, 目标) in os-dev.md. Candidate shapes 1 and 2 on the card (an additive MCP label call; seat-credential export) are platform surfaces and are deliberately not touched here.

Assignee ownership — the os-dev vs repo-CLAUDE.md contradiction.
Ruled to the PM side, matching the dispatch atomic pair as merged this morning: os-dev.md rule 2 now opens assignee 归 PM and gives one deterministic action in every observed state — never write the field; an empty-on-arrival assignee is a PM-side half-state reported in the summary — and states that the repo CLAUDE.md claim-first rule is satisfied by the PM's claim before the dev arrives. SKILL.md's claim intro states the same ownership from the PM side (assignee 字段归 PM:原子对 step 1 设,dev 席恒不写它). Criterion: both files answer "who writes the assignee field" with the same owner, and the dev instruction no longer asserts a state the dev may not observe.

Finding-label kind split.
The skill's report-contract line now carries the role file's split — observational findings wear finding, concrete defects stay unlabelled for triage — instead of the unconditional labelling token. Criterion: SKILL.md no longer contains an unconditional finding-labelling instruction; the rewritten parenthetical names both kinds and defers to os-dev rule 3.

Footer promise restated to the measured edit-path behaviour.
os-dev.md's byte-discipline section and AGENTS.md's attribution-footer clause now state the 2026-08-26 measurement (three REST writes, per-write read-back): create keeps the session-URL form; every PATCH edit normalises it DOWN to bare; the bare footer survives later edits verbatim. Both files state the practice: the footer's session id is create-only; durable attribution goes in body prose or a comment. The comment-channel paragraph is untouched (separate channel, not re-measured). Criterion: neither file still claims the session form survives the edit path.

Dead-claim recovery rescues the worktree first.
The stale-claim reclaim step now begins by checking the dispatch worktree: uncommitted changes are committed as WIP on the dispatch branch, pushed, the sha named in the recovery comment and marked INCOMPLETE AND UNREVIEWED, so the resuming dispatch diffs it rather than building on it unexamined. Criterion: the reclaim clause names the worktree rescue before the assignee release.

Cut-ledger (zero-headroom accounting)

Every file lands exactly at its ceiling; every added byte was paid inside the passages being edited. Cuts, each with its surviving home:

• SKILL.md claim intro: the parenthetical naming the mode:subagent branch identity was cut; surviving home: claim step 2, six lines below, which carries the same fact with its measurement note.
• SKILL.md label rule: the plain read-back spelling and the "read-back is the only detection" clause were replaced by the comparative union-diff spelling in the same clause; the "whole-set PUT writes this seat's snapshot" sentence folded into the erasure sentence; the API-200 caveat compressed with meaning intact.
• os-dev.md rule 2: the draft-flip two-way detail compressed to a one-phrase verdict; surviving home: the platform-readings fact row on draft-flips, which carries the full two-way measurement.
• os-dev.md footer block: the falsified promise lines are replaced, not moved; the dropped "platform behaviour, evidence of nothing else" elaboration survives in rule 2's own body-evidence sentence, which the block cites.
• Line accounting: SKILL.md 1005 to 1005 (label rule 6 to 6, claim intro 3 to 3, finding line 5 to 4, recovery 4 to 5 — the recovery line is paid by the finding member's in-place shrink); os-dev.md 470 to 470 (rule 2 6 to 6, label fallback 5 to 5, footer block 12 to 12); AGENTS.md 1158 to 1158 (PR-body paragraph 5 to 5).
• Flag for review, not hidden: the finding passage's freed line comes from re-flowing the sentence the kind split rewrites (its two under-filled wrap fragments absorbed the new words). The re-flow is confined to the edited sentence itself — no untouched passage was re-wrapped — but if that funding reads as a re-wrap purchase under the no-re-wrap rule, the remedy is a maintainer-picked one-line cut; flagging it here rather than presenting it as a clean cut.

Verification (head aede3eb)

Derived union from node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (change set: exactly the three files; 14 local families), all runs at head aede3eb through the shared verify lock:

• pm-skill-ratchet, quoting its own verdict lines: "SKILL.md is 1005 lines (ceiling 1005; headroom 0)", "os-dev.md is 470 lines (ceiling 470; headroom 0)", "AGENTS.md is 1158 lines (ceiling 1158; headroom 0)", "SKILL.md: widest table row is 765 bytes (pin 765; headroom 0)" — 54 check lines, exit 0
• pm-skill-id-lint, skill-frame-sync, skill-frame-freshness, agent-model-declared, agent-test-spelling, doc-authoring, docs-audit-scope, nul-bytes, pm-governed-merges self-test, pm-governed-prose, required-contexts: all exit 0
• doc-formula-expressions: green after building @objectstack/formula and @objectstack/lint under the lock ("9 @example(s) judged clean across 1052 packages/spec/src files")
• governed-queue-guard: NOT MEASURED locally by construction — the guard reads the workflow event payload and nothing else, so only CI can run it; declared narrowing, CI owns this run.

Governed surface: this PR stays draft for maintainer merge (instruction .md files). No changeset — nothing publishable changes; skip-changeset label applied per this repo's mechanism.

Out of scope, stated safely: the platform-surface candidate shapes on the chain head (additive MCP label endpoint, seat-credential export) are not addressed here. The AGENTS.md claim-first paragraph for standalone, non-dispatched agents remains as is: under the PM-owned assignee ruling it needs no change, since the PM's dispatch-time assign satisfies it before a dispatched dev arrives.

---

Generated by Claude Code