os-dev: wait actively on the shared verification lock instead of ending the turn

[hotlong]

Fixes#8448

.claude/agents/os-dev.md only. The unconditional clause set for the measured stall where a dev queues on the shared verification lock, ends its turn expecting a wake-up from a process it does not own, and sits until the PM probes it. Nine measured instances back this: three in one batch on the filing card, plus six from the spec-lane shift handover whose items 1 and 2 were graded into this card's scope. That handover card, #8294, is referenced here as the evidence anchor only — it stays open, and the filing seat retires it by hand once both halves of its split have landed.

What changed

Resource discipline rule 1 — the lock is now a named convention, not just a command to copy: the path, flock owns the release (fd-scoped, dropping when the command's process tree exits), the lock wraps the command only and never your reading or deciding, and the acquire is bounded to fit inside one foreground call instead of a blind two-hour block.

Resource discipline rule 7 (new) — queued is not stalled. Never end a turn to wait for the lock; loop in the foreground and spend the queue interval on lock-free work (test authoring, changeset, PR body, package-local typecheck); past roughly 20 minutes with no progress, stop and report blockedwith the holder named.

Rule 6's closing sentence ("the one legitimate long wait is flock queueing") now states that the wait is active and in-turn. As previously written, that sentence was the one line in the file that read as permission to park on the lock.

"Terminating cleanly", new item — the end-of-turn self-check: does my last message describe a wake-up I expect from a process I do not own? Deliberately scoped so the ordinary report is never a violation: the report ends a turn on a result, in_progress gate status included, not on a promise that something else will resume you.

Mechanics measured in this container, not assumed

• flock -w N exits 1 on queue timeout — indistinguishable from a genuinely failing test. -E 99 separates the two, and it still passes the command's own exit code through unchanged; both directions verified.
• An abandoned run's orphaned child keeps the lock. Killing the wrapper left the lock held via the inherited fd until that child itself exited. That is the shape a stuck lock actually takes, and it is why "name the holder" is actionable: fuser -v on the lock path prints the PID and command.
• A single foreground call is capped at 10 minutes on this harness, so the previous -w 7200 could never have completed inside the call it ran in. That gap is the most plausible mechanical pressure toward backgrounding — which is the stall itself.

Verification

All eight derived gate families ran in the foreground with real exit codes collected, all green. The PM's gate list and a re-derivation with node scripts/pm/dispatch-gates.mjs against the actual changed path agree exactly — no additions. Practising the clause being written: every heavy step (install, the dependency build closure, the lint-package gate) ran under the shared lock in the foreground, and one masked exit code from a tail pipeline was caught and re-run for the real status.

No changeset: this is a .claude/-only change and releases nothing, so skip-changeset applies.

Merge path: draft, human-merge class (skills root). Not marked ready, no auto-merge armed.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 13, 2026 2:17pm