agents(os-dev): verify-lock non-guarantee clause + ratchet funding discipline in the dev contract (#14229)

* agents(os-dev): state the verify lock's non-guarantee beside its guarantee list

Rule 1's entry-point list named four guarantees and no non-guarantee, one
line above rule 6's wall-clock absolute — so every reader completed the
list into exclusivity the lock never promised. Add the missing clause: the
lock does NOT guarantee an idle machine; it only excludes work routed
through this entry point, and check:* gate runs, installs and dev servers
never take that path, so wall-clock absolutes measured under a hold are
shared-box readings. The script itself has stated this boundary on every
acquisition and in its VERDICT line since the disclosure change landed;
the clause points there rather than re-explaining. Rule 6 is untouched —
its sentence is literally true; the list is where the belief formed.

Funded (ratchet ceiling 469, headroom 0) by shrinking the model-pin
comment to a pointer: its resolution order, batch-death incident and both
traps live verbatim and fuller in scripts/check-agent-model-declared.mjs's
header, which is the surface that goes red when the pin is touched.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Whev4BkZ4BRcgiXYo4muWP

* agents(os-dev): carry the ratchet funding discipline, both sides in one breath

The re-wrap funding ban lived only in the PM's dispatch SKILL.md; two devs
paying line ratchets hit it independently in one hour, each doing exactly
what its dispatch said and reaching for the cheapest visible line source.
Add the rule to the contract the dev actually reads, stating BOTH sides so
the next dev neither funds with re-wrap nor refuses a legitimate
densification repair: additions are paid only by deleting content
(maintainer 2026-08-17), while independent densification that buys no
content is an allowed repair (maintainer 2026-08-29); the boundary
question is whether the re-wrap bought lines for new content. Raising the
ceiling stays the maintainer's floor; when nothing can be deleted, the
answer is a blocked report, not a raise.

Funded (ceiling 469, headroom 0) by delegating two verbatim duplicates to
their canonical homes: the stash mechanism + replacement spellings live in
CLAUDE.md (injected into every session) and AGENTS.md; the 2026-08-26
footer measurement lives in AGENTS.md's attribution-footer clause, which
this file's own sanitizer section already names as the single home. The
operative conclusions (never stash; session footer is create-only) stay.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Whev4BkZ4BRcgiXYo4muWP

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-justin

.claude/agents/os-dev.md

@@ -9,12 +9,8 @@ description: >
 model: opus
 ---
 
-<!-- `model: opus` 是刻意钉死的:没有它,每个被派发的 dev 都会**继承派发会话的模型**(实
-测:小模型上的 PM 座位曾把一整批 dev 无声压死在同一面共享额度墙上)。pin 是「未指定情形
-的下限」,不是上限 —— 解析顺序 CLAUDE_CODE_SUBAGENT_MODEL 环境变量 → 逐次调用的 `model`
-参数 → 本行 → 父会话的模型,PM 的逐单定档优先。两个陷阱:该环境变量静默压过一切,而
-本仓没有任何东西会显示它;被 org 允许名单挡下的值回退到**继承的**模型 —— 正好落进本
-pin 要防的失效 —— 而不是回退到本行。 -->
+<!-- `model: opus` 是刻意钉死的下限,不是上限 —— PM 的逐单定档优先。完整解析顺序、
+批量压死事故与两个陷阱(环境变量、允许名单)住 check:agent-model-declared 门禁脚本头部。 -->
 
 你是 ObjectStack 开发 agent,由 PM 派发,恰好带一张 GitHub issue。你的交付物是:该 issue
 实现完毕并推成 draft PR,外加下方的 JSON 报告 —— **交付两次,GitHub 优先**:先作为 issue
@@ -86,7 +82,10 @@ pin 要防的失效 —— 而不是回退到本行。 -->
    走:`bash scripts/pm/os-verify-lock.sh -c '<command>'`(或 `-- <argv>`)。⛔ 永不手搓 `flock`/lockfile ——
    手写 `-w` 即「守约者饿死、越界者通吃」(实测:同容器五个等待者、三个越界 6 倍;越界者
    只凭「一直在场」12/12 赢走交接)。入口点保证:等待预算钉死在一次前台调用之内(更长表
-   达不出来)· 按到达顺序授予 · 99 仍专指「没排到」· 收尾打印持锁时长,过长自己喊。只
+   达不出来)· 按到达顺序授予 · 99 仍专指「没排到」· 收尾打印持锁时长,过长自己喊。同
+   一张清单的非保证:**它不保证机器空闲** —— 只排除经这个入口进来的工作,`check:*`
+   门禁、install、dev server 不走它,与持锁同核并跑(脚本每次获取与 VERDICT 行同述此界)⇒ 锁
+   下墙钟绝对值一律是共享盒读数,不是安静机器承诺。只
    包**命令本身**,不包你的阅读与判断;结论读它印的 VERDICT 行,不读裸 `$?`。排队是常态,不
    是挂死。
 2. **压住堆**:重命令前缀 `NODE_OPTIONS=--max-old-space-size=4096`(要抬需给理由)。
@@ -226,9 +225,7 @@ dispatch prompt 只携带每单增量(裁决引文、裁决 / PM-机制假设分
 - **家族规则:`git worktree` 只隔离工作树与 HEAD;`.git/` 下其余一切 —— refs(含
   `refs/remotes/*`)、stash 栈、config、hooks —— 全 worktree 共享;配方只有不点名共享态才
   worktree-safe。家族同签名:操作看着本地、报成功,唯一症状是 `git status` 里出现他人文件。**
-  ⛔ 永不 `git stash`(共享一个 LIFO 栈,两个 agent 同时 stash 互换条目;机制与 hook 见 AGENTS.md);取
-  出修复用临时 commit 或 patch 文件,都在自己 worktree 内: `git commit -am wip` 再
-  `git reset --soft HEAD~1`;`git diff > /tmp/wip.patch && git checkout -- <paths>` 再 `git apply /tmp/wip.patch`。⛔
+  ⛔ 永不 `git stash`;替代拼写(wip commit / patch)、机制与 hook 住每会话注入的 CLAUDE.md。⛔
   `origin/main` 是共享指针,别的 agent 一次 fetch 就推进它:`git reset --soft origin/main` 把你分支点
   之后**他人已合并的文件**整批 stage 成你的(实测一次四个 agent 的合并文件,commit 前才逮
   住)。「我从哪开始」的 reset/diff/log/rebase 一律锚基本规则 1 记录的 `"$BASE"`。
@@ -323,6 +320,11 @@ dispatch prompt 只携带每单增量(裁决引文、裁决 / PM-机制假设分
   2026-08-21 裁决,原文不译:「对外发布的 skills 是整个平台的最大价值,尤其要整体考虑和评
   估。」「……不能为了一个小功能扩写很多。」派发词给的净增预算装不下 ⇒ 停下按 `blocked` 报
   缺口,⛔ 不自行扩写、不自行抬预算 —— 预算是 PM 的,抬它是维护者裁决。
+- **付行数棘轮的唯一合法货币是删内容。** 维护者 2026-08-17 裁「⛔ re-wrap(折行合并)
+  不得用作筹行 —— 棘轮治理的是内容体量,行数只是机读代理,新增以删减付账;密度优化仅随净减
+  内容的 PR 顺带」、2026-08-29 裁「筹行(为内容购买行数)⛔ vs 独立密度修复(无内容购买)允
+  许」。分界只问折行有没有为新增内容买行 —— 门禁分不出两种 net-0;⛔ 不买内容的密度
+  修复是修复,不要当筹行拒掉。删不出等量内容 ⇒ 报 `blocked`,⛔ 不抬 ceiling(人工地板)。
 - **`skip-changeset` 标签按仓库分流——先认清目标仓库有没有这个机制。** 判据:**不从任何包
   发布东西**;闭合清单:仅含 `docs/adr/**` · `.claude/**` · `scripts/pm/**` · tests/workflow · 注释 的
   diff。**本仓库**:标签是真实机制,打标签是你的步骤、不是 CI 的,**PR 一开出就打**,⛔ 永不
@@ -463,7 +465,5 @@ _Generated by [Claude Code](https://claude.ai/code)_                ← bare:评
 _Generated by [Claude Code](https://claude.ai/code/session_<id>)_   ← session-URL:创建 PR 正文用
 ```
 
-实测(2026-08-26,三写逐写回读):create 保 session 形,并把裸形静默改写成它(平台行为,基本
-规则 2);**每次 PATCH 编辑把 session 形降回裸形,裸形其后原样存活** ⇒ session 页脚只按
-create-only 对待:归属要跨正文编辑存活,把 session URL 写进正文散文或评论作耐久副本,⛔ 不
-循环重贴页脚。评论是另一条通路:裸形在那里原样存活。
+**session 形按 create-only 对待**(PATCH 编辑把它降回裸形;评论通路裸形原样存活)⇒ 耐久归属
+写进正文散文或评论,⛔ 不循环重贴页脚;完整实测(2026-08-26)住 AGENTS.md 同条。