Make the additive label POST the prescribed write and permit it for dev agents

[os-zhuang]

Fixes #10902
Fixes #10686

One defect in two halves, one commit per member.

Member 1 — .claude/agents/os-dev.md (commit 8c0a24c)

The skip-changeset paragraph taught the whole-set read → union → write as what the label write is. Rewritten to the adjudicated four-point shape:

1. The additive POST /repos/{owner}/{repo}/issues/{n}/labels is THE mechanism, named executably — the exact curl line with Authorization: Bearer $GITHUB_TOKEN (measured working from an agent seat; "apply it additively" alone was demonstrably not actionable).
2. Read-back stays as the closing step — and the measured caveat is folded in: the additive POST is necessary but NOT sufficient. A bot's whole-set PUT was measured erasing a correct additive write within about 1 second, so the read-back happens AFTER the bots settle, and a vanished label is re-applied, not treated as the agent's own error.
3. The whole-set read → union → write is demoted to an explicitly declared fallback for a seat where the additive call is refused, with the requirement to report the read-back when used.
4. The objectui half (the label does not exist there; never create it) is untouched.

Line budget: os-dev.md 392 → 395 lines, ceiling 399 (check:pm-skill-ratchet verdict below). No ceiling raise. No issue numbers added (id-lint clean).

Member 2 — .claude/settings.json (commit f6d61c9)

Direction A from the paired card: the auto-mode permission classifier was measured blocking a dev agent's additive label POST while permitting the whole-set issue_write labels array — the inversion that pushes agents into the clobbering shape. Two permissions.allow entries pre-approve exactly the additive POST spelling that os-dev.md now prescribes, for this repo and the objectui twin (the same settings file governs sessions that touch both):

• Bash(curl -sS -X POST https://api.github.com/repos/objectstack-ai/objectstack/issues/*/labels *)
• Bash(curl -sS -X POST https://api.github.com/repos/objectstack-ai/objectui/issues/*/labels *)

Strictly narrower than the whole-set write already permitted: the endpoint can only add. Documentation note: settings.json is strict JSON and cannot carry comments, so the rationale lives here and in the os-dev.md paragraph the entries serve (the doc pins the exact spelling the rules match — URL directly after -X POST — and says not to rewrite it). Failure direction if the harness does not support the mid-pattern wildcard on the issue number: the rule is inert and the classifier keeps deciding, i.e. no wider than today. This does not address the labeler's own whole-set PUT — that half remains open: #10703 remains open (devx lane).

Verified this session from a dev seat: the additive POST to this PR's own labels endpoint returned 200 and the read-back after the size-labeler settled shows the label intact (evidence in the report comment on the anchor card).

Gates (all at head f6d61c9, run after the final commit)

node scripts/pm/dispatch-gates.mjs (no hand-fed paths) derived 8 families; all green:

• check:pm-skill-ratchet — "✓ check-skill-line-ratchet: .claude/agents/os-dev.md is 395 lines (ceiling 399; headroom 4)."
• check:pm-skill-id-lint — "✓ check-skill-id-lint: 17 file(s) clean (pattern /#[0-9]{3,}/g)."
• check:doc-authoring — "✓ doc authoring guard: 389 files clean — no bare metadata literals."
• check:nul-bytes — "check-nul-bytes: OK (scanned 6426 text file(s) … no raw ASCII control bytes)."
• check:pm-governed-merges — "✓ check-governed-merges --self-test: 119 assertions …"
• check:agent-model-declared — "✓ check-agent-model-declared: 1 agent definition(s) under .claude/agents/ all declare a model"
• check:skill-frame-sync — "✓ check-skill-frame-sync: 4 copies of the decision frame are structurally isomorphic across 3 files"
• check:doc-formula-expressions — "✓ … 22 record-scoped formula example(s) across 416 files / 1447 TS blocks judged clean"

.claude/** only — no publishable package changes, so no changeset; skip-changeset label applied. Governed surface (Prime Directive #14): draft PR, human merge only.

Generated by Claude Code

---

Generated by Claude Code

[os-zhuang]

PM 验收 — ACCEPT（终态）

复核：席位 session_01MsbKEG4LtERSLaDrbehM3e 全 diff 审毕（+12/−7 两文件，一员一提交各带 Fixes）。成员 1（os-dev.md）：裁定的四点形状逐项落地——加法 POST 以可执行拼写写明并与 settings 允许项互钉（「别改写」）、读回保留且移到 bots 稳定后（消失读作被抹、重加非己错——#10686 实测警示折入）、整组并集降为申报式回退、objectui 半边逐字节未动；395/399 无抬升，id-lint 绿。成员 2（settings.json）：两条 permissions.allow 窄允许，严格窄于已放行的整组写；通配符若不被支持则规则惰性=今日行为，失效方向收敛。

前提修正如实申报：#10686 的 classifier 拦截本席未复现（同拼写 200）——判定被实测为形状敏感且跨会话不可重复（证据卡 #11114，已按发现纪律立卡待定级）。这不削弱方向 A，反而是其最强论据：显式 allow 条目是唯一确定性通道。机制自证：本 PR 的 skip-changeset 即以文档中的加法 POST 施加，读回 bots 后双标完好零 unlabeled。

治理面终态：.claude/** —— 本 PR 保持 draft，仅维护者合并；⛔ 不 ready、不入队、不布防。已指派维护者。合并后剥 #10902/#10686 状态标。

---

Generated by Claude Code

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 32594788700 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Console Pin Gate — 失败步骤: Build the Console SPA at the pinned objectui SHA

  ✗ Build failed in 5.88s
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

跨 PR 相同签名（24h，按失败测试文件聚合）：

• ⚠️ 本次没有可用的聚合签名（日志里没有能解析出测试文件名的 FAIL 行）—— 这不是「没有同签名的其他 PR」，是这一轮没测到。跨 PR 聚合本次不可用，请手工比对其他 PR 的同类评论。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 92 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)