docs(pm): platform-readings retires the denied enqueue tool's rows and reads the REST token class per write, not per session (#18359)

Fixes #18320
Fixes #18334

ONE file, one fold:
`.claude/skills/pm-dispatch/references/platform-readings.md`.
463 to 465 lines (ratchet ceiling 466, headroom 1); every edited and
every added
line is at or under 120 bytes; the widest-table-row pin stays at 0.

## Hunk A — the denied enqueue tool's rows (the first card): lines 41,
49, 50, 58, 60

Lock 1 denies MCP `enable_pr_auto_merge` and `disable_pr_auto_merge` (PR
#18317),
and four rows still taught a seat how to call them. The live enqueue
route is
REST `PUT .../pulls/{n}/ccr/auto_merge`, which `rest-channel.md` owns.

- **`:49` retired** (the `mergeMethod: "SQUASH"` calling convention). It
is a
write-side recipe, and `:133` of this same file rules that write-side
recipes
  live in `rest-channel.md` and are never restated here —
  「逐操作通道归属、写侧配方与队列路由三读法见 `rest-channel.md`,⛔ 不在本表复述」.
  `rest-channel.md:50` already carries the live spelling with
`{"merge_method":"SQUASH"}`. Re-keying it here would have created the
exact
  duplicate that row forbids.
- **`:58` retired** (the tool succeeds on an already-`mergeable_state:
clean` PR,
against its own description). Its entire content is a contradiction
between one
MCP tool and that tool's description; nothing of it survives for the
REST route.
- **`:60` retired** (quota exhaustion returns success with no mount, so
verify the
effect and not the echo). Its conclusion is carried for the live route
by
  `rest-channel.md:52` 「⛔ `auto_merge` 与回显都不作数」, and inside this file by
  the surviving row 「回显两向不可靠 … ⛔ 不拿它当任何方向的证据」, which now stands
  directly above 「效果读数 = …」. The dispatch asked for no duplicate, so no
  replacement row was written.
- **`:41` re-keyed TOOL-NEUTRAL**, deliberately not keyed to the REST
unload. The
surviving truth (unloading auto-merge alone does not kick this repo's
queue) was
measured on the MCP `disable` call. I could cite no measurement of that
same
behaviour on `DELETE .../ccr/auto_merge`: `rest-channel.md:51` measures
only the
422 an unmounted PR answers, which is a different question. Keying the
row to the
REST route would have asserted an unmeasured platform fact, so it now
reads
  「补救:转 draft 与卸载 auto-merge 都做 —— 本仓卸载 auto-merge 单独不踢队。」
- **`:50` re-keyed in place**, forced by retiring `:49`: `:50` opened
with 「它」 and
`:49` was its antecedent. The reading is unchanged and the new subject
is
  route-neutral — 「挂上的 auto-merge 存的方法恒为 `merge`」. This is the one hunk
outside the four named lines, and it is declared as a deviation in the
report.

After this hunk, zero rows in the file name either denied tool in any
voice, so no
history row was needed either: the deny itself is already recorded for
the
operation in `rest-channel.md:53`, which is where `:133` says it
belongs.

## Hunk B — the REST token class (the second card): lines 129-130 become
126-132

`:129` said the class is fixed per session — 「按会话定」. Two measured flips
inside
one session, each with no seat action and with `GET /user` constant,
falsify that:

- the triage seat, 2026-09-15: `claude[bot]` at 15:54Z, then `os-sam` at
22:55Z;
- this seat, 2026-09-15 into 09-16: `claude[bot]` at 20:04Z, then
`os-zhuang` at 01:53Z.

The rows now say: two classes, both at core 15,000/h; the class follows
the Claude
Code account and NOT the session, and can flip between two writes of one
session
with no seat action; both flips are named by date and account; the class
is read
from EVERY write's own read-back (`user.login` plus `user.type`) and is
never
carried forward from the round-open marker, whose identity reading is
dated rather
than standing; and `performed_via_github_app`, `GET /user` and the core
rate-limit
header all answer the same for both classes, so none of the three
discriminates.

The consequence is split across two rows because it does not fit one
120-byte line:
a user-class write is author-bound — a suspended account 404s its
comments and its
filed cards, while labels, state, titles and bodies survive — so the
durability
calculus is re-run per class and never assumed to sign as `claude[bot]`;
and under
the user class the PR's author IS that user, so requesting them as
reviewer answers
422. That 422 was measured on PR #18351 at 02:32Z. The second
measurement table
comes from #18350, which the second card carries as its duplicate.

## Verification

Reverse verification, before and after, on the one file:

| reading | before (`1411cf2c`) | after |
|---|---|---|
| `grep -n -E 'enable_pr_auto_merge\|disable_pr_auto_merge'` | `:41 :49
:58 :60` | zero hits (grep exit 1) |
| `grep -n -E 'installation\|user-to-server'` | `:129` only | `:126`
only |
| 「按会话定」 | present on `:129` | absent; `:127` reads 「⛔ 不按会话定」 |
| every-write read-back | absent | `:129` 「类只认每次写回读的 …」 |
| consequence row | absent | `:131` and `:132` |
| `wc -l` | 463 | 465 |
| widest line | 120 B | 120 B, zero lines over 120 B |

Firing control — `rest-channel.md` is untouched and still carries the
live route:
`grep -n 'ccr/auto_merge'
.claude/skills/pm-dispatch/references/rest-channel.md`
still answers `:50` and `:51`, byte-identical. `git diff --stat` against
the merge
base is the one file, 9 insertions and 7 deletions.

Ratchet, both readings, quoted from the gate itself:

```
✓ check-skill-line-ratchet: .../platform-readings.md is 465 lines (ceiling 466; headroom 1).
✓ check-skill-line-ratchet: .../platform-readings.md: widest table row is 0 bytes (pin 0; headroom 0).
```

`node scripts/pm/dispatch-gates.mjs --commands THE-FILE` derived 16
families; all
16 were run, every one at exit 0, and reconciled with `--ran`:
`✓ dispatch-gates --ran: 16 derived famil(ies) accounted for — 16 run, 0
NOT-MEASURED`.
Outside that derivation I also ran `pnpm check:pm-settings-deny-roster`
(its roster sits under
`.claude/`, so its silence would not have been evidence in either
direction) and
the path face `node scripts/pm/check-governed-merges.mjs --test
THE-FILE`, which
answers GOVERNED as expected.

No changeset: nothing versioned moves. `.claude/**` ships in no package
`files[]`.

## Landing

This diff touches `.claude/**`, a governed surface (Prime Directive
#14). Every
governed path lies under `.claude/skills/pm-dispatch/references/`, so
the landing
tier is the skills seat's in-seat review at `CONTRACT_REVIEW_TIER`
rather than the
maintainer's word. **This PR stays DRAFT.** I requested no reviewers,
touched no
ccr route, armed no auto-merge and flipped nothing.

## 维护者速读(草稿)

**改了什么** — 派发座位的平台事实表改了两处。一是删掉三条、改写两条教座位去调一个已被
锁 1 禁掉的 MCP 入队工具的规则,活路线的写法本来就在 `rest-channel.md`。二是把「REST 写
的身份按会话固定」这条改成实测的样子:身份跟 Claude Code 账号走,一次会话中间会变,每次
写都要自己回读一次。

**为什么改** — 这两条都是写着的事实与实测不符。前者让座位学一个它调不到的工具;后者更贵:
座位的耐久性判断(评论和卡会不会随账号被封而 404)整个建立在「署名恒为 `claude[bot]`」
上,而这一班里已经两次实测到写入落成了用户账号。四天内已经有两个分诊账号在班中被封并因此
丢掉全部书面记录,所以这条假设错的方向正是丢数据的方向。

**风险与代价(含回滚)** — 只动一个内部指令文件,不发布、不进任何包、无运行时影响。棘轮还
剩 1 行余量。回滚 = revert 这一个 commit。⛔ 本 PR 不改写入通道本身:换一个低权限账号或
改回 App installation token 是维护者的决定,这里只把事实表改成实测的样子。

**席位意见** —

**你要做的** — 目前不需要你做任何事。这是 references 层,按现行分层由技能席位在座评审后
自己落地;⛔ 不需要你的批准。若你希望把「写入身份」这件事本身处理掉(专用低权限账号,或
恢复 App installation token),那是另一张卡。

---
_Generated by [Claude
Code](https://claude.ai/code/session_01HZfg2AwVX191qCizp88gQr)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-zhuang

.claude/skills/pm-dispatch/references/platform-readings.md

@@ -38,26 +38,23 @@
 - 按名定位失败才拉全表;订阅来的 `check_suite.completed` 是唤醒不是放行读数。
 - 转 draft 不是可靠的踢队手段:两向相反读数并存,处置按最坏走。
 - 本仓转 draft 同时掉 auto-merge 与队列成员资格,不自动恢复,转正后重挂;姊妹仓曾保位照合。
-- 补救:转 draft 与 `disable_pr_auto_merge` 都做 —— 本仓 disable 单独不踢队。
+- 补救:转 draft 与卸载 auto-merge 都做 —— 本仓卸载 auto-merge 单独不踢队。
 - 出队按队列 ref 阳性探针答不在队向,加未落地;ref 缺席只作旁证,⛔ 永不承载结论。
 - `update_pull_request` 单字段调用也发送 `draft` 位,曾把治理面 draft 发进队列 ⇒ 锁 1 已拒。
 - 请审专用路 = REST `POST /pulls/{n}/requested_reviewers`,载荷只有 reviewers/team_reviewers。
 - 它不碰 draft 位 ⇒ 请审恒走它;MCP 兜底已拒。
 - undraft 单通道:席位凭据走 `POST .../pulls/{n}/ccr/ready_for_review`;MCP 兜底已拒。
 - 2026-09-12 两席实调:裸 GraphQL 会话内被拒,建议的 REST 正是 ccr 路 ⇒ 池 0 不再只能等重置。
 - ⛔ 裸 `PATCH /pulls/{n}` 传 `draft: false` 回 200 而无操作(2026-09-11);读回才作数:`GET /pulls/{n}`。
-- `enable_pr_auto_merge` 恒显式传 `mergeMethod: "SQUASH"`;不传静默退回被禁的 merge-commit = 无操作。
-- 它存的方法恒为 `merge`,不论请求了什么;REST `auto_merge.merge_method` 读回 `merge`。
+- 挂上的 auto-merge 存的方法恒为 `merge`,不论请求了什么;REST `auto_merge.merge_method` 读回 `merge`。
 - 仓库 `allow_merge_commit:false` 时同样读回 `merge`;无 REST 端点设该方法。
 - 设方法的 GraphQL mutation 不服务 agent 会话 ⇒ 席位既设不了也纠不了。
 - 它在本仓无实效:`main` 的合并队列规则带 `merge_method: SQUASH`,合并由队列执行。
 - ⇒ 落地方法读分支规则,⛔ 永不读 auto-merge 请求;树上每 PR 一个 squash 提交。
 - `auto_merge_enabled` webhook 载荷同报 `merge` ⇒ 三个载体一致也不作数,判据是落地提交的父数。
 - squash 落地重写署名 trailer:作者行按提交作者身份改拼,`Claude-Session:` 原样存活。
 - squash 的 committer date 是入队时刻,快进不改 ⇒ 落地时刻读 `merged_at`/`merged`,不读 `git log`。
-- `enable_pr_auto_merge` 对已 `mergeable_state: clean` 的 PR 照样成功,与工具描述的优雅失败相反。
 - 回显两向不可靠,空回显不等于未挂上 ⇒ ⛔ 不拿它当任何方向的证据、不为它空转。
-- 配额枯竭时 `enable_pr_auto_merge` 回成功而挂载根本没发生 ⇒ 验效果,不验回应。
 - 回读 `auto_merge` 非空本接口给不了:`pull_request_read` 与 `fields` 枚举都无该成员。
 - 效果读数 = 下列阳性探针、timeline 入队事件、最终落地;队列分支仅在场时算。
 - 队列 ref 答 BUILD 不答成员资格:`gh-readonly-queue/*` 只在存在时有意义,即有 build 在跑。
@@ -126,8 +123,13 @@
 - ⇒ MCP 限流先 `GET /user` 比 ID:同 ID 的 REST 满额不是退路,写排队到重置;异 ID 才是。
 - MCP 的读限流与写限流彼此独立,两向各有实测 ⇒ 一侧被拒 ⛔ 不推另一侧也不可用。
 - REST 档以本班 repo-scoped 探针绿为前提;403 会话改按降级梯读。
-- 容器 curl 的 REST 通道令牌按会话定:installation(`claude[bot]`)或 user-to-server(用户),core 15,000/时。
-- 令牌类只认自写回读的 `user.type`/`user.login`;`performed_via_github_app` 与 `GET /user` 两类同答。
+- 容器 curl 的 REST 通道令牌两类:installation(`claude[bot]`)与 user-to-server(用户),core 均 15,000/时。
+- 类按 Claude Code 账号定,⛔ 不按会话定:一会话内两次写之间可无席位动作地翻转。
+- 两次实测:分诊席 2026-09-15 `claude[bot]`→`os-sam`;技能席 2026-09-15→16 `claude[bot]`→`os-zhuang`。
+- 类只认每次写回读的 `user.login`/`user.type`,⛔ 不从开轮标记沿用:标记读数带日期、不站住。
+- `performed_via_github_app`、`GET /user` 与 core 限流头对两类同答 ⇒ 三者都不是判别式。
+- 用户类写绑作者:封号则其评论与卡按作者 404,标签/状态/标题/正文存活。
+- ⇒ 耐久算按令牌类重算,⛔ 不假定署名恒 `claude[bot]`;用户类下请 PR 作者复审回 422。
 - GraphQL 池 5000/时,只留给没有 REST 对应物的几件。
 - 那几件 = draft 翻转、auto-merge 挂载、语义 `/search/*`、Projects field_values、`issue transfer`。
 - 逐操作通道归属、写侧配方与队列路由三读法见 `rest-channel.md`,⛔ 不在本表复述。