docs(pm): platform-readings retires the denied enqueue tool's rows and reads the REST token class per write, not per session - #18359

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 8d99e6e573206f80655ad9194e8c6b0326c4ae2b

Reviewing seat: domain:skills, in-seat review at the contract-review tier — get_session read at 2026-09-16T03:45Z: configured_model = session_context.model = last_served_model, the constant's tier, no fallback notice this round. The fold #18320 + #18334, claims 5691538423 / 5691539100, report 5691695859 on #18320 (posted through the tool; author read back os-zhuang / User — the third live instance of #18334's own finding); Clause-②: no on both claims; default-tier build (no path mandate for references/**); seat review at tier.

① Derived judgments

• Accept set / public surface: none moves — .claude/skills/pm-dispatch/references/platform-readings.md only, +9 / −7, 463 → 465 lines against merge base 1411cf2c (the branch is cut from the current origin/main); nothing published; skip-changeset read back (documentation + size/s + skip-changeset). GOVERNED by check-governed-merges --test (.claude/** ×1, exit 3 = the verdict) and the path is the references tier ⇒ in-seat landing after this record: ready through the CCR route, auto-merge SQUASH, the queue lands it.
• The change, read whole on a detached worktree of the head — hunk A ([finding] platform-readings: four rows describe MCP enable_pr_auto_merge / disable_pr_auto_merge behaviour a seat can no longer reach once lock 1 denies the enqueue class (:41 · :49 · :58 · :60) #18320): :41 re-keyed tool-neutral 「补救:转 draft 与卸载 auto-merge 都做 —— 本仓卸载 auto-merge 单独不踢队。」 (the queue fact survives, the MCP name does not); :49 (mergeMethod: "SQUASH" for the denied tool) RETIRED rather than re-keyed — rest-channel :50 owns the live body and this file's :133 forbids restating write-side recipes here (the dispatch's 「only if the register does not already say so」 resolves to: it does, in the owning file); :50 given its subject back (「挂上的 auto-merge 存的方法恒为 merge …」) because :49 was its antecedent; :58 and :60 RETIRED (a behaviour of a denied tool; :60's rule is rest-channel :52's). No history row — the deny is recorded once at rest-channel :53, and zero mentions is the stronger AFTER. Hunk B ([finding] the seat's REST writes now land as a USER account, not claude[bot] — the durability premise in platform-readings, #6015 and every Routine prompt is falsified #18334): the two token-class rows become seven at :126–:132 — the two classes with their shared core pool; 「类按 Claude Code 账号定,⛔ 不按会话定:一会话内两次写之间可无席位动作地翻转」; the two dated flips (triage seat 09-15 claude[bot]→os-sam; skills seat 09-15→16 claude[bot]→os-zhuang); the class read from EVERY write's read-back, never carried from the round-open marker; three non-discriminators (performed_via_github_app, GET /user, the core rate-limit header — the third from [finding] the seat's REST writes now land as a USER account, not claude[bot] — the durability premise in platform-readings, #6015 and every Routine prompt is falsified #18334's own table); the consequence in two rows (user-class writes are author-bound — a suspended account 404s its comments and cards, labels / state / titles / bodies survive; 「耐久算按令牌类重算」 and the PR-author reviewer 422). Every edited or new line ≤120 B (the seat measured 0 lines over); check-skill-id-lint clean (no card numbers entered the file).
• Seat re-runs on the head: check:pm-skill-ratchet 465 / 466 (headroom 1), widest-row pin 0; check:pm-skill-id-lint 27 files clean; check:skill-frame-sync coherent; check-governed-merges --test GOVERNED (.claude/** ×1); check-clause2-carriers --pair 18359 0 for BOTH cards; grep -c of the two tool names → 0; git diff --name-only origin/main...HEAD = the one file; rest-channel.md untouched (its :50–:52 still carry the live route — the firing control). Gates: 21 recorded by the dev — 16 derived, all exit 0 and reconciled by --ran (16 / 16 / 0, a DERIVED zero), check:doc-formula-expressions first NOT MEASURED then built under the verify lock and measured green; plus check:pm-settings-deny-roster 0 and the governed face at its own exit 3, outside the derivation and named as such; the closing-keyword parity check binds exactly Fixes #18320 + Fixes #18334 under both parsers.

② Semver level

Not applicable — nothing published moves; skip-changeset measured.

③ Boundary flags

open_questions: none. Two seat premises owned: the locator grep offered for :130 (installation|user-to-server) matches :129 only — the row exists with the described content, the locator was wrong; and rest-channel's direct-merge row is :54, not :55 (:55 is blank). Seven deviations answered: :50 edited beyond the four named lines — accepted (a dangling 「它」 after :49's retirement; the reading is unchanged, the subject made explicit); the consequence in two rows, not one — accepted (every one-row spelling measured 121–140 B); :129–:130 → seven rows — accepted (the dated flips and the non-discriminator list are not citable inside one 120-B row; 465 ≤ 466); the third non-discriminator (core 限流头) — accepted (measured by the triage seat on #18334: the limit header did not move with the identity); no history row — accepted (four_axes: the tightening, and rest-channel :53 records the deny); two gates beyond the derivation — accepted, additive; the formula / lint build to measure check:doc-formula-expressions — accepted. Out of scope, FILED by the seat as two cards of this lane: (1) #18360 — rest-channel :54 「REST 按会话为 claude[bot] 或用户」 carries the same falsified 「按会话」 premise this PR retires from platform-readings — a one-row in-place re-key, fold candidate with #18337 / #18339 on the same file; (2) #18361 — platform-readings :134 / :143 still list draft flips and auto-merge mounting among the operations with no REST counterpart and stand a seat down for them in a rate-limit window, contradicted by the live ccr routes (rest-channel :46 / :50) and by this file's own :47 — a judgment re-key of the GraphQL-only list, one line of ratchet headroom left. Noted, not filed: the retired :49 loosens the section's topical run around the surviving 「回显两向不可靠」 row (self-naming; no misreading). Landing: references tier — in-seat: this record, the ACCEPT on #18320 (the fold's primary, naming #18334), then ready through POST …/ccr/ready_for_review, PUT …/ccr/auto_merge SQUASH, the added_to_merge_queue reading and the queue ref, provenance on the PR; three landing readings, both cards' residue stripped, landing records on both.

Implemented-by: claude/issue-18320-platform-readings-denied-enqueue-rows-token-class
Reviewed-by: session_01HZfg2AwVX191qCizp88gQr

VERDICT: PASS

Generated by Claude Code

Landing provenance — skills seat, session session_01HZfg2AwVX191qCizp88gQr, 2026-09-16T03:58Z. References-tier landing (.claude/skills/pm-dispatch/references/**): review of record 5691731467 PASS on head 8d99e6e573206f80655ad9194e8c6b0326c4ae2b, ACCEPT 5691731638 on #18320 (the fold's primary; #18334 folded); every check on that head read complete with only success or a rostered skip at 2026-09-16T03:58Z (30 check-runs: 18 success · 12 skipped · 0 other — read with check-expected-skips.mjs --head, exit 0). The seat flipped the PR ready through POST …/pulls/18359/ccr/ready_for_review and armed auto-merge SQUASH through PUT …/pulls/18359/ccr/auto_merge; the added_to_merge_queue event reads 2026-09-16T03:58Z; the queue ref refs/heads/gh-readonly-queue/main/pr-18359-* read 1 fifteen seconds after the arm. ⛔ No approving review was written by this seat; the queue is the only landing path; merged_at and the single-parent squash are the landing readings, posted on both cards.

Generated by Claude Code