diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
index a1d764e..1d28c44 100644
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -4,17 +4,20 @@
 # (pr-back). Two hard lessons baked in: (1) main is guarded by the
 # Optimus-Branch ruleset (PR-required, signed commits, zero bypass actors —
 # see the optimus-branch-ruleset landmine in STATE.a2ml), which rejects a
-# commit-back direct push; (2) the reusable requests `actions: read`, and a
-# job-level `permissions:` block REPLACES the top-level one for that job
-# (it does not merge) — so `actions: read` must ALSO be declared on the
-# job, or GitHub rejects the run at startup_failure with zero jobs and no
-# log ("requesting 'actions: read', but is only allowed 'actions: none'").
-# Three main runs died exactly that way on 2026-09-21/22 before the job
-# key was added. Merge the changelog PRs it opens
-# (squash keeps required_signatures satisfied — GitHub signs the squash
-# commit). Uses the canonical cliff.toml from standards (no local cliff.toml
-# by design — one config for the estate). CHANGELOG.adoc is retained as a
-# frozen pointer.
+# commit-back direct push; (2) the reusable's `generate` job requests
+# `contents: write` + `pull-requests: write`, and empirically GitHub checks
+# those against the CALLER's TOP-LEVEL permissions only: every working
+# caller in this repo (governance, secret-scanner) requests nothing above
+# top-level read, while every changelog run with top-level `contents: read`
+# died startup_failure with zero jobs and no log. So the write grants live
+# HERE at top level — do NOT "tidy" them into a job-level block (a job
+# block replaces top-level for that job and does not merge). Saga: #188
+# added top-level actions:read (still failed); #190 was comment-only (the
+# job-block edit was lost to a tooling race); this PR grants write at top.
+# Merge the changelog PRs it opens (squash keeps required_signatures
+# satisfied — GitHub signs the squash commit). Uses the canonical cliff.toml
+# from standards (no local cliff.toml by design — one config for the
+# estate). CHANGELOG.adoc is retained as a frozen pointer.
 name: changelog
 on:
   push:
@@ -24,15 +27,10 @@ concurrency:
   cancel-in-progress: true
 permissions:
   actions: read
-  contents: read
+  contents: write
+  pull-requests: write
 jobs:
   changelog:
-    permissions:
-      contents: write
-      # REQUIRED for pr-back: the reusable opens the changelog PR via the
-      # API. (Review T1 on #185 asked to drop this; that was correct for
-      # commit-back and wrong for pr-back — see the header.)
-      pull-requests: write
     # Pinned to standards@main as of 2026-09-21 (commits/changelog: #886).
     uses: hyperpolymath/standards/.github/workflows/changelog-reusable.yml@b77c53c85e5734756a793497845735485c9dc933
     with:
diff --git a/.machine_readable/6a2/STATE.a2ml b/.machine_readable/6a2/STATE.a2ml
index 62493fc..ab5768c 100644
--- a/.machine_readable/6a2/STATE.a2ml
+++ b/.machine_readable/6a2/STATE.a2ml
@@ -102,7 +102,7 @@ clobber-is-a-policy-violation = "absolute-zero/.claude/CLAUDE.md lists PMPL-1.0
 stray-worktree-gitlink = ".claude/worktrees/maa-ci-repair was committed as a gitlink (mode 160000) with NO .gitmodules entry. Git refuses: 'fatal: No url found for submodule path ... in .gitmodules'. This broke OSSF Scorecard AT CHECKOUT, before a single probe ran, and breaks any recursive clone. Fixed in #145; .claude/worktrees/ now gitignored."
 gitlink-shape-is-a-repeat = "639f389 (2026-02-21) left aletheia as a gitlink with no .gitmodules entry. A gitlink WITHOUT its mapping resolves to a silently-empty directory — git's quietest failure — and went unnoticed for over a month."
 dead-sha-pin-check = "aletheia's own Silver-level 'GitHub Actions SHA pinning' check used `line.contains(\"@v\") && !line.contains(\"@\")`, which is UNSATISFIABLE — every repo passed unconditionally, including this one while it carried the unpinned @master action that had broken Governance and CodeQL. Fixed with 3 tests in #144."
-changelog-startup-failure = "2026-09-21: both changelog runs on main (900c141, e6d02db) startup_failed with zero jobs and no log — the caller declared top-level permissions without actions:read while the reusable requests it (standards own caller documents this exact trap). Fixed same-day with actions:read + pr-back."
+changelog-startup-failure = "2026-09-21/22: FIVE changelog runs on main (900c141, e6d02db, 0f837de, 6620744, dc4514e) startup_failed with zero jobs and no log. #188's top-level actions:read did not help; #190 was comment-only (job-block edit lost to a batched-edit tooling race — never batch two edits to one file). Empirical rule found by comparing callers: the reusable job's {contents:write, PR:write} is checked against the CALLER's TOP-LEVEL permissions (governance + secret-scanner callers request nothing above top-level read and work; standards' own changelog caller also fails). Fixed by granting write at caller top-level with no job block."
 
 [open-questions]
 # These need a human ruling; they are not research tasks.