docs(pm-dispatch): name MCP rerun_failed_jobs as the one exception to the no-MCP-write invariant (#22997)

Fixes #22979
Clause-②: no

The all-seats invariant in `.claude/skills/pm-dispatch/SKILL.md` said
content writes go through the REST proxy only and no MCP write exists,
while `references/platform-readings.md` records that MCP
`rerun_failed_jobs` answers 201 and the deny roster does not carry it. A
seat reading only the invariant waited on the maintainer for a re-run
the rules allow (the measured instance: the timing-drift red on PR
#22935, re-run answered 201 once the maintainer asked). The invariant
now names the one exception on the same line, bounded by the CI-red
single re-run and the head comparison. Nothing wider: no other MCP write
becomes permitted, the content-write rule and the relay identity stay as
they were, and `CONTENT_WRITE_TOOLS` / `permissions.deny` are untouched.

## Line 92, before and after (verbatim)

Before, `origin/main` at `712361b7a` (identical at the dispatch's
`246edf5b3`; no commit touched either file in between):

```text
- 内容写只走 REST 代理,⛔ 无 MCP 写;`user.login` 记令牌不记席位,归属 = 文本里的 session ID。
- 写侧恒为 `objectstack-fleet[bot]`(AGENTS.md);节奏 ≥3 秒/笔、每账号每小时 ≤40 笔,429 即停写。
```

After, this PR at `dea49749a`:

```text
- 内容写只走 REST 代理,⛔ 无 MCP 写,唯一例外 `rerun_failed_jobs`(限 CI 红单次重跑,先核 head)。
- 写侧恒为 `objectstack-fleet[bot]`;`user.login` 记令牌不记席位,归属 = 文本里的 session ID。
```

The exception's bound points at rules that already exist: the single
re-run is the four-branch red handling in
`references/landing-operations.md` lines 30–34 (known flaky re-submitted
as is; a new signature re-run once only when the three facts hold; the
same signature bouncing again stops it); the head comparison is
`references/review-checklist.md` line 47 and
`references/platform-readings.md` lines 295–296 (a re-run of a stale
head cancels the current head's run, so a re-run is a write, not a
read).

## Why two lines, and what paid for it

Work item 1 asked for the exception on line 92 as one line and, failing
that, for the two spellings tried. The ratchet enforces a 120-byte line
cap (`MAX_LINE_BYTES = 120` in
`scripts/pm/check-skill-line-ratchet.mjs`); line 92 stood at 116 bytes
with the attribution clause alone at 69 bytes, so no honest one-line
spelling exists. The two measured:

- the dispatch's candidate 「内容写只走 REST 代理,⛔ 无 MCP 写,唯一例外 MCP
`rerun_failed_jobs`(限 CI 红规则的单次重跑,先核 head);`user.login` 记令牌不记席位,归属 =
文本里的 session ID。」 — 198 bytes;
- the tightest honest form 「内容写只走 REST 代理,⛔ 无 MCP 写(例外:单次
`rerun_failed_jobs`,先核 head);`user.login` 记令牌不记席位,归属 = 文本里的 session ID。」
— 163 bytes.

The ruling's remedy for a line that must be added is a deletion of
content in the same file, declared here, so the edit stays at net zero
lines and does not report `blocked`:

- The attribution clause (`user.login` 记令牌不记席位,归属 = 文本里的 session ID)
moves byte-identical to line 93, directly under the rule it qualified,
and shares that line with the fleet-identity clause. It is not deleted.
- Deleted from line 93: the write-pace clause 「节奏 ≥3 秒/笔、每账号每小时 ≤40
笔,429 即停写」. The rule it carried lives in `scripts/pm/write-pace.mjs`,
which every `scripts/pm/` write tool runs behind (header rules ①–③: the
3 s gap, the 40-per-hour budget, the stop on 403/429), and in
AGENTS.md's write-gate paragraph (`write-pace.mjs` serialises and spaces
every write verb fleet-wide). The pace is enforced mechanically on every
write whether or not the prose repeats the numbers.
- Deleted with it: the `(AGENTS.md)` pointer after the fleet identity.
AGENTS.md is that rule's authority (every GitHub write leaves through
`scripts/pm/`, as `objectstack-fleet[bot]`),
`references/rest-channel.md` line 10 restates it, and SKILL.md's
priority line already ranks AGENTS.md above this file. With the pointer
kept, line 93 reads 121 bytes.

If the seat or the maintainer would rather keep the pace clause in the
main file, the alternative is to report `blocked` and have the
maintainer name the line to give up; this PR takes the ruling's
declared-deletion path instead and says so in the report.

## The other work items

- `references/platform-readings.md` is untouched: the head comparison is
legible at lines 295–296; the single re-run is a rule, not a reading,
and lives in `landing-operations.md` where line 92 now sends the reader;
tightening line 292 to carry 「单次」 measures 123 bytes without dropping 「锁
1 未禁」, which is the load-bearing half of that reading (锁 1 is the deny
list). 460/460 lines, unchanged.
- `.claude/agents/os-dev.md` is untouched: its `mcp_calls` rule stands
at line 62 (报告记 `api_writes` 与 `mcp_calls`) and line 371 (a write tool
in the list = this report is refused). The dev never re-runs CI.
- `.claude/settings.json` deny roster, lines 81–99: 17 `mcp__github__`
entries, none for `rerun_failed_jobs` or `actions_run_trigger`;
`check:pm-settings-deny-roster` reads declared = enforced (17 = 17).
`CONTENT_WRITE_TOOLS` in `scripts/pm/check-settings-deny-roster.mjs`
names neither tool. No settings change is needed to name the exception.
- The card body says the change lands Tier H; AGENTS.md Prime Directive
14 places all of `.claude/**` at Tier S, and the dispatch dispatched it
as Tier S. This PR follows AGENTS.md.

## Ratchet reading per file

| file | before | after | ceiling |
|---|---|---|---|
| `.claude/skills/pm-dispatch/SKILL.md` | 319 lines; line 92 116 B, line
93 118 B | 319 lines; line 92 117 B, line 93 110 B | 319 lines, 120 B
per line |
| `.claude/skills/pm-dispatch/references/platform-readings.md` | 460
lines | 460 lines (untouched) | 460 lines |

## Gates, at `dea49749a`

Derived with `node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack` (no paths; 1 path vs merge base
`712361b7a`): 20 commands. All 20 run with exit codes recorded; `--ran`
reconciliation: `✓ dispatch-gates --ran: 20 derived famil(ies) accounted
for — 20 run, 0 NOT-MEASURED (a DERIVED zero — all 20 recorded an exit
code and none of them is 3).` Two more named by the dispatch and outside
the derivation, also run green: `check:pm-settings-deny-roster`,
`check:skill-frame-freshness`.

One derived gate, `pnpm --filter @objectstack/lint run
check:doc-formula-expressions`, first exited 3 (prerequisite not met:
`@objectstack/formula` and `@objectstack/lint` not built). Built under
the shared verify lock (`os-verify-lock: VERDICT command-exit 0 · held
the lock 1s · waited 0s`, all four tasks cached), then re-run: exit 0.

Verdict lines as the gates printed them:

```text
✓ check-skill-line-ratchet: .claude/skills/pm-dispatch/SKILL.md is 319 lines (ceiling 319; headroom 0).
✓ check-skill-line-ratchet: .claude/skills/pm-dispatch/references/platform-readings.md is 460 lines (ceiling 460; headroom 0).
✓ check-skill-id-lint: 34 file(s) clean (pattern /#[0-9]{3,}/g).
✓ check-skill-frame-sync: the one declared copy of the decision frame is internally coherent (.claude/skills/pm-dispatch/SKILL.md; no second copy to compare — the cross-copy comparison is discharged until a second COPIES entry is declared)
✓ check-skill-frame-freshness: the decision frame in this tree is current with origin/main (fetched just now).
✓ check-governed-prose: 2 instruction surface(s) name all 6 registered governed surfaces (docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md · docs/NORTH-STAR.md) and claim no others.
✓ check-settings-deny-roster: 17 content-write tool(s) declared = enforced in .claude/settings.json (17 mcp__github__ deny entr(ies), 0 outside this gate's population and ignored).
check-nul-bytes: OK (scanned 10999 text file(s) -- 10999 tracked, 0 untracked-not-ignored; skipped 9 binary; no raw ASCII control bytes).
```

Control-byte self-scan of the edited file: zero matches. No package is
touched, so there is no build closure and no package test to owe; `pnpm
lint` stays CI's run. `skip-changeset`: `.claude/**` publishes nothing.

## Acceptance notes

- No out-of-scope finding of class a, b or c. The card's "Tier H" line
is a card-body inaccuracy (AGENTS.md says Tier S for `.claude/**`);
noted here, not filed.
- The Edit tool on the skill file was refused by the auto-mode
classifier without a reason; the same two-line change was applied as a
reviewable patch with `git apply` (the one bare-action retry the
platform readings allow), and the diff above is the whole of it.

## 维护者速读(草稿)

**改了什么**:PM 协议主文 `SKILL.md` 第 92 行,「⛔ 无 MCP 写」这条全席位不变量现在同一行点名唯一例外:MCP
`rerun_failed_jobs`,只限 CI 红规则的单次重跑,动手前先核对 run 的 head 与 PR 当前 head。第 93
行改为写侧身份 + 归属条款(归属条款原样搬过来,一字未改)。原第 93 行的节奏条款(3 秒/笔、每账号每小时 40 笔、429
即停)离开散文,仍由 `scripts/pm/write-pace.mjs`
在每一笔写上机械执行。`platform-readings.md`、`os-dev.md`、`settings.json` 三个文件都没动。

**为什么改**:规则与读数打架 —— 规则说没有 MCP 写,读数说 `rerun_failed_jobs` 回 201 且锁 1
没禁。席位按「两条细则冲突按更严的一条」等了你一次本可自己做的重跑,这是你在卡片上问的那个成本。规则现在自己说出例外,下次席位不再等人。

**风险与代价(含回滚)**:① 例外只点名一个工具,并绑定既有的单次重跑规则与 head 核对,没有放宽任何别的 MCP 写;deny 名单与
`CONTENT_WRITE_TOOLS` 原样。② 节奏数字不再出现在主文散文里,只在 `write-pace.mjs` 的头部与
AGENTS.md;所有写工具每笔都走 write-pace,行为不变,少的是一行提醒。③ 行数棘轮 319/319、字节上限 120
都守住,门禁全绿。回滚 = revert 这一个提交,两行回到原样,零数据影响。

**席位意见**:

**你要做的**:本 PR 落在 `.claude/**`,按 AGENTS.md 第 14 条是 Tier S,由席位达档复核 PASS
后走队列落地,不需要你点批准。只有一件事值得你说一句:若你不同意节奏条款离开主文,席位会改为由你指定要删的那一行,或由你决定抬一行上限。

---
_Generated by [Claude
Code](https://claude.ai/code/session_01CinRQcE6T8SvMbhH8D3NhS)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.claude/skills/pm-dispatch/SKILL.md

@@ -89,8 +89,8 @@ PM 的工作是循环:选卡 → 认领 → 派发 → 收集 → 复核 → 报
 
 - 状态只经 GitHub 标签、assignee、正文行与 `pm:seat` 座位贴读写;循环须能从全新会话恢复。
 - 用户账号仅三用:assignee、授权批准、维护者亲手;批准账号永不跑席位或作其关联用户。
-- 内容写只走 REST 代理,⛔ 无 MCP 写;`user.login` 记令牌不记席位,归属 = 文本里的 session ID。
-- 写侧恒为 `objectstack-fleet[bot]`(AGENTS.md);节奏 ≥3 秒/笔、每账号每小时 ≤40 笔,429 即停写。
+- 内容写只走 REST 代理,⛔ 无 MCP 写,唯一例外 `rerun_failed_jobs`(限 CI 红单次重跑,先核 head)。
+- 写侧恒为 `objectstack-fleet[bot]`;`user.login` 记令牌不记席位,归属 = 文本里的 session ID。
 - GitHub 上一切新内容用英文;中文只留四通道(维护者速读、轮报、裁决引文、四维分析)。
 - 裁决引文照抄不译;四维中文只管新记录,存量英文块 ⛔ 不迁移;存量中文 ⛔ 不追溯改写。
 - 一 PM 恰管一车道,一车道由一组座位管,一席一贴;PM Y 管什么恰一个答案。