docs(pm-skill): census reach: in is not ADR-0131 D9 admission; the tenancy ledger decides (#23435)

Fixes #23377

Clause-②: no

## What changes

One reading is added to
`.claude/skills/pm-dispatch/references/platform-readings.md`, section
读数陷阱 (reading traps), and one same-file restatement is deleted to pay
for it at the file's 460-line ceiling. File surface: that one file. No
`scripts/**`, no `packages/**`, no other reference.

## Before / after

**Added** (119 bytes; placed after 「⛔ 别处写下的计数值一律先复测再用。」, in the
count-is-not-mechanism cluster):

> - 租户普查 `reach: in` 只说有租户列;D9 系统写盖章只认 `PLATFORM_OBJECT_TENANCY` 的
`tenant-scoped`。

**Deleted** (was line 395, in the required-checks cluster):

> - `in_progress` 不是过;advisory 门禁红进 main 是共享损伤,照样止血立单。

**Its home**:
`.claude/skills/pm-dispatch/references/reading-discipline.md` lines
24–25. That is the reference this file's own line 3 points to (见
reading-discipline.md):

> - 放行认门禁 job 的结论(`completed: success`),⛔ 不认聚合读数。
> - advisory 门禁红着进 main 是共享损伤,任何车道发现都立即止血并立单,见 landing-operations B。

The deleted line's first half (`in_progress` is not a pass) is the
negation of line 24's positive criterion: only `completed: success`
releases. AGENTS.md Multi-agent discipline §7 also states it literally
("`in_progress` is not a pass"). The second half is line 25 nearly word
for word. Nothing in the deleted line exists only there.

Line budget: 460 → 460 (ceiling 460, headroom 0). Widest line 120 bytes,
unchanged.

## Premises, re-read on `4f81f31526` before writing

1. **The census predicate.**
`scripts/platform-object-tenancy-census.json` has `"reach": "in"` ×48
and `"reach": "out"` ×35. The predicate is computed at
`scripts/platform-object-tenancy-census.mjs:379–384`: `tenantField =
resolveTenantFieldName({ ...def, fields: registeredFields })` and
`reach: tenantField === null ? 'out' : 'in'`.
`scripts/check-platform-object-tenancy-census.mjs:305` prints the same
predicate sentence in the gate's failure text.
2. **The ledger.** `PLATFORM_OBJECT_TENANCY` is at
`packages/objectql/src/tenancy/platform-object-tenancy.ts:124`, and the
class union `tenant-scoped` / `global` / `unclassified` is at :100–106.
It has 9 entries, all `tenant-scoped`. An unlisted name is
`unclassified` by absence (:244–245).
3. **The early return.** The method is
`Engine.resolveSystemInsertOrganization` at
`packages/objectql/src/engine.ts:6699`. `system-write-organization.ts`
holds the pure decision and names that method in its header (:164). At
:6717, `if (isPlatformObjectOutOfTenantAuditScope(object)) return
undefined;` returns early. That predicate
(platform-object-tenancy.ts:261–263) answers true for a
platform-namespace object whose class is not `tenant-scoped`. No
organization is derived and nothing is refused.

Cross-reading of the two artefacts: 9 of the 48 `reach: in` objects are
`tenant-scoped` in the ledger. The other 39 are `reach: in` and take the
early return. That is the size of the trap this line names.

Context, all named without a closing verb: the ledger is the one ruled
in #13491. The two misreadings the card cites are #23284 and #23256. PR
#23340 admitted `sys_notification` to the ledger. The lift for
unclassified objects belongs to #15212. This PR is a reading for seats,
not a runtime change.

## Gates (head `0c01a9d561`, exit codes captured before any pipe)

`node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack` derived 20 commands. All 20 exited 0:

- `node scripts/check-closing-keyword-parity.mjs` · `--self-test`
- `node scripts/check-comment-mask-corpus.mjs`
- `node scripts/pm/check-governed-queue-guard.mjs --self-test`
- `node scripts/pm/check-harness-current.mjs --self-test`
- `pnpm --filter @objectstack/lint run check:doc-formula-expressions`:
the first run exited 3 (PREREQUISITE NOT MET, unbuilt). After `turbo run
build --filter=@objectstack/formula --filter=@objectstack/lint` under
`os-verify-lock.sh` (VERDICT command-exit 0), it exited 0.
- `pnpm check:agent-test-spelling` · `check:cross-package-test-inputs` ·
`check:doc-authoring` · `check:driver-memory-census` ·
`check:gitlink-declared` · `check:nul-bytes` ·
`check:pm-governed-merges` · `check:pm-half-states` ·
`check:pm-skill-id-lint` · `check:pm-skill-ratchet` ·
`check:refd-timer-probe` · `check:required-contexts` ·
`check:skill-frame-sync` · `check:watch-hint-literal`

Reconciliation: `dispatch-gates --ran` printed 「✓ dispatch-gates --ran:
20 derived famil(ies) accounted for — 20 run, 0 NOT-MEASURED」. The
ratchet line reads 「platform-readings.md is 460 lines (ceiling 460;
headroom 0)」.

Roster families I also ran: `pnpm check:pm-governed-prose` 0 · `pnpm
check:pm-settings-deny-roster` 0 · `node
scripts/check-published-list-mirrors.mjs` 0 · `node
scripts/check-skills-token-ratchet.mjs` 0. `node
scripts/check-single-claim-paths.mjs` was NOT MEASURED: it exited 2, NOT
WIRED, because it needs the PR context only the workflow supplies.

The farm (`pnpm lint`, `pnpm test`, builds) and the four type-check
lanes belong to CI.

## Acceptance notes

- The next line, 「⛔ 聚合命令同样不作判定 …」, now follows the required-set lines
and not the deleted one. Its 「同样」 still reads against
reading-discipline.md line 24's 「⛔ 不认聚合读数」. It is left untouched because
the file surface is one line.
- Landing tier: `.claude/**` is Tier S in the `GOVERNED_SURFACES`
register. The triage comment's "Tier H" is a misreading of the register.
The landing tier is read at landing by `check-governed-merges.mjs --pr`.

## 维护者速读(草稿)

**改了什么**:在 PM 席位用的「平台读数事实表」里加了一条:租户普查里的 `reach: in`
只说明找到了租户列,不说明系统写入会被自动盖上组织。会不会盖章,只看 `PLATFORM_OBJECT_TENANCY` 账本里是不是
`tenant-scoped`。为了不超行数上限,同时删掉一条已经在 reading-discipline.md 里写过的重复规则,文件仍是
460 行。

**为什么改**:同一个席位在一个班次里两次把普查读成「会盖章」,其中一次写进了裁决记录。实测普查里 48 个 `reach: in`
对象,只有 9 个在账本里是 `tenant-scoped`。其余 39 个对象上的裸系统写入,组织列落空,也不会被拒绝。

**风险与代价(含回滚)**:只改给 agent 读的内部参考文件,不进任何发布包,不影响运行时。删掉的那条规则在
reading-discipline.md 里原样保留。回滚就是 revert 这一个提交。

**席位意见**:

**你要做的**:无需决策。`.claude/**` 属 Tier S,由席位做合同档复核,PASS 后入队落地。

---
_Generated by [Claude
Code](https://claude.ai/code/session_013zGKMG1cRedVzWtqGGGZW9)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.claude/skills/pm-dispatch/references/platform-readings.md

@@ -392,7 +392,6 @@
   `Build Core` · `Governed Surface Queue Guard`。
 - ⭐ 本表的 `mustName` 声明 `statesTheSet` ⇒ 必须逐字等于注册表,加注册行不跟改本表即红。
 - ⇒ 门绿即名单逐字齐全的读数;⛔ 但数量词未钉:实测 七→六 照绿,只能手跟改。
-- `in_progress` 不是过;advisory 门禁红进 main 是共享损伤,照样止血立单。
 - ⛔ 聚合命令同样不作判定:`check:type-check-debt` 可在包级 typecheck 绿时红。
 - `check:i18n` 以 PREREQUISITE NOT MET(workspace CLI 未 build)退 3,不是漂移。
 - 退出码是字段字面值:判据取门禁印的判定行,⛔ 不取码 —— 同一脚本里一个码可两义。
@@ -401,6 +400,7 @@
 - 计数答至今发生过没有,不答机制在不在:零计数只作弱先验。
 - 判 required 集为空要读 ruleset 的 required 集本身,或看队列合并是否真在等检查。
 - ⛔ 别处写下的计数值一律先复测再用。
+- 租户普查 `reach: in` 只说有租户列;D9 系统写盖章只认 `PLATFORM_OBJECT_TENANCY` 的 `tenant-scoped`。
 - MCP `issue_write create` 落库丢掉正文尾部的署名页脚块,正文其余部分完好。
 - MCP `issue_write` update 送尾部横线加页脚块则两者同被吃掉,而调用照常回 id 与 url。
 - 建卡走 REST `POST /issues`:带页脚存活,无页脚合成恰一条(+58);回读后 `PATCH` 重送逐字节存下。