docs(pm-skill): rules-only rewrite of the readings ledger, the REST table and the eight lane job descriptions - #15641

Part of #15379
Fixes #15121
Fixes #15525
Fixes #14928
Fixes #15481

Rules-only rewrite of the readings ledger, the REST channel table and the eight lane job
descriptions, plus the three small references, under the house style the digest set: one rule
per line, at most 120 bytes measured with wc -c, plain Chinese with identifiers in backticks,
grouped under each file's own sections, each file opening with one pointer to the SKILL.md
section it details. Provenance dates, ruling citations, verbatim quotations, incident
post-mortems and rationale tails leave the corpus. Every rule already stated in the rewritten
SKILL.md (head 66338b6a) or in the rewritten seven references (head 6000e270) is cut
rather than repeated; the dedup was run against those two heads, not against origin/main.

946 to 874 lines across the thirteen — 72 lines out, and none of the thirteen grows. Bytes
fall further than lines do (the ledger alone 42,349 to 33,840), because most of the shrink is
narrative deleted out of multi-line bullets that then re-flow into single rule lines.

Angle-bracket placeholders are spelled as bare placeholder words in this body and in its
comments only, because the body sanitizer eats short angle-bracket fragments even inside
backticks. The files keep the original spelling.

The thirteen files

• platform-readings.md — 397 to 359. The readings ledger: one fact per line, the platform
  behaviour plus the operational consequence a seat acts on. The five sections keep their
  subjects and their order. Every number a seat acts on stays (the 5000/hour and 15,000/hour
  ceilings, 107 points per full list_issues, the 2,000/minute GraphQL second tier, the 15-item
  timeline window, the ~9,900 pagination offset, the 15-30 minute queue landing, the six
  required check names, the 58-byte comment footer append). How each was measured does not. Four
  folded readings land here and one no-longer-reproducing reading is restated as its current
  reading (below).
• rest-channel.md — 88 to 82. Per-operation channel ownership. The check mark keeps its
  operative meaning — this shape was executed from a gate-open seat — because two entries are
  documented-but-never-called and a reader must be able to tell them apart; its per-row dates go.
  The five non-migratable operations keep their numbering, since the readings ledger points at
  them by number. The update-branch route folded in from its own card lands on the write side.
• release-aftercare.md — 58 to 50. The five lettered duties keep their letters. Every
  operational number stays: the 9x intra-region leg spread, the server = 33 + 23 x RTT shape,
  the 200ms gate boundary, the ~15s re-draw window, the five weeks of green health checks. The
  two-day operations log that produced them does not.
• true-green.md — 33 to 32. Per-repo canonical invocation, the gates a CI-log grep cannot
  see, the local preflight. One fact per line per repo.
• compile-surfaces.md — 26 to 24. Keeps its lookup table. The six surface rows are
  unchanged byte for byte, which is what keeps the widest-table-row pin at 352 as ruled; only the
  thawed row loses its two dates and the retired out-of-scope wording, and the prose around the
  table loses its measurement provenance.
• lanes/cli.md — 31 to 29. Scope, standing promises, in-seat judgement. The
  dispatch-to-draft-PR baseline number is cut: SKILL.md's collection section already rules that
  the baseline is read from the lane's own record and is never a constant in the text.
• lanes/devx.md — 39 to 38. Scope with the SUBJECT boundary intact, the two
  release-owned channels, the changeset split by publish surface, and the gate-self-description
  rule with its anti-no-op limb.
• lanes/director.md — 72 to 72. The heaviest narrative in the set. The charter quotation
  becomes the authority line it grants; the supersession ledger recording which ruling moved
  which duty on which day is gone entirely, and what survives is the current allocation as
  rules. Four duties keep their numbering and every never-line.
• lanes/engine.md — 36 to 32. Scope, the driver-conformance ledger promise, and the five
  in-seat readings including the three-independent-implementations count.
• lanes/hotcrm.md — 57 to 53. The two charter quotations become the four rules they
  authorise: platform capability implemented upstream, the exemplar shows platform capability,
  no requirement sprawl, dual-edition compatibility. Nothing in scope moves. The changeset-flow
  tombstone (an older sentence that was false) is dropped and only the true rule kept.
• lanes/services.md — 28 to 27. Scope with the security-boundary human floor, the
  ablation promise, the disclosure discipline, the two serialisation readings.
• lanes/skills.md — 35 to 33. Its tier line now names tiers instead of model identifiers,
  which is where the house style and the file disagreed.
• lanes/spec.md — 46 to 43. Scope, the in-seat split criteria, the standing promises
  including the pre-approved ledger-append class, and the branch-information test, which keeps
  its English wording because the wording is the criterion a reader tests against.

The four folded cards

• finding(pm-tooling): list_issues labels is a UNION, not an intersection — every multi-label board reading is wrong, and wrong in the direction that looks right #15121 — the MCP list_issues labels array is a union: a multi-label totalCount is the
  size of the disjunction and is always at least each single label's, never an intersection. The
  canonical workaround (count each label singly, derive the intersection by inclusion-exclusion,
  and read a negative or implausible implied intersection as the model being broken) lands in the
  ledger's readings-trap section together with the OR-versus-AND channel contrast.
• [finding] the CCR container GitHub egress is proxy-credentialed: header-less reads carry a session identity, a caller Authorization header is overridden, and a 2026-09-02 platform reading no longer reproduces #15525 — from a CCR container the GitHub egress is proxy-credentialed: a header-less REST
  read answers 200 with a session identity at a core ceiling of 15000, a caller-supplied
  Authorization header is overridden by the proxy, and a dead HTTPS_PROXY port does not cut
  the network. The operational consequence is written as the rule: token-scope conclusions drawn
  inside the container do not transfer to a session whose egress is not proxied. The standing
  line that the clause-2 checker's --pair answers 403 and exits 3 without a token no longer
  reproduces; it is restated as its current reading (exit 0 with and without a token,
  same cause) rather than kept with a since-then tail.
• [finding] REST update-branch is a PM-usable merge-main route (full SHA required; 422 when the base has not moved); job-log download is proxy-refused, annotations suffice #14928 — PUT /repos/{o}/{r}/pulls/{n}/update-branch works from a PM seat and is the
  zero-file-write way to merge origin/main into a PR head, producing a real merge commit with
  no rewrite; expected_head_sha must be the full 40-character SHA (a short SHA answers 422);
  and a base that has not moved answers 422 with no new commits on the base branch, which is
  nothing to do rather than a failure. Those three land on the REST table's write side. The
  job-log endpoint being refused by the egress proxy (CONNECT 403) and the check-run annotations
  endpoint carrying the exit code and the failing command land in the ledger, beside the
  existing rule that the assertion text is only in the run-log archive.
• [finding] the GitHub MCP enable_pr_auto_merge tool records merge_method: merge whatever method a seat asks for — harmless here only because the main merge-queue ruleset squashes, so the platform-readings table should say which reading is authoritative #15481 — MCP enable_pr_auto_merge stores method merge whatever was requested (REST
  auto_merge.merge_method reads back merge even where the repository sets
  allow_merge_commit:false), no REST endpoint sets the method and the GraphQL mutation is not
  served to agent sessions, so a seat can neither set nor correct it. It is inert on this
  repository: the main merge-queue rule carries merge_method: SQUASH and the queue performs
  the merge. The rule written is the one a seat acts on — the landing method is read from the
  branch rule, never from the auto-merge request.

Ratchet

The thirteen CEILINGS rows in scripts/pm/check-skill-line-ratchet.mjs are re-pinned down
at the landed counts (359, 82, 50, 32, 24, 29, 38, 72, 32, 53, 27, 33, 43), each with a one-line
note in the map's own convention. Nothing is raised and no other row moves. Ceilings across the
thirteen fall 956 to 874. Every MAX_TABLE_ROW_BYTES pin is untouched — the twelve zeros stay
zero because those files carry no table row, and compile-surfaces.md stays 352 because its
widest row is unchanged byte for byte.

One maintenance edit inside the declared cross-file move, and the gate's own header prescribes
it. The move declared on platform-readings.md carries was: 314 plus two ruledRaises
records totalling 73. Lowering the destination to 359 leaves it only 45 above was, so the two
records together read as an over-claim and crossFileMoveVerdict refused them by name. The
header's remedy for exactly this is that a ruled raise since given back is spent and its record
is retired. This rewrite handed back 38 of those 73 lines, so 35 still stand and only one record
can remain. The third-increment record is retired and the intake record kept, which is the
conservative direction rather than a preference: 34 declared against 35 actually standing prices
the move at +11 for a raise that took +10, while keeping the +39 instead would price it at +6,
and under-pricing the move is the failure the header warns about. was, sources and their
pre-move ceilings are untouched, and both rulings are still quoted beside the ceiling above.

Gate line, verbatim: cross-file move into .claude/skills/pm-dispatch/references/platform-readings.md: +11 (314 to 359, less 34 lines of ordinary ruled raise) against a net source decrease of 20 (lanes/cli.md 35 to 29, lanes/services.md 30 to 27, rest-channel.md 93 to 82); authorised by the ruling this map cites.
and declared cross-file moves: 1, total ceilings down 9 lines.

Hygiene, before and after

Per file, measured on the tree: dates matching 2026-0M-DD · corner-quote characters · non-table
lines the ratchet's own scanner reports over 120 bytes.

The third column is 0 on both sides everywhere because the gate reports non-exempt lines, and
compile-surfaces.md's seven over-length lines are table rows while hotcrm.md's five were two
blockquote lines, two lines inside a multi-line corner-quoted ruling and one carrying a
line-anchored Blocked-by: example — all structurally exempt. Measured raw instead, ignoring the
exemptions, those twelve over-length lines are now zero in both files apart from
compile-surfaces.md's seven pinned table rows: the rewrite removed every construct the
exemptions were covering rather than leaning on them.

Also zero across all thirteen after the rewrite: warning and star glyphs, issue or PR numbers in
operational text, decision-frame fingerprint phrases, and model identifiers.

Gates run

Family derived on the tree with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack,
which read the change set from the merge base itself: 14 paths, 35 runnable commands. All 35 run,
all 35 green. Each gate's own verdict line was read; the roll-up:

Two results that are not a plain pass and are recorded as such:

• node scripts/pm/check-governed-merges.mjs --test with the 14 paths → exit 3, which is the
  expected verdict, not a failure: governed-surface predicate: 13 of 14 path(s) hit the register (5 surfaces, repo-agnostic). / GOVERNED — a human merge is the review record for this PR /
  .claude/** x13 / paths not on the register: scripts/pm/check-skill-line-ratchet.mjs.
• pnpm --filter @objectstack/lint run check:doc-formula-expressions answered exit 3,
  PREREQUISITE NOT MET on its first attempt (@objectstack/formula not built, then
  @objectstack/lint not built) — nothing was measured, so that attempt is not counted as a
  pass. After building both through the shared verify lock it ran clean: check:doc-formula-expressions: 22 record-scoped formula example(s) across 428 files / 1371 TS blocks judged clean.

Whole-repo pnpm lint was run, not narrowed — through the repo's lock wrapper,
bash scripts/pm/os-verify-lock.sh -c 'pnpm lint', which printed
VERDICT command-exit 0 · held the lock 103s (1m43s) · waited 0s. The command it ran is the
repo's own eslint . --no-inline-config over the whole tree, so no narrowing claim is needed.

Identifier sweep. Every backticked token in the thirteen files at 6b8c67778 (436 spans) was
checked against the thirteen rewritten files (413 spans), the rewritten SKILL.md and the
rewritten seven references. Six misses were load-bearing spellings rather than narrative and were
restored inside existing lines, so no ceiling moved: the unexpanded matrix placeholder, the dev
scratch directory name, the full large-datasets pagination message, the merge-main command that
is the only fix for a stale rerun, the repository setting behind the auto-merge method read-back,
and the fully qualified spec zod path. The remaining eighteen are in Table 2.

All gate readings above were taken after the final commit, at ddf47bdd7
(git rev-parse --short HEAD), which is this PR's head.

Table 1 — every surviving rule line (part A: the twelve files other than the ledger)

671 rule lines across the thirteen (340 of them the ledger, which continues in part B, the first
comment on this PR). A rule line is one bullet or numbered entry, wrapped continuation lines
joined; the count rises while the file line count falls because the old files carried multi-line
bullets and the new ones carry one rule per line. stripped is derived mechanically by matching
each new rule against its nearest old rule and naming what the old text carried and the new one
does not: date, quotation, marker, merged (two old rules collapsed into one), narrative
(the old text was materially longer), reworded, unchanged, or new (no old rule matched — the
folded-card facts and rules split out of a longer bullet).

Table 2 — passages left out, by class and file

Everything below is content that leaves the corpus rather than being re-worded. The rule it
supported survives in the line named beside it unless the row says the rule itself was a
current-state value or a tombstone.

Table 3 — literal spellings kept because something machine-readable pins them

Table 4 — conflicts found, and the reading taken

Generated by Claude Code

Generated by Claude Code