docs(skills): rest-channel records that the advisory_report 403 did not reproduce, with the seat retry rule (#30132)

domain:skills#1 · huangyiirene · session_01J8VVAnMUWA9rufXzFaEh4J

<!-- claude-projects-attribution: {"github_login":"huangyiirene"} -->
_Requested by **Irene** · [project
thread](https://claude.ai/code/project/chan_01TJXtQ1tVD26ecLDZxFS67x?thread=cmsg_01TJXtQ1tVD26ecLDZxFS67xKrdoy3yoTTsnUokgtw4ZPB)_

Fixes #29402

Supersedes #30130 (same change; that branch's commit message failed
`check-commit-card-trailers`).

Clause-②: no
Metadata-protocol: none

The maintainer waived the model-tier mandate while that tier had no
quota; this PR was developed below it.

## 维护者速读

- 改了什么:`rest-channel.md` 写侧公告两行重写:L50 保留 main 的措辞并加 `advisory_read`,L51
记 `advisory_report` 403 复测不复现与席位规则。
- 为什么改:卡上复测(评论 6632996128)经中继新报一次无 403,11-02 那批 403
不复现;单次隔日成功也合账号日限,故只记不复现。
- 风险与回滚:Tier S `.claude/**` 文字,行数不变(82,上限 82),不进任何包,`skip-changeset`;回滚即
revert。
- 先看:L50-51 两行。
- 需要你做的:无;席位 contract review PASS 且检查全绿即落地。

## What changes

`.claude/skills/pm-dispatch/references/rest-channel.md`, write side, two
lines rewritten, none added:

- **L50** keeps main's wording from #30135 (`等操作`, `发布亦经中继`), now also
names `advisory_read`, and keeps the pointer to `security-findings.md`.
The old L51's detail (one-time key in the seat process, ciphertext back,
`--reveal` prints plaintext) already lives in `security-findings.md` L21
and `lanes/security.md` L19, so folding it in loses no rule.
- **L51** records the reading and the seat-side rule in one line: a
later `advisory_report` 403 did not reproduce on re-test (`复测不复现`; a
single success on a later day is also what the daily limit predicts, so
the line claims no more); the seat reads a 403 against the two causes
`security-findings.md` L22 already names (the advisory write grant and
the per-account daily limit on private reports), retries once on a later
day, and never switches account.

`security-findings.md` is not edited: the reading does not make L22
wrong, it only says the 11-02 run did not hit either cause as a standing
state.

**Ratchets.** Line count 82 → 82 (ceiling 82, the added rule line is
paid by folding L51 into L50). Widths: L50 119 bytes, L51 115 bytes,
under the 120-byte cap.

## Why

The card's last bullet. The 11-02 runs answered HTTP 403 on every
`advisory_report` after the first. On 2026-11-04 a fresh report through
the relay succeeded with no 403, and the maintainer confirmed the lane
App shows as reporter on it and on the reports of the last two days
(card comment 6632996128). The seat needs a written rule for the next
403 so it neither resends into a refusal nor reaches for another
account.

## Verification

Head `6492c26c`: two commits plus a hand merge of `origin/main` (no
rebase, no amend). The merge resolves the L50-51 conflict with #30135,
which had rewritten L50; L51 is unchanged.

<details><summary>Local gates on 6492c26: 17 derived, 17 run with exit
0, 0 NOT MEASURED (`dispatch-gates --ran`)</summary>

- `node scripts/pm/dispatch-gates.mjs --commands` derived 17 commands
for the one changed file. All ran after `pnpm install
--frozen-lockfile`, each with its exit code captured before any pipe.
`@objectstack/formula` and `@objectstack/lint` were built first, which
`check:doc-formula-expressions` needs.
- All 17 exited 0, among them `check:pm-skill-ratchet`,
`check:pm-skill-id-lint`, `check:skill-frame-sync`,
`check:doc-authoring` and `check-comment-mask-corpus.mjs`.
- `--ran` printed: `17 derived famil(ies) accounted for — 17 run, 0
NOT-MEASURED (a DERIVED zero — all 17 recorded an exit code and none of
them is 3)`.
- `node scripts/check-empty-changeset.mjs --base origin/main`: exit 0.
No changeset: `.claude/**` ships in no package, so `skip-changeset`.
- `node scripts/check-commit-card-trailers.mjs --range
origin/main..HEAD`: exit 0, run before the push.

</details>

## Human Minimum

- [x] 1. Schemas start as Zod; `packages/spec` holds no runtime logic.
(Not touched.)
- [x] 2. Every name I added uses the casing for its kind. (No names
added.)
- [x] 3. No formatter ran.
- [x] 4. One issue, one branch off an up-to-date `main`, one pull
request.
- [x] 5. A change that publishes carries a changeset, and both
declaration lines are filled in here and in the changeset. (Publishes
nothing.)
- [x] 6. `packages/spec` touched: its generated artifacts are
regenerated and committed. (Not touched.)
- [x] 7. No hand edits to `content/docs/references/`,
`packages/*/CHANGELOG.md` or `content/docs/releases/`.
- [x] 8. Title, body and comments are in English. (The 维护者速读 section is
Chinese, per the lane template.)
- [x] The *Before Submitting* list in CONTRIBUTING.md is done.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01J8VVAnSGyRU8EkF8acg337

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.claude/skills/pm-dispatch/references/rest-channel.md

@@ -47,8 +47,8 @@
 - ✓ 请审 `POST .../pulls/{n}/requested_reviewers`(Tier H 归中继 op)· 开 PR `POST .../pulls` 带 `draft=true`。
 - ✓ `origin/main` 合进 PR head:中继 op `pr_update_branch`(`pull` + 40 位 `expected_head_sha`),真合并提交。
 - 挂子卡走中继 op `sub_issue_add`/`sub_issue_remove`(`issue` 父号,`sub_issue` 子号),回读父列表。
-- 公告经中继 `advisory_create`(首选)等操作,发布亦经中继;规则住 `security-findings.md`。
-- 读公告经中继 `advisory_read`:席位进程一次性密钥,密文回传;`--reveal` 才印明文到 stdout。
+- 公告经中继 `advisory_create` 等操作与 `advisory_read`,发布亦经中继;规则住 `security-findings.md`。
+- `advisory_report` 403 复测不复现:按 `security-findings.md` 两因读,隔日重试一次,⛔ 不换账号。
 - ✓ 落地经中继 `node scripts/pm/fleet-write/dispatch.mjs --repo O/N --actions-file F`;`--via dispatch` 同载。
 - ✓ 启动 run 走 op `workflow_dispatch`:解锁物是白名单 run 才启;入表只经 workflow 自己的 PR。
 - F = `[{"op":"workflow_dispatch","workflow":"release.yml","ref":"main","inputs":{"refresh_version_pr":true}}]`。