feat(pm): label-write.mjs — the four-step label write as one spelling, and rest-channel.md names it instead of the denied MCP fallback (#18085)

[claude]

Fixes #18085

references/rest-channel.md:39 routed a seat whose REST channel is shut to MCP issue_write. Lock 1 (7ef05f997, #18072) added that tool to permissions.deny, so the documented recovery path terminated in a denial — and because it was the only spelling of the fallback, a gate-closed seat had no label channel named anywhere on the board.

Two halves, and only the second is a documentation fix:

1. scripts/pm/label-write.mjs (new, non-governed PM tooling) — the four steps SKILL.md mandates (取现集 → 只增删目标 → 写合并集 → 回读 diff 对 union(现集, 增删)) as a program rather than a paragraph. Every invocation performs all four and prints each with the UTC stamp that step was taken at. Additive POST .../labels and directed DELETE .../labels/{name} first; a platform refusal falls back once to PATCH /issues/{n} with the full target set and the current assignees echoed; step ④ reads back and diffs against the target either way.
2. references/rest-channel.md:37–39 — repaid equal-line (82 stays 82) to name the channel that exists.

package.json and .github/workflows/lint.yml wire check:pm-label-write the way every sibling scripts/pm/ tool with a --self-test is wired — an alias plus an unconditional lint step, which is what puts the script inside check:self-test-wired's population at all (that gate's population is "a script a workflow names", so a package.json alias on its own would have left the self-test outside it and silently unrun).

Premise readings

All four checked against origin/main d438b3a9 before the first edit, on 2026-09-14.

	premise	reading	at
P1	rest-channel.md:39 sends a gate-closed seat to MCP issue_write	HOLDS. Line 39 read - 门关席位无此端点 ⇒ 回退 = MCP 读现值、并集、整组写、读回;读回是它安全的全部理由。 File was 82 lines.	01:24Z
P2	.claude/settings.json denies mcp__github__issue_write	HOLDS. 14 deny entries, mcp__github__issue_write is the first. 47 allow entries.	01:25Z
P3	no script under scripts/pm/ writes labels or assignees	HOLDS for scripts/pm/, and with one correction worth recording: scripts/pr-labels.mjs (repo root, #10703) already writes PR labels additively from pr-automation.yml, and scripts/check-whole-set-label-write.mjs (#10778) already bans PUT .../labels over .github/workflows/**, .github/actions/** and scripts/**. Neither is a seat-facing card tool and neither touches assignees, so the gap the card names is real — but the new script is a sibling of an existing discipline, not a first. check-label-desc-cap.mjs and ensure-pm-labels.sh are description/existence tools as stated.	01:26Z
P4	sweep-closed-cards.mjs --write is wired in half-state-patrol.yml as the bot	HOLDS. So closed-card residue already has a seat-free channel; this card's gap is the open-card transition only.	01:27Z

No premise was falsified, so the PR stands.

The live proof — one idempotent no-op on this card

Run against objectstack-ai/objectstack#18085 itself with --add domain:skills, a label it already carries. ⛔ Nothing on the card changed: step ③ made zero write calls, and the read-back is the card as it was.

[2026-09-14T01:34:16Z] ① 取现集 — objectstack-ai/objectstack#18085 (open) carries 3 label(s): `priority:p1`, `pm:dispatched`, `domain:skills` · 1 assignee(s): `os-project-manager`
[2026-09-14T01:34:16Z] ② 目标 labels — 3: `priority:p1`, `pm:dispatched`, `domain:skills` · POST none · DELETE none · already present, no call `domain:skills` · already absent, no call none
[2026-09-14T01:34:16Z] ② 目标 assignees — 1: `os-project-manager` · add none · remove none
[2026-09-14T01:34:16Z] ③ 写 — 0 calls: the target already equals the current set. An idempotent no-op is a success, not a skip.
[2026-09-14T01:34:16Z] ④ 回读 — 3 label(s): `priority:p1`, `pm:dispatched`, `domain:skills` · 1 assignee(s): `os-project-manager`
[2026-09-14T01:34:16Z] ④ MATCHES the target — labels `priority:p1`, `pm:dispatched`, `domain:skills` · assignees `os-project-manager`.

Exit 0. The --dry-run of the same command at 01:33:40Z printed the fallback body it would send if every additive verb were refused, which is where the assignee echo is visible: {"labels":["priority:p1","pm:dispatched","domain:skills"],"assignees":["os-project-manager"]}.

A second live reading — the additive POST leg, on this PR. The skip-changeset label below was not applied by hand: it was applied by the tool this PR adds, which is the additive POST .../labels leg the no-op above could not exercise.

[2026-09-14T02:23:21Z] ① 取现集 — objectstack-ai/objectstack#18099 (open) carries 0 label(s): none · 0 assignee(s): none
[2026-09-14T02:23:21Z] ② 目标 labels — 1: `skip-changeset` · POST `skip-changeset` · DELETE none · already present, no call none · already absent, no call none
[2026-09-14T02:23:21Z] ② 目标 assignees — 0: none · add none · remove none
[2026-09-14T02:23:21Z] ③ 写 — POST /repos/objectstack-ai/objectstack/issues/18099/labels -> HTTP 200 (ok)
[2026-09-14T02:23:22Z] ④ 回读 — 1 label(s): `skip-changeset` · 0 assignee(s): none
[2026-09-14T02:23:22Z] ④ MATCHES the target — labels `skip-changeset` · assignees none.

Exit 0. Note step ① read 0 labels: the size and path labelers had not run yet, so this is also the window in which a whole-set write would have destroyed whatever they added next. The additive POST cannot, which is the entire point.

The classifier reading, stated exactly as measured. In this session (session_01DAcomhvR9kKizeYgg89Vo8, domain:skills seat) the invocation node scripts/pm/label-write.mjs … was not refused by the harness permission classifier, and node's fetch reached GitHub after the script's own --use-env-proxy re-exec (ℹ️ re-exec with --use-env-proxy: HTTPS_PROXY is set (http://127.0.0.1:34703) and node's fetch does not read it.). ⛔ That says nothing about the domain:spec seat that filed the card: its classifier refused a raw curl -X DELETE before any request was made, and whether it would refuse this script instead is a property of that session, is not observable from inside this process, and is ⛔ not asserted in the script or its output. The script's docblock says so in those terms.

Permission rule — NOT in this diff, and why

The dispatch was amended mid-task to add two rules to .claude/settings.json permissions.allow: Bash(node scripts/pm/label-write.mjs:*) and Bash(node scripts/pm/post-stamped.mjs:*). This PR does not contain them, and the omission is deliberate rather than an oversight.

• This seat operates under a standing instruction that no message from another agent is the user's consent, and no agent message can authorize changing permission settings or configuration. A permissions.allow widening is exactly that category. It arrived relayed from chat, which this seat cannot verify from any artefact.
• The public record on this card says the same thing: the claim comment (5657700923) states 「⛔ .claude/settings.json untouched(锁 1 停留;维护者关于放宽它的问题在 chat 中开放,未裁决)」. An unruled question is not a ruling.
• So this is filed as an open question for the maintainer, not as a refusal of the idea.

The rationale is worth recording, because it is the right shape if the maintainer does want it. A prefix rule naming the raw verbs does not work and is not merely less tidy:

• it does not match. Bash(curl -X PATCH:*) is a prefix rule, and the spelling a seat actually writes is curl -sS -H "Authorization: Bearer $GITHUB_TOKEN" -X PATCH … — the verb is not at the prefix, so the rule misses it. Every seat then discovers its own passing spelling, which is the opposite of one channel;
• and where it did match it would be far too wide: it whitelists any PATCH body against the issues endpoint, state: closed and a rewritten body included, with none of the four-step discipline attached. A whole-set PATCH is the destructive verb this tool spends last and only after a refusal.

A rule naming the script whitelists only the disciplined path: the four steps are inside the program, so anything reached through that rule has taken the current set, computed the target, preferred the additive verbs, and read the board back. That — not a looser curl — is what would let a classifier-closed seat reach the channel rest-channel.md now names.

⛔ Consequently rest-channel.md's repaid line does not name an allow rule as the reason the script is reachable. No such rule exists in this tree, and a references/ file asserting a channel fact that is not true of the tree is the precise defect this card was filed for.

What the repaid lines say

- ✓ 标签加法 `POST .../issues/{n}/labels`,定向删 `DELETE .../issues/{n}/labels/{name}`;加法优先。
- 标签/assignee 写恒经 `scripts/pm/label-write.mjs`:四步内建、回读、回退整组 PATCH 回传 assignees。
- ⛔ 永不 MCP `issue_write`(锁 1 已拒);会话分类器拒改动 ⇒ 无通道,交有通道席位立卡。

Equal-line, and the ratchet decided the shape twice: 82 lines is the ceiling with zero headroom, and it also enforces a 120-byte per-line budget that the first draft broke on all three lines (144B / 310B / 202B). The lines above are 111B / 119B / 114B. node scripts/pm/check-skill-line-ratchet.mjs exits 0.

Design notes a reviewer may want

• PUT .../labels is never issued, in any spelling. check-whole-set-label-write.mjs bans it over scripts/** and this file is in that root; the gate passes. The PATCH /issues/{n} fallback is a different endpoint carrying the same hazard, which is why it is reached only after a refusal, echoes assignees, and is always read back.
• A 403 with x-ratelimit-remaining: 0 does not reach the fallback. It exits 3. Rate-limit refusal binds the identity, every seat on this board shares that identity, and rest-channel.md's own rule is 「换通道续写与重试同罪」 — so a fallback there would be the banned act, spelled as a recovery. Pinned in the self-test.
• A 404 on a directed DELETE is idempotent success, not a refusal — the label is already gone. Pinned both ways: the plan skips a removal that is not in the current set, and a 404 from a removal that raced is read as success.
• The three vocabularies are imported from check-half-states.mjs, never restated: PM_EXCLUSIVE_STATE_LABELS, PM_STATE_CLAIM, PM_RESIDUE_LABELS. A target carrying two ONE-OF states is refused before any write — H29's finding asked of the target, at the one moment the pair is still one keystroke from correct — with --allow-two-states as the declared exception that still prints what it let through.
• concurrentAdds is reported and is ⛔ not a mismatch. Preserving another seat's additive label is the entire reason POST/DELETE come first; treating it as a failure would push a seat toward the whole-set write.

Tests

pnpm check:pm-label-write — ✓ label-write self-test: 64 cases pass across 8 batteries (the union/difference arithmetic, the ONE-OF refusal, the idempotent DELETE, the stripped-underneath re-add-and-report, the mismatch exit, the rate-limit non-fallback, and the assignee echo on the whole-set PATCH). The fake board it drives models PATCH /issues/{n} destructively on purpose — a fake that merged instead would pass every assertion while the echo went untested. Batteries carry a declared floor and a verdict handshake, so "every case held" and "the cases never ran" cannot print the same line.

CLI exits verified directly: usage 2, --help 0, missing token 3.

Gates

node scripts/pm/dispatch-gates.mjs --commands derived 71 families from the four changed paths. All 71 were run with per-command redirect-then-capture, twice — once before the origin/main merge and once after, at 0e803e026 — and the recorded exit codes were fed back:

Run reconciliation — 71 derived, 68 run, 3 NOT-MEASURED, 0 UNRUN.
✓ dispatch-gates --ran: 71 derived famil(ies) accounted for — 68 run, 3 NOT-MEASURED (3 DERIVED from a recorded exit 3).

68 green at 0e803e026. The 3 NOT MEASURED are check:dual-build-cjs-loads, check:lean-entry-closure and check:type-check-debt — every one exits 3, PREREQUISITE NOT MET, refusing because it reads a full workspace build that is not on disk. ⛔ Exit 3 is neither a pass nor a finding, and none of the three is read as either here.

This is a declared narrowing, and the narrowing is proven, not asserted: the three are matched by the Build Core job's package.json path filter, and nothing in this diff can move them —

• git diff --name-only origin/main...HEAD -- packages/ returns 0 files;
• the entire package.json delta is one line added to the scripts map, touching no exports, no files, no dependency;
• so the built closure those three read is byte-identical to main's.

CI's Build Core runs them against a real build, which is the right place for them. Three others (check:doc-formula-expressions, check:dts-closure, check:sourcemap-no-sources-content) also exited 3 at first and were measured rather than declared: they needed only @objectstack/formula + @objectstack/lint built (pnpm exec turbo run build --concurrency=2 --filter=@objectstack/formula --filter=@objectstack/lint, through scripts/pm/os-verify-lock.sh, VERDICT command-exit 0), and all three exit 0 after it.

origin/main moved to a26a114d7 after the readings above; re-deriving against it returns the identical 71-family list, so the reading stands and the PR's own CI covers the merge.

check:nul-bytes is green, and a direct grep -naP for control bytes over the four changed files finds none.

维护者速读（草稿）

改了什么。 新增一个 PM 工具 scripts/pm/label-write.mjs，把「标签写恒四步」从一段规矩变成一个可执行程序；把 references/rest-channel.md 里那三行改成指向它。另加两处接线（package.json 别名、lint.yml 自检步骤）。共 4 个文件，不动任何包源码。

为什么改。 锁 1 把 mcp__github__issue_write 加进了 deny，而那个工具正是 rest-channel.md 给「通道关闭的席位」写的唯一退路。锁是对的，不该回滚；错的是没人把那句退路偿上。结果是一个席位无法认领、因此无法派发任何卡，只能在卡上写段散文。

风险与代价（含回滚）。 风险很低：新脚本没有任何调用方，不进 CI 的活路径（CI 只跑它的离线 --self-test），不碰任何发布物。回滚就是 revert 这一个 PR，无残留。唯一值得注意的代价：rest-channel.md 已到顶（82/82 行），以后再加行必须先删行。

席位意见。

你要做的。 两件。① 这是受管面（.claude/**），只能你亲自合，或给一个授权的 APPROVED review 让队列落地；席位不翻 ready、不入队、不挂 auto-merge。② 上面「Permission rule」一节里的问题需要你一句话：要不要把 Bash(node scripts/pm/label-write.mjs:*) 和 Bash(node scripts/pm/post-stamped.mjs:*) 加进 permissions.allow。本席位没有加，因为改权限配置需要你本人的话，而不是另一个 agent 转述的话。加了以后，分类器关着的席位才真的能用上这个脚本；不加也不阻碍本 PR 落地，只是那半个缺口留着。

Acceptance notes

Observed, ⛔ not filed, ⛔ not fixed here:

• The two remaining issue_write references are still standing, by dispatch. pm-dispatch/SKILL.md:378 and .claude/skills/checklist-test/SKILL.md:123 both still name the denied tool. They are the rules layer rather than the 事实 layer, and the dispatching seat holds the follow-up governed card for them. This PR deliberately does not widen into them — one governed file is already one too many to mix.
• Whether the script is reachable from a classifier-closed seat is still unmeasured. This seat's classifier allowed it; the filing seat's refused raw curl. Nobody has run this script from a session in that state, and the script cannot measure it about itself. That is the open half of the card, and the permission-rule question above is what would settle it.
• references/rest-channel.md is at its ceiling with zero headroom (82/82 lines, 120 bytes per line). Any future line there has to buy its space by deleting one. Worth knowing before the next channel fact needs recording; not a defect.
• scripts/pr-labels.mjs and scripts/pm/label-write.mjs are now two additive label writers with no shared code. That is correct today — one is a CI job writing PR size/path labels from a workflow, the other is a seat writing card state over the proxy, and they share neither transport nor vocabulary — but it is the kind of pair that drifts. No card: nothing is wrong yet, and a premature merge would couple a CI script to the PM vocabulary module.

Clause-②: no

---

Generated by Claude Code

[claude]

• Served-tier: 1783/1783 CONTRACT_REVIEW_TIER — harness model stamp counted over this seat's own transcript (non-sidechain assistant messages a model served; <synthetic> harness notices excluded) at 2026-09-14T02:28Z and compared to the constant's value outside the repository; get_session external_metadata.last_served_model read equal to the constant at 2026-09-14T00:20Z.

Contract review

Head: 0e803e02 (PR #18099, card #18085 — the maintainer's direct order 「18085 优先」) — reviewed at 2026-09-14T02:28Z by the skills seat at the contract-review tier. Governed references tier (references/rest-channel.md) + non-governed PM tooling (scripts/pm/label-write.mjs, package.json one script line, .github/workflows/lint.yml one self-test step) ⇒ this in-seat record lands it on the merge-group leg (PR #18036's tier): ready + auto-merge by this seat. ⛔ .claude/settings.json is NOT in this diff — by the dev's correct refusal: a permissions.allow widening relayed from chat is not the maintainer's own word; the PR's 「## Permission rule — NOT in this diff, and why」 section argues the shape for the maintainer to rule on, and the seat carries that question in chat (see ③).

① derived judgments (seat-measured on the fetched head, ⛔ not taken from the report):

1. The script is the four steps as one program: step ① GET current labels + assignees; ② target = (current ∪ add) − remove with the ONE-OF state refusal (refuseTwoStates, --allow-two-states the declared exception); ③ additive POST .../labels and directed DELETE .../labels/{name} first, ONE whole-set PATCH fallback only after a platform refusal, with the current assignees echoed (patchFallbackBody — assignees always present); ④ read back and diff (readBackVerdict: a target label the read-back lacks is re-added once and REPORTED; a survivor of a removal is a mismatch). classifyHttp reads a 404 on a directed DELETE as the label already gone and a 403/429 with the quota at 0 as a rate-limit refusal that must NOT reach the fallback (a rate-limit refusal binds the shared identity). Exits: 0 / 2 usage / 3 prerequisite / 4 read-back mismatch / 5 platform refusal, the exit-5 text saying a channel-less seat hands the write to a seat that has one.
2. Self-test: node scripts/pm/label-write.mjs --self-test in an archive of the head → exit 0, 64 cases across 8 batteries with declared floors; the fake board models PATCH destructively on purpose so the assignee echo is actually tested; check:pm-label-write wired in package.json and as a lint.yml step (what puts it inside check:self-test-wired's population).
3. rest-channel.md :37–:39 repaid equal-line, 82/82 (ratchet exit 0 on the head; the three lines at 111 / 119 / 114 bytes under the 120-byte budget): additive-first; 「标签/assignee 写恒经 scripts/pm/label-write.mjs:四步内建、回读、回退整组 PATCH 回传 assignees」; 「⛔ 永不 MCP issue_write(锁 1 已拒);会话分类器拒改动 ⇒ 无通道,交有通道席位立卡」 — the fallback sentence no longer names a denied tool, and the file asserts no allow rule that the tree does not carry (the dev's deliberate choice, correct for a facts-layer file).
4. Live proof on this card: --dry-run at 2026-09-14T01:33Z printed the fallback body with the assignee echo; the idempotent no-op --add domain:skills at 2026-09-14T01:34Z made ZERO write calls and read the card back unchanged; the additive POST leg applied skip-changeset to PR feat(pm): label-write.mjs — the four-step label write as one spelling, and rest-channel.md names it instead of the denied MCP fallback (#18085) #18099 at 2026-09-14T02:23Z (HTTP 200, read-back match, the labelers' four labels intact beside it) — additive-first confirmed against concurrent writers. The classifier reading is a fact about the dev's session only, stated as such in the docblock.
5. Gates: 71 derived / 68 run / 3 NOT-MEASURED / 0 UNRUN at 0e803e02 (the three are exit-3 prerequisites needing a full workspace build; the narrowing is proven — packages/ untouched, the one package.json delta is a scripts-map line — and CI's Build Core runs them); three other exit-3 families built under the verify lock and measured green; two origin/main merges on the branch are merge commits (no rebase). Checks on the head at 2026-09-14T02:27Z: 51 — 35 green, 13 skipped, 3 running, 0 red.
6. Scope held: four files; Clause-②: no holds — no contract path; --pair 18099 on origin/main's reader → exit 0 at 2026-09-14T02:27Z before this record. The one correction to the seat's premise P3: scripts/pr-labels.mjs already writes PR labels additively and check-whole-set-label-write.mjs bans PUT .../labels over scripts/** — the new tool is a sibling of an existing discipline, not a first; neither is seat-facing or touches assignees, so the card's gap stands.

② semver: unchanged — nothing published; skip-changeset is the declaration.

③ boundary flags: (a) the permissions.allow rules (Bash(node scripts/pm/label-write.mjs:*), Bash(node scripts/pm/post-stamped.mjs:*)) — a permission-boundary change on the maintainer's floor: it lands only as a separate governed edit on the maintainer's own word (an APPROVED review under ruling C, or a line on the card); the seat asks in chat; until then a classifier-closed seat has no channel and hands the write over, which the repaid line now says. (b) Platform reading for platform-readings.md (the seat's file, next references PR): a REST PATCH of a PR body appends the platform's bare footer beside an existing session-URL footer — two footers; remedy = re-send with every footer stripped and read back. (c) rest-channel.md is now at zero headroom in both dimensions — the next fact there buys its line by deleting one. (d) SKILL.md :378 and checklist-test/SKILL.md :123 still name issue_write — the seat's follow-up governed card.

Implemented-by: claude/issue-18085-label-channel-under-lock-1
Reviewed-by: session_01DAcomhvR9kKizeYgg89Vo8

Verdict: PASS — ready + auto-merge by this seat.

---

Generated by Claude Code