feat(pm): label-write.mjs — the four-step label write as one spelling, and rest-channel.md names it instead of the denied MCP fallback (#18085)

.claude/skills/pm-dispatch/references/rest-channel.md

@@ -34,9 +34,9 @@
 ## 写侧 —— 全部可迁移
 
 - ✓ 评论 `POST .../issues/{n}/comments`;改评论 `PATCH .../issues/comments/{id}`。
-- ✓ 标签加法 `POST .../issues/{n}/labels`,定向删 `DELETE .../issues/{n}/labels/{name}`。
-- 加法写剥不掉并发席位刚挂的标签,比 MCP `issue_write` 的整组替换安全。
-- 门关席位无此端点 ⇒ 回退 = MCP 读现值、并集、整组写、读回;读回是它安全的全部理由。
+- ✓ 标签加法 `POST .../issues/{n}/labels`,定向删 `DELETE .../issues/{n}/labels/{name}`;加法优先。
+- 标签/assignee 写恒经 `scripts/pm/label-write.mjs`:四步内建、回读、回退整组 PATCH 回传 assignees。
+- ⛔ 永不 MCP `issue_write`(锁 1 已拒);会话分类器拒改动 ⇒ 无通道,交有通道席位立卡。
 - ✓ 建卡带标签 `POST .../issues` · 改正文 `PATCH .../issues/{n}` · 认领 `POST .../issues/{n}/assignees`。
 - 请求体走文件(`-d @file`)或引号定界 heredoc(`<<'EOF'`),⛔ 永不内联双引号串。
 - 双引号内 shell 先展开反引号、`$(...)`、`$VAR`,请求尚未成形;只标题坏而正文完好即此形。

.github/workflows/lint.yml

@@ -1211,6 +1211,32 @@ jobs:
       - name: Stamped-post helper self-test
         run: pnpm check:pm-post-stamped
 
+      # Label-write helper self-test (#18085) — same family and the same split
+      # as the step above. The LIVE path mutates a card's labels and assignees,
+      # so it is emphatically not a thing CI runs against the board; the offline
+      # half is all CI can hold.
+      #
+      # What the self-test instruments is the set of rules a clean tree cannot
+      # exercise, every one of which is silent when it breaks: the union /
+      # difference arithmetic that decides what gets written at all; the ONE-OF
+      # state refusal (H29's finding, asked of the TARGET, at the one moment the
+      # pair is still one keystroke from correct); that a 404 on a directed
+      # DELETE is the label already being gone rather than a refusal; that a 403
+      # with the quota exhausted must NOT reach the whole-set fallback, because
+      # rate-limit refusal binds the shared identity and switching channels to
+      # keep writing is the same act as retrying; and the assignee echo on that
+      # fallback, without which a labels-only whole-set write silently
+      # un-assigns the card. Weakening any of them leaves every ordinary
+      # invocation just as green — the tool would simply write the wrong thing
+      # and read it back happily — which is the shape `check:self-test-wired`
+      # requires this step for.
+      #
+      # The fake board it drives models `PATCH /issues/{n}` DESTRUCTIVELY, on
+      # purpose: a fake that merged instead would pass every assertion here
+      # while the echo went untested.
+      - name: Label-write helper self-test
+        run: pnpm check:pm-label-write
+
       # Board-snapshot archiver self-test (#17390) — same family and the same
       # split as every step around it. The LIVE run reads the whole board over
       # REST and commits the result to an orphan branch, so it is not a thing

package.json

@@ -83,6 +83,7 @@
     "check:pm-closed-card-sweep": "node scripts/pm/sweep-closed-cards.mjs --self-test",
     "check:pm-stale-finding": "node scripts/pm/sweep-stale-finding.mjs --self-test",
     "check:pm-post-stamped": "node scripts/pm/post-stamped.mjs --self-test",
+    "check:pm-label-write": "node scripts/pm/label-write.mjs --self-test",
     "check:pm-board-snapshot": "node scripts/pm/board-snapshot.mjs --self-test",
     "check:pm-changeset-deadline-census": "node scripts/pm/changeset-deadline-census.mjs --self-test",
     "check:pm-governed-merges": "node scripts/pm/check-governed-merges.mjs --self-test",