docs(pm): re-key H64 rationale to the account-bound token class

[os-elon-musk]

Fixes #18393

H64's rationale sourced the write identity to the CHANNEL and quoted 「REST 按会话为 claude[bot] 或用户,MCP 恒用户」 from .claude/skills/pm-dispatch/references/rest-channel.md. That sentence no longer exists there: git grep '按会话为' origin/main -- .claude/skills/pm-dispatch/references/ returns nothing, and the control word 按账号 hits rest-channel.md:54 (「actor 记令牌类,按账号非会话、逐写回读;见配额段,MCP 恒用户」). The landed fact is .claude/skills/pm-dispatch/references/platform-readings.md 配额段: 「类按 Claude Code 账号定,⛔ 不按会话定:一会话内两次写之间可无席位动作地翻转。」

The re-key points at that section rather than restating it, and keeps the half of the rationale that is still correct — attribution on this board is the session_ id the TEXT carries (.claude/skills/pm-dispatch/SKILL.md).

Prose only. ⛔ No predicate, population, threshold, cap, pin instant or remedy of H64 moved. The diff is the H64 header docblock, two runtime message strings, and the three self-test cases that pinned the retired text.

What changed, string by string

1. Header docblock — the sourcing

Before:

// (`.claude/skills/pm-dispatch/SKILL.md`), and the write identity follows the
// CHANNEL rather than the account — 「REST 按会话为 `claude[bot]` 或用户,MCP
// 恒用户」 (`.claude/skills/pm-dispatch/references/rest-channel.md`).

After:

// (`.claude/skills/pm-dispatch/SKILL.md`), and the login it does record is a
// TOKEN CLASS bound to the Claude Code ACCOUNT rather than to the session — it
// is read back from each write and can flip between two writes of ONE session
// with no seat act behind it
// (`.claude/skills/pm-dispatch/references/platform-readings.md` 配额段).

2. Header docblock — what the author field records

Before: // it says WHICH, and the author field records only the token that session was / // handed.

After: // it says WHICH, and the author field records only the token class behind that / // write.

3. Header docblock — the 2026-09-15 measurement narrative

Before: // The first two are both REST-proxy writes and differ only in the TOKEN CLASS / // the session was handed.

After: // The first two are both REST-proxy writes and differ only in the TOKEN CLASS / // behind them.

The measurement itself is untouched; only the clause that attributed the class to the session moved. The two rows it names differ by ACCOUNT, which is what the landed fact says decides the class.

4. Header docblock — why the exposure half names no remedy

Before:

// the token class is handed to a session at start rather than chosen at write
// time, so no act available to a user-token session moves its content to the
// App.

After:

// the token class follows the Claude Code ACCOUNT and flips between writes
// with no seat act behind it: nothing available to a user-token session
// chooses the class of its own write, and nothing moves content it already
// authored to the App.

The conclusion is unchanged and still true — this half files NO row because no reader can perform a repair — but the reason is now the landed one rather than the retired one.

5. Runtime message — the author clause

Before: 'TOKEN that session was handed and not the seat that wrote'

After: 'TOKEN CLASS that write was made with and not the seat that wrote'

6. Runtime message — the sourcing carried into the finding sentence

Before:

because the write identity follows the CHANNEL and one protocol identity is shared by
every agent here (`.claude/skills/pm-dispatch/SKILL.md`,
`.claude/skills/pm-dispatch/references/rest-channel.md`).

After:

because one protocol identity is shared by every agent here and the token class behind
that login follows the Claude Code ACCOUNT rather than the session
(`.claude/skills/pm-dispatch/SKILL.md`,
`.claude/skills/pm-dispatch/references/platform-readings.md` 配额段).

7. Exposure clause — why it names no remedy

Before:

but the token class is handed to a session at start rather than chosen at write time, and
no act available to a user-token session moves its content to the App, so this half names
NO remedy and files NO row

After:

but the token class follows the Claude Code ACCOUNT and flips between writes with no seat
act behind it, and nothing available to a user-token session chooses the class of its own
write or moves content it already authored to the App, so this half names NO remedy and
files NO row

Self-test

Three cases pinned the retired strings and move with them; every other case is byte-identical.

Case	Pinned before	Pins after
H64 author: …	TOKEN that session was handed and not the seat that wrote	TOKEN CLASS that write was made with and not the seat that wrote
H64 exposure: …and says why no remedy exists …	handed to a session at start rather than chosen at write time	follows the Claude Code ACCOUNT and flips between writes with no seat act behind it
H64 row: …both halves of it	`.claude/skills/pm-dispatch/references/rest-channel.md`	`.claude/skills/pm-dispatch/references/platform-readings.md`

Case count 4270 before, 4270 after — one-for-one replacements, nothing added and nothing dropped.

BEFORE (on 0c573f09, through scripts/pm/os-verify-lock.sh):
  ✓ check-half-states self-test: 4270 cases pass.
  os-verify-lock: VERDICT command-exit 0 · held the lock 1s · waited 134s

AFTER (pnpm check:pm-half-states, exit 0):
  ✓ check-half-states self-test: 4270 cases pass.

Gates

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths) derived 40 families for this change set of one path. All 40 were run in the foreground with exit codes captured before any pipe, and reconciled:

✓ dispatch-gates --ran: 40 derived famil(ies) accounted for — 40 run, 0 NOT-MEASURED
  (a DERIVED zero — all 40 recorded an exit code and none of them is 3).

All 40 exited 0, including pnpm check:pm-half-states, pnpm check:pm-dispatch-gates, pnpm check:nul-bytes, pnpm check:pm-governed-prose where derived, and pnpm check:commit-card-trailers (which the pre-push hook also ran: "2 commit message(s) on this push carry no card relation and no model identifier in the trailer pair").

The whole union was then re-run on the final head 9b5e6488 (after the origin/main merge below) and reconciled again from that head: 40 derived, 40 run, 0 NOT-MEASURED, 0 UNRUN, every family carrying a captured exit code of 0, and pnpm check:pm-half-states still reporting 4270 cases pass.

Derivation was re-run after merging origin/main b9598e9c (which itself moved scripts/pm/dispatch-gates.mjs): the family list is identical — 40 derived, none added, none dropped — and the change set is still the one path.

Control-character self-scan beyond the gate, on the edited file: a grep -naP over the C0 control range plus DEL (NUL through backspace, vertical tab, form feed, SO through US, and 7F), written with each bound spelled as an escape rather than a raw byte, returns nothing.

Changeset

skip-changeset. scripts/pm/** is on AGENTS.md's fast track — it publishes nothing from any released package, and Post-Task Checklist step 3 states the arm in as many words: that label "is for a diff that publishes nothing from any released package". No package files[] ships scripts/pm/.

Acceptance notes

• Seven prose sites, not four. The card and the dispatch named four carriers of the retired premise. A multiline sweep (perl -0777 over session was handed|handed to a session|token that session|TOKEN CLASS the session) found three more, all inside the H64 region and all wrapping across a line break, which is why a line-oriented grep missed them: the header's "the author field records only the token that session was / handed", the measurement narrative's "differ only in the TOKEN CLASS / the session was handed", and the runtime author clause's "TOKEN that session was handed". They carry the same retired mechanism as the four named ones, in the same function and the same docblock, so re-keying four and leaving three would have left the row teaching the retired fact from the same paragraph. All seven moved together. After the change the sweep returns empty and grep -c "按会话为|handed to a session|session was handed|follows the CHANNEL" is 0.
• Three cases moved, not two. The third is the one that pinned the author clause in site 5. The count is unchanged because each is a one-for-one re-pin.
• rest-channel.md is no longer cited anywhere in this file. Both citations were the retired sentence's, and the re-key points at platform-readings.md 配额段 as the dispatch's route asked. rest-channel.md:54 still carries the account-bound actor line, so a future re-key has a second source available if one is ever wanted. Noted, not filed — it is an observation about sourcing style, not a defect; the carrier is whoever next edits H64's sourcing.
• No out-of-scope finding in classes (a), (b) or (c) was seen in this region.
• Regions belonging to in-flight sibling cards were not touched: H38, H44 and the file tail are all outside every hunk. The hunk map is 14458-15029 plus the three case lines.

---

Generated by Claude Code

---

Generated by Claude Code

[os-elon-musk]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 9b5e64888c88c0403db78ed72878a5646758ccd8

Skills seat, session_01HPfcjvF23QBoBj7P47DDxs, 2026-09-16T11:27Z — in-seat review of the dispatched dev's PR for #18393 (claim 5695940020, Clause-②: no; the ACCEPT on the card records the checklist).

① Derived judgments

• Accept / reject set: unchanged. The diff rewrites rationale prose (docblock comments and three message string literals) in a report-only patrol row; what H64 flags, over which population, with which cap and which remedy, is byte-identical. No runtime contract, no packages/spec path, no error code, no published export touched.
• Public surface: none — scripts/pm/** ships in no package's files[]; no new export.
• Clause-②: no is consistent with the diff (no widening tell; --pair 18444 exit 0).

② Semver level

None owed: nothing publishes; skip-changeset is AGENTS.md's own arm for this diff. No changeset expected, none present — consistent.

③ Boundary flags

• Dev open_questions: empty. Deviations (seven carriers, three cases; one declared over-budget PR-body PATCH) answered in the ACCEPT — accepted.
• Region boundary: hunks inside the H64 docblock / message / exposure clause and the H64 case block only; H38 ([Decision] one lane, several execution PMs — option D, free-claim multi-seat: a second Claude Code account claims from the same domain:spec queue (protocol text in SKILL.md / core-rules / seat-post-protocol + a check-half-states H38 filter); A partition / B outlet-only kept as alternatives #18394), H44 ([finding] check-half-states: H44 reads a SESSION ID as a dateless tree tip — 6 of 9 rows on the cloud board are this shape, and the prescribed remedy would manufacture provenance #18385) and the file tail ([finding] check-half-states.mjs --help prints no usage and silently runs the full sweep — argv is never validated, so a mistyped --repo reads the wrong repo and looks successful #18369, landed) untouched.
• Self-test at this head: 4270 cases pass (seat's own run on a detached worktree).

Implemented-by: claude/issue-18393-h64-rationale-account-bound-class
Reviewed-by: session_01HPfcjvF23QBoBj7P47DDxs

VERDICT: PASS

---

Generated by Claude Code

[os-elon-musk]

Landing provenance — skills seat, session_01HPfcjvF23QBoBj7P47DDxs, 2026-09-16T11:30Z. In-seat contract review PASS 5696689883 on head 9b5e6488 (Served-tier: CONTRACT_REVIEW_TIER); ACCEPT 5696689546 on #18393. Landing pre-checks: ① that record ✓ · ② check-clause2-carriers.mjs --pair 18444 exit 0 ✓ · ③ every check-run on 9b5e6488 success (30) or a rostered skip (14, check-expected-skips.mjs VERDICT OK) ✓ · scripts/pm/check-half-states.mjs merged onto origin/main b6fe311a reads 2,095,902 B, under the parity gate's 2,097,152 B cutoff (the hazard filed as #18435 does not reach this PR) ✓. Landed by the seat through the CCR routes: POST …/ccr/ready_for_review at 2026-09-16T11:29:07Z (read back draft: false), PUT …/ccr/auto_merge {"merge_method":"SQUASH"} at 2026-09-16T11:29:29Z (auto_merge_enabled on the timeline; the REST field reads merge as the platform always reports — the landing commit's parent count is the reading). Tracked to MERGED with the two readings (queue ref, origin/main by content); the queue currently holds PR #18436 (red, see 5696514750) and PR #18438 ahead — if this PR's first merge group inherits that red, the queue recomputes it once #18436 is removed; ⛔ no re-enqueue by hand before that reading.

---

Generated by Claude Code