diff --git a/.claude/skills/pm-dispatch/references/security-findings.md b/.claude/skills/pm-dispatch/references/security-findings.md
index 5b7442e0ba0..7acd15ca58c 100644
--- a/.claude/skills/pm-dispatch/references/security-findings.md
+++ b/.claude/skills/pm-dispatch/references/security-findings.md
@@ -20,7 +20,7 @@
 - 私卡 = 受影响仓上一份未发布的安全公告,只有管理员、安全经理与受邀协作者可见。
 - 首选中继 `advisory_create` 建草稿公告,再 `advisory_collaborators_add` 带具名账号进公告。
 - 读公告只走中继 `advisory_read`(席位账号读被拒):一次性密钥只在席位进程,只回密文。
-- `advisory_report` 只留给 App 无公告写权的仓:GitHub 按账号限每日新私报,全队共一个 App。
+- `advisory_report` 与 `advisory_create` 同铸公告写权,无此权的仓两者皆拒;私报另有账号日限。
 - ⛔ 席位永不以自身账号私报或写公告:GitHub 写只走中继,以 App 身份;发布归维护者。
 - 两操作皆被拒 ⇒ 会话专递(选 A):机制只在会话里交维护者,由其建草稿,⛔ 不换账号重发。
 - 私有仓无私密漏洞报告功能,那些操作上线后仍会话专递。
diff --git a/scripts/pm/fleet-write/execute.mjs b/scripts/pm/fleet-write/execute.mjs
index c328a12cd28..4eb92b0db13 100644
--- a/scripts/pm/fleet-write/execute.mjs
+++ b/scripts/pm/fleet-write/execute.mjs
@@ -192,8 +192,9 @@
  *
  * ## The four advisory rows — fenced on the ADVISORY, printing none of its text
  *
- * `ops.mjs`'s header section "The three rows that touch a security advisory"
- * is the authority; this is where its fences and landings are measured.
+ * `ops.mjs`'s header section "The four rows that touch a security advisory"
+ * is the authority, and its "The one row that READS an advisory" for the read
+ * below; this is where their fences and landings are measured.
  *
  *   - `advisory_report` is ONE POST of the row's body to the private-report
  *     endpoint, and nothing is read first. It LANDS on a 2xx whose answer