docs(agents): scope the attribution-footer clause to PR bodies, and record the comment channel's measured append

[qq9340100]

Fixes#10207

Ruled scope was C then A: re-measure through a second write path before writing
documentation, then scope the clause to what the measurements support.

C — the re-measurement (2026-08-20)

Four probes on this card's own thread, two write paths x two footer forms, each read back
byte-for-byte over REST. The card's original sample was re-read (read-only, never edited).

#	surface	write path	footer written	footer(s) read back
M1	issue comment 5360236506	MCP add_issue_comment	session-URL	session-URL, then bare (two)
M2	issue comment 5360236672	MCP add_issue_comment	bare	bare (one)
M3	issue comment 5360238570	direct REST POST (curl)	session-URL	session-URL, then bare (two)
M4	issue comment 5360238778	direct REST POST (curl)	bare	bare (one)
—	#10102 comment 5356851695	the card's original sample	session-URL	session-URL, then bare (two)
—	PR #10204 body	create_pull_request	session-URL	session-URL (one)
—	#10207 issue body	issue_write	session-URL	session-URL (one)

The premise fork

The card reports the comment channel as a rewrite running "in the opposite direction"
from create_pull_request — session-URL downgraded to bare. The measurements do not
support that, and the card's own sample disproves it: comment 5356851695 carries two
footers, the session-URL one written by its author intact, with a bare one underneath.

The actual mechanism is an append. Every issue comment gets a bare footer block
appended on write. When the body already ends in the bare form that append is idempotent
(the existing block is consumed and re-emitted, net one footer plus a blank line). When it
ends in the session-URL form the platform does not recognise it as the footer, so it
survives verbatim and a bare one lands under it — two footers. Reading only the tail of the
comment is what makes an append look like a downgrade.

Byte-level confirmation for M1 (written vs read back), the appended block being lines 7-10:

 6|_Generated by [Claude Code](https://claude.ai/code/session_019T1s...)_ <- written, intact
7|
8|
9|---
10|_Generated by [Claude Code](https://claude.ai/code)_ <- appended

Two further findings the card left open: the behaviour is per-surface, not per-tool —
MCP and direct REST are indistinguishable — and PR bodies and issue bodies get no
append, which is why the session-URL rule is correct there and only there.

A — the clause

AGENTS.md now states the rule per surface, keeps both literal footer forms, and records
the comment-channel behaviour with its measurement date beside the PR-body rule. The old
closing sentence "Comments are a different path and unaffected" is gone; the practical
guidance for comments is bare (or no footer), and the anomaly-reading guard is inverted to
match the mechanism: a tail bare footer on a comment is the platform's, not your form
downgraded.

AGENTS.md is at its shrink-only ceiling, so this is paid by dedup inside the clause's own
paragraph: 10 insertions, 10 deletions, net zero — the file stays at 961 lines
(check-skill-line-ratchet: AGENTS.md is 961 lines (ceiling 961; headroom 0)).

Verification

Gate union re-derived on the actual diff with node scripts/pm/dispatch-gates.mjs (one
path, AGENTS.md), then re-run at the final commit 50e76aa4e — all green:

check:docs-audit-scope EXIT=0 check:pm-skill-ratchet EXIT=0
check:pm-governed-merges EXIT=0 check:required-contexts EXIT=0
check:pm-governed-prose EXIT=0 check:doc-authoring EXIT=0
check:pm-skill-id-lint EXIT=0 check:nul-bytes EXIT=0

The re-derivation named four gates the dispatch clue did not (check:docs-audit-scope,
check:pm-skill-id-lint, check:pm-skill-ratchet, check:required-contexts); all four
are included above.

Instruction-surface change only — no published package is affected, so skip-changeset.
Governed surface: draft, human merge, never ready/queued/auto-merge.

---

Generated by Claude Code