My GitHub account was invisible for three weeks. The fix was a header, not an appeal

Profile 404 to anonymous visitors, fork 403 on every repo, search API returning 'User flagged as spammy' - with no notification. Email support bounced, the appeal form demanded 2FA first, and 2FA looked like it was refusing. Reading the wizard's own JavaScript showed the real request shape: a custom Scoped-CSRF-Token header, a type=app body field, and a download precondition. The exact protocol, and the two lessons about reading schema errors as policy refusals.