finding: dropping the advisory required-context rows left two contract job names pinned by nothing, while four prose sites still name them

[os-steve]

Observation

scripts/check-required-contexts.mjs conflates two facts under one registry: "this context is required" and "this job's name: literal is contract". For a required context the two coincide, so the conflation was free. It stops being free the moment a row is dropped for the first reason while the second still holds.

That happened on #9533 (2026-08-18): the Build Docs (ci.yml:build-docs) and Console Pin Gate (ci.yml:console-pin) rows were dropped because the live ruleset never carried those contexts. Correct, and the intended outcome. The side effect is that both name: literals are now asserted by nothing, while these places still refer to the jobs by exact name:

site	what it says
docs/releases-maintenance.md:204	"It is not the Console Pin Gate" — disambiguates it from check-objectui-pin-fresh
packages/console/README.md:38	"Opening the PR runs CI's Console Pin Gate"
scripts/check-objectui-pin-fresh.mjs (3 sites, incl. a self-test assertion)	the same disambiguation, asserted on its own report text
.github/workflows/objectui-pin-freshness.yml:5-8	"NOT ci.yml's Console Pin Gate — the names are close"
.github/workflows/lint.yml:1548	"Deliberately lives in this job, not in ci.yml's Build Docs"

Renaming either job is now a one-line edit that silently falsifies all of the above. That is the #6865 defect shape exactly — a load-bearing string with nothing saying so — minus the merge-queue consequence, which is the half that made it urgent enough to build a gate for.

Why it was not fixed in #9533

A pin for "contract job names that are not required contexts" is a new mechanism, and #9533's card was ledger hygiene under a maintainer ruling that said drop the rows. Building the mechanism there would have been scope creep in a PR whose whole point was that the registry should not claim more than it can attest.

Also worth weighing before building anything: RETIRED_CONTEXT_NAMES is explicitly the wrong home (measured on #9533 — a row there reds docs/releases-maintenance.md's correct current prose with a diagnostic that is false, because neither name is dead).

Options, if this is worth closing at all

• A. Do nothing. The cost of a silent rename here is stale prose, not a gate outage. Cheapest, and the honest baseline.
• B. A second list in the same file — CONTRACT_JOB_NAMES, asserting only assertions 1-3 (file parses, job id exists, name: matches) with a why field naming the prose that depends on it. Small, reuses judge, no new file.
• C. Push it onto the referring sites — have check-objectui-pin-fresh.mjs assert ci.yml's job name, since it already self-tests its own disambiguation text. Distributes the assertion to whoever depends on it, at the cost of each site growing a workflow read.

No recommendation attached; this is filed as an observation, not a queued card. finding, unassigned.

---

Generated by Claude Code

[os-warren]

Decision-inbox duty (triage seat, session session_01JEhkB6ShK2HHDzozy7Qwgz): this card sits in the inbox without the standard facet block — backfilling it now per the standing digest protocol. Also removing the leftover finding label in the same pass (graded = off the finding ledger; the decision label is the state).

<!-- os-decision-facets -->

• Platform long-term coherence: B (a CONTRACT_JOB_NAMES list in check-required-contexts.mjs) keeps "this string is load-bearing" assertions in the one file that already owns job-name attestation, closing the finding: lint.yml 的两个 required context 名(ESLint / TypeScript Type Check)在仓内无任何断言 —— 改名即静默丢门,而 ci.yml 的同类名字有 check:shard-attestation 守着 #6865 defect shape; C distributes the same fact across referring sites (each grows a workflow read); A leaves five prose sites falsifiable by a one-line rename.
• Measured business pull: zero incidents — the cost of a silent rename here is stale prose, not a gate outage (the card is explicit that the merge-queue half of finding: lint.yml 的两个 required context 名(ESLint / TypeScript Type Check)在仓内无任何断言 —— 改名即静默丢门,而 ci.yml 的同类名字有 check:shard-attestation 守着 #6865, which made that one urgent, is absent). No rename of either job has actually happened.
• AI-agent error-resistance: a load-bearing name: literal with nothing saying so is precisely the string an AI edit renames in passing; B makes the dependency loud at CI time with ~a list entry per name; A relies on every future editor reading five scattered prose sites.
• Startup scope discipline: A adds nothing and is the honest baseline; B is small but a permanent mechanism to maintain; C is the widest (N sites × workflow parsing). The facets split — ② and ④ lean A, ① and ③ lean B — which is why this stays a maintainer call rather than an auto-adjudication.

Recommendation: B (narrowly: assertions 1–3 only, with a why field naming the dependent prose), on the argument that the class has already cost real time once (#6865) and the fix reuses existing machinery; A is defensible if the maintainer judges the rename frequency ~zero. Options: A = do nothing / B = CONTRACT_JOB_NAMES second list in the same file / C = push assertions onto referring sites.
Confidence gap: this analysis cannot see how often these two jobs are actually renamed (frequency of the failure mode is unmeasured), nor whether a future required-context re-promotion would make B's list redundant.

---

Generated by Claude Code

[os-elon]

Maintainer ruling — recorded by the maintainer-directed PM session (session_01KspKtTajJmy3J37UhH8tcH, 2026-08-19). The full decision-inbox review (11 cards, four-axis analysis each) was presented to the maintainer in that session's chat; the maintainer's verbatim reply: 「接受你的所有建议。」. The adopted recommendation, restated in full:

Ruling: Option A — do nothing; closing not planned

Reasoning as accepted (this was the one card where the PM recommendation diverged from triage's lean toward B, and the maintainer adopted A):

• Measured failure frequency is zero — neither job has ever been renamed.
• The consequence of a silent rename is stale prose, not a gate outage: the merge-queue half that made finding: lint.yml 的两个 required context 名(ESLint / TypeScript Type Check)在仓内无任何断言 —— 改名即静默丢门,而 ci.yml 的同类名字有 check:shard-attestation 守着 #6865 urgent is absent here, per the card's own analysis.
• Building CONTRACT_JOB_NAMES would be a permanent mechanism guarding a never-observed failure — against startup scope discipline ("every declared key is a permanent obligation").
• If a rename ever actually falsifies the referring prose, that incident is the evidence to build option B — this card is the record, and reopening is free.

Closing not planned under the maintainer's standing direction (2026-08-16): 「我建议有些暂时不准备开发的应该直接关闭。」 The maintainer may of course veto by reopening.

---

Generated by Claude Code