Generate or guard the remaining hand-maintained lists — three shipped red-main incidents traced to one class

[JSONbored]

Why

Three separate incidents in a single day, all the same shape: a correct change whose blast radius was tracked by a hand-maintained list that nobody re-derived.

incident	the hand-maintained thing	how it failed
#9813 → main red	test assertions pinning a call arity + a cache-key literal + the two .loopover.yml example copies	8th arg added; three assertions never updated; six failures on main
#9815 → main red	miner-UI mock relying on an inferred shape	ChatActionDispatchResult closed into a union; the mock widened and stopped satisfying it; ui:typecheck isn't in the root typecheck
#9848 (found, unshipped)	turbo.json's //#typecheck inputs	four statically-imported paths unhashed → stale-cache risk; the comment's own stated reason for excluding one was false

The last one is the tell: the comment said "a snapshot … not a structural guarantee — re-run the same grep before trusting this list again." Nobody re-runs a grep on request. That list is now computed by scripts/check-turbo-typecheck-inputs.ts (#9853), which is the pattern this issue asks to apply more broadly.

What already has a guard (do not redo)

• MIGRATION_REBASELINE → db:migrations:immutable:check
• no-hand-written-js allowlist → validate:no-hand-written-js
• codecov type-only ignores → test/unit/codecov-ignore-type-only.test.ts
• turbo typecheck inputs → turbo-inputs:check (chore(build): make turbo's typecheck inputs self-verifying, and lock two runtime assumptions into tsc #9853)

Candidates to audit

1. The four parallel MCP command lists — STDIO_TOOL_DESCRIPTORS, CLI_COMMAND_SPEC, printHelp, and the README block are maintained by hand and already documented as having "bitten once". Partial parity checks exist (mcp-cli-completion-spec); a single generated projection would remove the class.
2. packages/loopover-mcp's ~85 hand-mirrored zod shapes — the comments admit they mirror the remote server's. Now that @loopover/contract is published and shipping 12 shared modules, most could be imported instead of re-declared.
3. test:ci's ~50-command chain in package.json — order and membership are hand-kept; a check that every scripts/check-*.ts is actually wired in would catch a checker that lands and is never run.
4. FOCUS_MANIFEST_TOP_LEVEL_FIELDS / gate key registries — three touchpoints per field (parse, serialize, recognize) plus presence; feat(gate): gate.ignoredCheckRuns — exclude a third-party check from CI resolution entirely #9813 and feat(gate): choose provider, model, effort and self-consistency runs — per repo, and escalated on guarded paths #9821 each shipped a bug from missing one. The exhaustive Record fixtures catch some of it; presence and the serialize guard were both missed this week.
5. Coverage-report asymmetry — the root v8 run and the engine c8 --all run disagree about which lines exist, so a fully-tested engine change can still read as 65% covered (hit on feat(gate): choose provider, model, effort and self-consistency runs — per repo, and escalated on guarded paths #9821). Worth either documenting as a contributor-facing rule or reconciling.

Suggested shape

Not one big PR. Each item is independently checkable, and the bar is the one #9853 met: compute the fact, don't remember it, and make the checker fail loudly with the fix in the message. Reject any "add it to the list too" fix that leaves the list hand-maintained.

Note on the third failure mode

ui:typecheck is in test:ci but not in the root typecheck, so a type change validated locally with npm run typecheck can still break apps/**. Worth calling out in the contributor skill regardless of what else gets automated here.

[linear-code]

JSO-6877