tooling(required-contexts): scan the PM readings ledger for the six required names

[claude]

Fixes #15652

The seat's readings ledger, .claude/skills/pm-dispatch/references/platform-readings.md, restates the six required check-run names as the operative per-repo set it reads before a PR may be enqueued — and scripts/check-required-contexts.mjs did not scan it. Renaming any of the six reddens the pin on AGENTS.md and on review-checklist.md, so the rename PR is forced to fix those two; the ledger's copy stayed invisible to the same run and would keep the dead name, in the one place consulted at the moment of the decision. The RETIRED_CONTEXT_NAMES standing ban did not reach it either.

Route 1 of the two the card names, taken on the decision frame's third axis: the ledger's reader is a seat at the instant of enqueue and needs the six names readable in place, so a pin that reds on rename keeps that copy honest, where a pointer would remove information from the place it is consulted.

The change

One INSTRUCTION_SURFACES entry, the same shape review-checklist.md already gets, with mustName for all six — both halves (the naming requirement and the retired-name ban) arrive through that one entry. The ledger file itself is not touched: it is carried by PR #15641, and its six names are spelled identically on main and on that head, so this entry is green against both.

Also updated by the file's own convention: the provenance block's count line (four of five surfaces carry a path separator becomes five of six), a dated note on the scan set's derivation, three self-test cases, and that battery's declared floor (28 becomes 31).

references/true-green.md is not added. Measured rather than assumed — see the derivation below: it names no registered context at all.

The red, proved

Triage's hand-over condition: not "I added the entry so it should red". Measured on a throwaway copy of the repo (scripts/, .github/, and the six surfaces copied into a temp root; a node_modules symlink; the worktree itself never mutated — git status clean throughout except the one committed file).

Control, untouched copy:

✓ check-required-contexts: 6 required context name(s) pinned across 2 workflow(s); 6 instruction surface(s) scanned against 2 retired name(s) (#9491).

Temporal Conformance (live PG + MySQL) renamed to Temporal Conformance (live Postgres + MySQL) in the ledger copy (mutation confirmed on disk: old literal 1 occurrence becomes 0, new literal 1; blob hash 8fce82f becomes eff4732), gate exit 1:

✗ check-required-contexts — 1 problem(s)

  • .claude/skills/pm-dispatch/references/platform-readings.md no longer names the required context 'Temporal Conformance (live PG + MySQL)'. This file states the required set, and the literal IS the contract — a required check is matched by check-run name, so an instruction that stops naming it cannot be followed (#9491). [remedy text elided]

Ablation, single variable — the pre-change gate from origin/main run against the identical mutated copy, exit 0:

✓ check-required-contexts: 6 required context name(s) pinned across 2 workflow(s); 5 instruction surface(s) scanned against 2 retired name(s) (#9491).

Five surfaces, silent on the rename. That is the defect, measured from both sides: the red above is this entry's doing and nothing else.

Restored copy, byte-identical to the worktree file (git hash-object 8fce82f both sides — an empty hash would have been read as a failed restore), exit 0:

✓ check-required-contexts: 6 required context name(s) pinned across 2 workflow(s); 6 instruction surface(s) scanned against 2 retired name(s) (#9491).

The scan set, re-derived

The header claims the set was derived, not assumed, so the same query was re-run rather than trusted. Every *.md under AGENTS.md, CLAUDE.md, .claude/ and docs/ naming any of the six registered contexts, case-sensitive, docs/adr/** excluded by the header's standing rule: the readings ledger is the only file in that population that names a registered context and was not enrolled. true-green.md returns zero hits for all six — the positive control being the enrolled files that do hit.

Verification

At 618f44fb8, the head this PR opens on.

• node scripts/check-required-contexts.mjs --self-test exit 0 — ✓ ... 153 assertions
• pnpm check:required-contexts exit 0 — ✓ check-required-contexts: 6 required context name(s) pinned across 2 workflow(s); 6 instruction surface(s) scanned against 2 retired name(s) (#9491).
• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derives 30 families; all 30 run, all exit 0. Reconciled: ✓ dispatch-gates --ran: 30 derived famil(ies) accounted for — 30 run, 0 NOT-MEASURED. The family list was re-derived after a fresh git fetch origin main and is byte-identical.
• pnpm lint (eslint . --no-inline-config, whole repo, through scripts/pm/os-verify-lock.sh) exit 0 — VERDICT command-exit 0 · held the lock 103s. Shared box, so that absolute is a contended reading.
• node scripts/check-required-contexts.mjs --verify-required-set through the proxy, exit 0 — see the note below.

One reading this PR does not act on

The live required-set sweep reports a direction-B finding that is not this card's and is left exactly as it is:

⛔ direction B — required in the live set, pinned by NO registry row (1).
       • Governed Surface Queue Guard — from main (active)

The live ruleset carries seven required contexts; REQUIRED_CONTEXTS pins six. The remedy is a registry row, not a settings change, and not a rider here.

Generated by Claude Code

---

Generated by Claude Code

[os-steve]

ACCEPT — contract-tier in-seat review of PR #15727, head 618f44fb8 (skills seat, 2026-09-05T05:1xZ).

Implemented-by: claude/issue-15652-required-contexts-scan-the-ledger (os-dev subagent)
Reviewed-by: session_019RfFHiRCSs3JXLK4cwcfox (skills seat)

Verified in a detached compare worktree at the PR head against merge-base 1c1421401, not from the report: one file, scripts/check-required-contexts.mjs, +59 / −3 — one INSTRUCTION_SURFACES entry for .claude/skills/pm-dispatch/references/platform-readings.md with mustName for the six required contexts in the same shape as the review-checklist entry (so the RETIRED_CONTEXT_NAMES ban reaches the ledger by the same entry), three self-test cases in the stale-name battery (the entry names all six; a rename in the ledger copy produces the no longer names problem; the retired-name ban), the battery floor 28 → 31, the provenance count line updated. No ledger edit, no other entry; true-green.md not added, on a measured reading (it names none of the six). No model names in the diff; not a governed surface (check-governed-merges --test exit 0). The seat's own gate runs in the compare worktree answered PREREQUISITE NOT MET (no node_modules there) and are recorded as NOT MEASURED; the evidence is the dev's proved red on a throwaway copy — control exit 0 with six surfaces, the mutated ledger exit 1 with exactly one problem naming the ledger and the renamed context, and the ablation (the pre-change gate against the identical mutated copy stays green at five surfaces) — plus the gate's --self-test 153 assertions, 30 derived commands all exit 0, whole-repo lint through the lock, and CI on 618f44fb8: 35 check runs, 24 success, 11 skipped, none failing, Lint & Repo Gates (which runs this gate) among the successes.

The dev's held reading — the live ruleset on main requires seven contexts while REQUIRED_CONTEXTS pins six (Governed Surface Queue Guard has no registry row) — is already filed as #15233; the seat adds the fresh reading there rather than filing twice.

Landing regime: pure code ⇒ ready + auto-merge in this same act (the queue's SQUASH governs whatever method the tool reports); closes #15652.

---

Generated by Claude Code

[claude]

Landing note from the skills seat: the ACCEPT above says "ready + auto-merge in this same act". That act has not happened yet. The seat's GitHub API quota was exhausted at the moment of the flip (05:08Z), and the retry at 05:13Z was refused the same way, so this PR is still a draft with no auto-merge. Nothing about the verdict changes: the review stands, CI is green on 618f44fb8, mergeable_state: clean. The seat retries the flip and the auto-merge arming at its next patrol; if an approver flips it ready and enqueues first, that is equally fine for a pure-code PR.

---

Generated by Claude Code