Merge policy: a new check table or lint test registers itself where it's declared; only removing or loosening one waits for the owner #869

What must hold: adding a new check, meaning a check-shaped table or a lint test that walks src/ or scripts/, never needs a hand edit to a locked file. Only taking a check away, or loosening one, waits for the owner. That covers a table or lint removed, a registration's kind changed, or an allowlist grown.

Why (measured, 2026-10-20):

• Merge: a PR that removes or weakens a test, lint or guard waits for the owner (#783) [PROTECTED: owner merges] #820's backstop requires every new check table to be listed in CHECK_TABLES, and every new source-listing test in LINT_TESTS, both in src/merge-policy-weakening.ts.
• That file is locked, and the classifier refuses agents' edits to it. That is right for removals, but these are all additions, which tighten.
• In one day this produced 7 owner hand-edits on 6 branches:
  • main: docs-guardrails test turns #820's weakening input on, and the page lists its hold [PROTECTED: owner merges] #868/main: test/claude-accounts-retired.test.ts;
  • Tool guard: its lanes' rules move to src/guard/, so it loads 57 modules, not 83, and only those are locked as the guard (#785) [PROTECTED: owner merges] #839: test/review.test.ts GUARD_TREE;
  • Required checks count only from the App or workflow pinned for their name [PROTECTED: owner merges] #788/doctor prints a paste-ready required_check_sources block; a new project's config starts pinned (after #788) [PROTECTED: owner merges] #803: three test/raw-check-reads.ts allowlists;
  • Single machine: policy.yaml is root's, and the engine refuses one that isn't (#726 part 1) [PROTECTED: owner merges] #769/Dashboard policy changes go through root's helper (set-policy), never a loosening (#726 part 2) [PROTECTED: owner merges] #770: test/policy-edit.test.ts;
  • Dashboard policy changes go through root's helper (set-policy), never a loosening (#726 part 2) [PROTECTED: owner merges] #770: scripts/machine/worklane-machine.cjs POLICY_ONLY.
• It also made main red: Merge: a PR that removes or weakens a test, lint or guard waits for the owner (#783) [PROTECTED: owner merges] #820 merged, then claude accounts: remove profiles, failover and the account switch; leftovers fail closed (#736) [PROTECTED: owner merges] #861 added an unregistered lint, and nothing re-ran the backstop against the combination before merge.
• Each stacked PR needs the same lines added twice, and every registration line in a shared list is another same-line conflict.

Design (by design, not a lint):

• The registration lives on the declaration it registers, in the file that declares it:
  • a marker comment // check-table: never-grow or // check-table: never-shrink on the line before a table;
  • // lint-test near the top of a lint test file.
• The backstop and the hold read the markers. The central lists keep only the entries that can't carry a marker: package.json scripts and non-JS files.
• The kind is not the author's free choice. A table whose name says it allows or exempts something (ALLOW|EXEMPT|EXCEPT|SKIP|OUTSIDE|IGNORE|KNOWN|REVIEWED|PERMIT|BASELINE|LEGACY|WAIVE|NOT_YET|GOOD) must be marked never-grow. A marker that says otherwise fails the backstop.
• The hold (Merge: a PR that removes or weakens a test, lint or guard waits for the owner (#783) [PROTECTED: owner merges] #820) treats each of these as a weakening, so it waits for the owner:
  • a removed or changed marker line;
  • a marked table whose declaration disappears;
  • a removed // lint-test.
• Today those would be comment lines with no assertion, so this adds them to weakeningOf explicitly, with tests.
• No agent edit to src/merge-policy-weakening.ts is needed to add a check. Every removal still is one, through the hold.

Acceptance:

• A PR that adds a new allowlist table with its marker, and a new lint test with its marker, passes the backstop. Fail-without: on main it needs a src/merge-policy-weakening.ts edit.
• A PR that removes a marker, changes never-grow to never-shrink, or deletes a marked table waits with design: may weaken a check:.
• An allowlist-named table marked never-shrink fails the backstop.
• The existing CHECK_TABLES and LINT_TESTS entries move onto markers in the same PR. A test proves the set of registered (path, table, kind) is identical before and after: measured, none lost.

Risk class: protected (merge policy). The owner merges.