ci(devx): a daily watchdog workflow gives check:platform-checklist a reporting channel

.github/workflows/lint.yml

@@ -2325,6 +2325,32 @@ jobs:
       # PR. The checklist is a QA ledger, not a code gate; keeping it out of the
       # per-PR path means an unrelated PR is never blocked by checklist drift.
       # Run it by hand: `pnpm check:platform-checklist`. See that dir's README.
+      # Its red does have a reporting channel now, and it is NOT this file:
+      # `.github/workflows/platform-checklist-watchdog.yml` runs the gate on `main`
+      # daily and files or refreshes one issue when it is red.
+
+      # ⛔ …and the step below is NOT that wiring. What runs here is the STATIC PIN
+      # over the watchdog workflow: it asserts the file exists, fires on
+      # `schedule:` + `workflow_dispatch:`, carries NO `merge_group:` /
+      # `pull_request_target:` trigger, that any `pull_request:` trigger is
+      # `paths`-filtered to the watchdog file ALONE, that no board write is
+      # reachable from a pull_request run, and that the gate is invoked through its
+      # package script rather than an inlined copy. Two file reads, no socket.
+      #
+      # The watchdog's own `pull_request:` trigger names only itself, so it fires on
+      # no unrelated PR — that filter is what keeps the decision above intact, and
+      # pinning it is most of this step's job. It has to live HERE rather than
+      # inside the watchdog for the other half: a PR DELETING the watchdog would
+      # silence any check that lived inside it, and this job is the only place where
+      # the absence of that file is observable before it merges.
+      #
+      # Invoked as `node scripts/…` rather than a `pnpm check:*` alias: see the GATE
+      # INVOCATION IDIOM note at the top of this file. The `--self-test` leg runs
+      # first because a checker whose own cases failed has no verdict worth printing.
+      - name: Platform-checklist watchdog workflow pin
+        run: |
+          node scripts/check-platform-checklist-watchdog.mjs --self-test
+          node scripts/check-platform-checklist-watchdog.mjs
 
       # #3280/#3290 org-identifier guard: `organizationId` is the blessed
       # developer-facing name for the caller's active org in hook/action bodies;

docs/qa/platform-checklist/README.md

@@ -193,7 +193,8 @@ Why this shape:
   census and not a verdict). Adding anchors never reds; ⛔ lowering a floor is
   MAINTAINER-ONLY. ⚠️ Note what a red here reaches: `check:platform-checklist` is not
   CI-wired (see "Operating cadence"), so it reaches whoever runs the gate — **not every
-  PR**. #11730 holds that gap.
+  PR** — plus the daily `platform-checklist-watchdog` workflow, which files or refreshes
+  one issue when the gate is red.
 - **`why` is the debt marker.** A recipe exists because stock fixtures cannot demonstrate
   something — the same discipline as a coverage waiver. Landing the fixture in the
   showcase seeds proper retires the recipe; until then `why` says what is missing and
@@ -352,6 +353,12 @@ checklist drift. It runs on a **manual / periodic cadence** instead. Run
   dangling id or a forgotten `revision` bump in your own edit;
 - **alongside a `checklist-author`** (find gaps) **or `checklist-test`** (execute items).
 
+A red gate does have a reporting channel, and it is not this cadence:
+[`.github/workflows/platform-checklist-watchdog.yml`](../../../.github/workflows/platform-checklist-watchdog.yml)
+runs `pnpm check:platform-checklist` on `main` daily and files or refreshes one issue when
+it is red (⛔ and does nothing when it is green). That closes the visibility half only —
+the cadence above is still how the gate gets run *before* a red can matter.
+
 The trade-off of staying out of CI: a new capability kind or enum value that lands on
 `main` between runs is caught at the **next** manual run, not the moment it merged. The
 ratchets still detect it — they just aren't a blocking gate. If drift-catching latency

docs/qa/platform-checklist/RUNNER.md

@@ -11,6 +11,13 @@ build/runtime model incl. the vendored-console staleness trap (§2), and the
 anti-false-positive rule (§3). This file assumes it and adds the checklist-specific
 contract.
 
+**Who sees a red gate.** `pnpm check:platform-checklist` is not wired into per-PR CI (a
+standing maintainer decision — see the README's "Operating cadence"), so the channel that
+sees its red is
+[`.github/workflows/platform-checklist-watchdog.yml`](../../../.github/workflows/platform-checklist-watchdog.yml):
+it runs the gate on `main` daily, files or refreshes exactly one issue when the gate is red,
+and does nothing at all when it is green.
+
 ## Verdicts
 
 Per **clause** (each acceptance entry gets exactly one):

package.json

@@ -88,7 +88,7 @@
     "check:adr-links": "node scripts/check-adr-links.mjs --self-test && node scripts/check-adr-links.mjs",
     "check:adr-symbol-anchors": "node scripts/symbol-anchors.mjs --self-test && node scripts/check-adr-symbol-anchors.mjs --self-test && node scripts/check-adr-symbol-anchors.mjs",
     "check:scripts-symbol-anchors": "node scripts/symbol-anchors.mjs --self-test && node scripts/check-scripts-symbol-anchors.mjs --self-test && node scripts/check-scripts-symbol-anchors.mjs",
-    "check:platform-checklist": "node scripts/checklist-select.mjs --self-test && node scripts/check-platform-checklist.mjs",
+    "check:platform-checklist": "node scripts/checklist-select.mjs --self-test && node scripts/check-platform-checklist.mjs --self-test && node scripts/check-platform-checklist.mjs",
     "check:org-identifier": "node scripts/check-org-identifier.mjs --self-test && node scripts/check-org-identifier.mjs",
     "check:runner-env-posture": "node scripts/check-runner-env-posture.mjs --self-test && node scripts/check-runner-env-posture.mjs",
     "check:cli-test-child-env": "node scripts/check-cli-test-child-env.mjs --self-test && node scripts/check-cli-test-child-env.mjs",