A downstream repo's pinned validate-task.yml/prose-gate SHA can predate a retire disposition's HUB_HOSTED exemption

[ptr727]

What happened

spec/divergences.json's retire disposition for repo-config/README.md, repo-config/settings.json, repo-config/main.json, and repo-config/operational/develop.json (#861, commit e31d3fc, 2026-08-19T19:17:08-07:00) landed in the same logical change as the matching HUB_HOSTED exemption entries in .github/actions/prose-gate/prose_lint.py's dead_path_findings() (also e31d3fc). That's the right pairing -- #721 already established that a retired hub-hosted path needs a dead-path exemption alongside its disposition.

But nothing keeps a downstream repo's pinned validate-task.yml/prose-gate SHA in sync with a new HUB_HOSTED entry added after the pin was last bumped. ptr727/HomeAutomation-Config's workflows pin at 389f5b9 (tag 2.0.392, 2026-08-19T17:49:37-07:00) -- about 1.5 hours before e31d3fc. Resyncing that repo and retiring its local repo-config/ copy (per the very disposition #861 added) hit dead-path findings on repo-config/README.md/repo-config/settings.json in the CI-required Validate sources job / Lint sources job, even though those exact paths are already exempted in current hub main -- confirmed by reproducing the same diff locally against the current .github/actions/prose-gate/prose_lint.py (clean) versus what the pinned 389f5b9 copy actually reported in CI (failed, twice, across the two mentions I hadn't yet reworded).

Why it matters

Every fleet repo that still carries a local repo-config/ (per the registry, at least PlexCleaner, PhotoCleaner, and ESPHome-Config still do) will hit this exact failure at their own promotion gate when they retire it, unless their pin happens to already be past whichever commit added the exemption for the path they're retiring. The failure is diff-scoped against main (same shape as #721), so it surfaces at the promotion PR, the step with the least room to fix it.

What I did instead (workaround, not a fix)

Reworded the two affected mentions in ptr727/HomeAutomation-Config's local copy of operational-vs-release-workflow/references/branch-protection-and-promotion.md to avoid a literal backtick-wrapped path string (a markdown link with a non-path-shaped label instead), so the dead-path scanner's INLINE_SPAN regex never extracts a token for it, regardless of which pin is active. That's a per-repo, per-mention workaround, not something that scales to every new HUB_HOSTED addition.

Possible directions

• A RESYNC.md/audit step that checks a repo's pinned validate-task.yml SHA against the hub commit that last touched HUB_HOSTED or spec/divergences.json's retire entries, and flags a bump as needed before a repo retires a newly-exempted path.
• Or: dead_path_findings() reads HUB_HOSTED from the retire disposition list at scan time rather than a hardcoded literal set, so a repo's local spec/divergences.json... except downstream repos don't carry that file either. Worth a second look regardless, since the literal-set duplication is exactly what let this gap open.

audit run 2026-08-25T13:46:24Z | hub fa63163