pm(labels): ensure-pm-labels.sh creates pinned and work-in-progress — stale.yml exempts both and the per-seat mailbox carries pinned (#27211)

Fixes #27151
Clause-②: no
Metadata-protocol: none

## 维护者速读

- 改了什么:`scripts/pm/ensure-pm-labels.sh` 新增两行,创建 `pinned` 与
`work-in-progress` 两个标签(仅 objectstack 主仓)。
- 为什么改:`stale.yml` 早就豁免这两个标签,但它们在仓里不存在(均 404),豁免形同虚设;每人信箱 PR(#27143)要挂
`pinned` 才不被 stale 扫掉。
- 风险与回滚:极低,只是标签词表多两行;合并本身不创建任何标签,要等席位或维护者运行脚本才生效;回滚即 revert 本 PR。
- 先看:`scripts/pm/ensure-pm-labels.sh` 新增块(needs:contract-review
之后),重点看两行 `-d` 描述与颜色。
- 两分钟验证:`pnpm check:pm-label-desc-cap`,预期输出 `44 label descriptions … all
≤100 characters`。
- 需要你做的:无,席位落地。

## What changes

- `scripts/pm/ensure-pm-labels.sh`: two new rows, `pinned` and
`work-in-progress`, on `objectstack-ai/objectstack` only, colour
`cfd3d7` (the sweep-exempt family `tracking` and `status:parked` already
use; `tracking` sits in the same `stale.yml` exemption list), each `-d`
within the 100-character cap. The comment block names the readers:
`pinned` is read by `.github/workflows/stale.yml` `exempt-issue-labels`
+ `exempt-pr-labels` and sent by `scripts/pm/mailbox-open.mjs`
(`STALE_EXEMPT_LABEL` in `PR_LABELS`, PR #27143); `work-in-progress` is
read by `stale.yml` `exempt-pr-labels` only, has no tool applying it,
and exists so the exemption the workflow already declares is not dead.
- Scope follows triage's grade (comment 6464839941):
「`ensure-pm-labels.sh` should create both」 — it overrides the card
body's narrower "no `work-in-progress`".
- Placement: right after the `needs:*` block, the file's home for
non-state, non-lane, main-repo-only labels whose reader is a workflow.
- `--reconcile` covers both rows with no extra edit: the file's `gh`
shim turns every create line into a create plus an edit, so there is no
separate reconcile list to extend.
- The labels are CREATED only when the seat or the maintainer runs `bash
scripts/pm/ensure-pm-labels.sh` (create-if-missing). This PR creates
nothing.

## Tests

- `bash -n scripts/pm/ensure-pm-labels.sh`: exit 0.
- `pnpm check:pm-label-desc-cap`: exit 0. Its self-test runs the real
script against a fake `gh` in both modes, and the gate printed `44 label
descriptions … all ≤100 characters (longest: 100, tooling)`. The checker
sets a FLOOR on parsed descriptions, not an exact count, and lists no
labels by name, so no fixture change is needed.
- Fake-`gh` run of `--reconcile` (a `gh` stub on PATH, no network): exit
0, and the stub log shows `label create` plus `label edit` for both
`pinned` and `work-in-progress` with colour `cfd3d7` and the
descriptions above.
- No ablation: no test pins this behaviour, and the diff is a vocabulary
script.

## Acceptance notes

- Five-repo question not measured: `pm:mailbox` sits in the five-repo
loop because a mailbox can be opened on any board. `GET /labels/pinned`
and `contents/.github/workflows/stale.yml` on objectui, cloud, objectos
and hotcrm returned 403 from the measuring session, so whether those
repos run a stale sweep is unknown. These rows stay main-repo only,
where the reader is measured. Widening them is a vocabulary decision.
- Whether the relay's `pr_create` labels leg auto-creates a missing
label is still unmeasured, as the card says. Once this lands and the
script runs, that question no longer matters for `pinned`.

## Verification

<details><summary>Derived gate families (26), at a419e3c</summary>

`node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack` derived 26 families. Each one was run
locally with its exit code captured before any pipe, and every one
exited 0. They include `pnpm check:pm-label-desc-cap`,
`check:nul-bytes`, `check:bash32-floor`, `check:entry-guard`,
`check:whole-set-label-write` (plus self-test), `check:self-test-wired`,
`check:closing-keyword-parity` and `check:comment-mask-corpus`. `--ran`
reconciliation: `26 derived famil(ies) accounted for — 26 run, 0
NOT-MEASURED (a DERIVED zero — all 26 recorded an exit code and none of
them is 3)`. CI families: see this PR's check-runs.

</details>

---
_Generated by [Claude
Code](https://claude.ai/code/session_01QSeKYmhU5KEj1nukYhp1Tg)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

scripts/pm/ensure-pm-labels.sh

@@ -367,6 +367,37 @@ gh label create needs:upgrade-harness -R objectstack-ai/objectstack -c 006b75 -d
 # families.
 gh label create needs:contract-review -R objectstack-ai/objectstack -c bfdadc -d "Marker only — PR awaits its at-tier Contract review PASS; no check reads it, the record decides" 2>/dev/null || true
 
+# pinned and work-in-progress — the two STALE-SWEEP EXEMPTION labels. Their
+# reader is a WORKFLOW rather than a query: `.github/workflows/stale.yml`
+# (actions/stale) skips any issue or PR carrying one of them. Like the needs:*
+# rows above they are not PM states, not lanes and not routing seams: one-of
+# with nothing, they block no dispatch, and no sweep in scripts/pm/ reads them.
+# Measured 2026-10-28 on objectstack-ai/objectstack: both answered 404 — the
+# exemption the workflow declares for them was dead, because a label that does
+# not exist cannot be applied (triage grade 6464839941 on #27151: create both).
+#
+# pinned — named readers: stale.yml `exempt-issue-labels` AND
+# `exempt-pr-labels`, and `scripts/pm/mailbox-open.mjs` (PR #27143), which sends
+# it as STALE_EXEMPT_LABEL in PR_LABELS on every mailbox `pr_create`, so a
+# mailbox PR — never merged, often quiet for weeks — is not marked stale at 30
+# days and closed 7 days later. Applied by that tool, or by hand to any issue or
+# PR that must outlive the sweep.
+#
+# work-in-progress — one named reader only: stale.yml `exempt-pr-labels`. No
+# tool applies it; it is applied by hand to a PR that must survive a quiet
+# stretch. It is declared here so that the exemption the workflow already
+# declares is not dead — the alternative, editing it out of stale.yml, is a
+# Tier H change this file does not make.
+#
+# Main repo only, for the needs:* rows' reason: the workflow that reads them
+# lives here (the other four repos' workflows were not readable from the seat
+# that measured this — widening the rows is a vocabulary decision, not a
+# maintenance edit). Colour cfd3d7 is the sweep-exempt family `tracking` and
+# `status:parked` already share; `tracking` is itself in the same stale.yml
+# exemption list.
+gh label create pinned           -R objectstack-ai/objectstack -c cfd3d7 -d "Exempt from the stale sweep (stale.yml, issues and PRs); every pm:mailbox PR carries it" 2>/dev/null || true
+gh label create work-in-progress -R objectstack-ai/objectstack -c cfd3d7 -d "PR exempt from the stale sweep (stale.yml exempt-pr-labels); applied by hand, no tool sets it" 2>/dev/null || true
+
 # Routing labels exist only on the main backlog repo, and mark SEAM cards only
 # (file-at-destination ruling: pure sibling-repo fixes live in the target repo).
 #