No hand-maintained parallel copy of what an authoritative source already knows. The copy is written carefully, by someone looking directly at the source, and it drifts anyway: sooner or later an entry is missed, and a missed entry ships silently. This is not a risk but a rate — when one project converted five such lists, five out of five had already drifted.
Three remedies, in order of strength:
- Derive the projection from the source. A registry query, a generated view. Drift becomes impossible; a new entry extends every projection with no edit.
- When it must stay code, guard the property, not the list. A test that asserts “the list contains these names” is the drifting list in a costume. Assert the invariant — any change that alters the output must alter the projection — and fire the guard once to prove it catches (DP-6).
- When a hand list must remain, choose its failure polarity and say so in a comment. Fail-safe (the missed entry still works, suboptimally) and fail-loud (the miss is immediately visible) are both acceptable. Fail-stale — the miss ships as silently wrong behavior — is never acceptable, and it is the polarity a naive list has by default.
In this package, the decision index is rung 1 and the reference lint is rung 2.
Why fail-stale specifically is the unacceptable polarity, rather than merely the worst of three: it is the silent one, and DP-015 is the general form — a missed entry that ships as wrong behaviour is indistinguishable from a complete list, so nothing about the system reports the gap.