---
"@ux-team/tvu-design-system": patch
---

Add four share-material fields to the shipped `design-record` template and validate them in
the shipped `build-request-index.mjs`: `share_worthy` / `audience` / `one_liner` / `evidence`.

**Why.** The owner asked whether product-design work could accumulate somewhere that an
internal UX sharing session could then read from, instead of someone re-mining it each time.
Both pools already accumulate — product design into `<consumer>/docs/specs/*-design-record.md`
(`design-process.md` §交付收尾 #3 requires one per requirement), DS work into
`docs/internal/retrospection/`. What was missing was a **machine-readable marker**: measured
on 2026-09-10, only 1 of 42 retrospections carried any frontmatter at all, so "read from the
pool" degraded into opening every file by hand.

So no third pool was created — that would be a third source of truth that drifts. The two
existing pools each gained the same four fields, and the reporting side reads them live.

- **Field contract lives in one place only**: the header comment of
  `scripts/audit-share-frontmatter.mjs` (an internal gate, not shipped), which self-prints
  the contract on every run. The template and this validator carry pointers, never a second
  copy of the criterion.
- **`share_worthy: no` needs only that one field.** Deliberate low friction: most records are
  purely internal, and demanding four fields every time is exactly the noise level that gets
  a gate bypassed (meta-rules 触发器 K §退档条款).
- **Consumer side is warn-only, and that is not a downgrade of intent.** A missing marker
  emits a warning and the index still builds; an *invalid* one fails. Hard-failing on
  "missing" would immediately break every consumer that already has design records (MicroApps
  has several). ⛔ Do not describe the design-record side as L4 — that claim would be false.
  The blocking layer (L4 pre-commit + L5 pr-checks) covers only newly added files **inside
  the design-system repo**.
- Opting in is validated strictly: `share_worthy` ≠ `no` requires `audience` (from a closed
  set), `one_liner` (10–120 chars) and `evidence`. That path is unreachable for existing
  records, which carry no `share_worthy` at all.

Verified on a fixture consumer root with three records: an opted-in-but-incomplete record
exits 1 and names the missing field; a legacy record with no markers warns and the index
still writes; a fully marked record passes clean. The repo's existing
`tests/upstream-gate.test.ts` (31 tests, the only suite touching this parser) still passes.