No, there’s a lot more.
I think I’ve found this, finally, but it took a lot more time and effort than I think it should have. Whoever decided that a data format, (yaml), was suitable for writing code, should be shot, drawn, and quartered.
It appears in this case, that the idiosyncrasies of how yaml handles duplicate fields or merging of fields led to the “only” restriction being eclipsed. And the linter didn’t notice, which also seems odd.
So this particular issue may be solved for me, but my meta issue - that there’s no easy way to trace or debug this - stands. There should be some form of tracing that exposes reasons why stages are/are not scheduled in any particular context. Such a tracer should probably also be capable of dumping the internal state of this “data” after the yaml substitution and eclipsing has been done. Either one of those would have given me the data to pinpoint this problem in short order. As is, I was doing a lot of blind guessing which is expensive labor.