feat(ci): deliver the changeset claim re-read onto the pull request (objectui#9140)

[os-try-charles]

Fixes #9140

Director ruling, comment 5682891844 (batch #136 item 2, letter B, maintainer 「同意」):
check-changeset-claims findings are delivered, not archived. On a pull request CI runs the
gate against the PR's merge base and head and, when it names a pending changeset the diff may have
falsified, posts the finding as a comment on that PR — through the channel the Console Performance
Budget report already uses.

⛔ Report-only did not move. Exit 0 on findings, not a required context, nothing blocks. Letter
C stays fenced, letter A stays refused, and the --audit census from PR objectui#9410 is
untouched — the coordinate is ⛔ not widened. Delivery changes only where the finding is read.

What landed

file	what
scripts/check-changeset-claims.mjs	--json FILE hand-off: this run's finding set, written once, by the run that printed the log
scripts/render-changeset-claims-comment.mjs	new — renders the comment body from that hand-off
.github/workflows/changeset-presence.yml	job-level pull-requests: write, a render step and a delivery step
scripts/__tests__/render-changeset-claims-comment.test.ts	new — 20 pins on the rendering
scripts/__tests__/check-changeset-claims.test.ts	pins on the workflow wiring, the permission shape and the hand-off
content/docs/guide/ci-cd-pipeline.md	the delivery, documented in the section that already owns this gate

The three measurements the ruling asked for

1. The pull-requests: write grant is the existing one, ⛔ not a new permission. It is the
same GITHUB_TOKEN scope performance-budget.yml posts the budget report with; four other
workflows here hold it too (labeler.yml, changeset-release.yml, cross-repo-issue-closer.yml,
dependabot-auto-merge.yml). No new secret, no personal token, no GitHub App, and ⛔ no
pull_request_target — pinned by a test.

⚠️ One reading that has to be stated plainly rather than glossed: GitHub scopes permissions:
per workflow and per job, so there is no repository-wide grant to inherit and this is a new
line in changeset-presence.yml. What the ruling fenced — a permission this repository does not
already give a gate job — is not required. It is declared on the changeset-claims job alone, so
the declaration gate beside it keeps its read-only token.

2. "Against the PR's merge base and head" was free. The gate already resolves its base as the
merge base with the target branch and already accepts an explicit pair; actions/checkout on a
pull_request event checks out the merge result. Nothing in the tree resolution changed. ⇒ the
"is this a redesign" fork in the dispatch did not open.

3. The budget report is the channel, and only the channel. It posts with
actions/github-script and github.rest.issues.createComment — and it always creates: no
marker, no update, one comment per run. So the ruling's "one comment per PR, updated in place,
⛔ not stacked" is an addition here, ⛔ not a copy. What is reused is the channel, the retry and
continue-on-error shape, and the render-in-a-script-so-it-can-be-unit-tested discipline.

⛔ Why the marker is plain text and not a hidden HTML comment

The usual shape for "find my own previous comment" is a hidden HTML-comment marker. In this
repository that shape is measured not to work: AGENTS.md records that GitHub deletes tag-shaped
fragments from a stored body, that backticks and fenced blocks do not protect them, and that an
HTML comment alone on the first line is eaten with them.

A marker that vanishes does not degrade gracefully — every re-run fails to find its predecessor and
posts again, which is exactly the stacking the ruling forbids. So the marker is the first line of
the body in plain text, it renders visibly, and the workflow reads it off the body it is about to
post rather than carrying a second copy.

Same sanitizer, second half: the comment quotes a paragraph of somebody else's changeset, and that
prose routinely names components in angle brackets. Those spans are rewritten to
ANGLE-BRACKETS(name) on the way out, and the comment says so — but only when the rewrite actually
fired, so a standing disclaimer never teaches readers to discount a verbatim quote.

The probe commits, and why they are here

This pull request's own diff names no file any of the 1,597 pending changesets spells, so the new
step would correctly post nothing — and the ruling requires one measured delivery, not an
assertion. Commit 2 is a one-shot probe: six comment lines appended to
scripts/check-changeset-presence.mjs, a file two pending changesets name in backticks. Commit 3
reverts it, and the revert is itself the second measurement — the same comment updated in place to
its resolved state, ⛔ not a second comment.

⇒ The delivered comment on this pull request is the measurement. The run-by-run reading (comment
id, comment count per leg) is in the report comment on issue objectui#9140; this body is written
once and ⛔ not edited afterwards, because a PATCH here drops the session reference from the
footer and appends a second one.

Local verification

• npx vitest run over the seven test files that read a file this diff touches — 288 passed,
  including the 59 across the two files that own this gate.
• pnpm type-check:scripts exit 0; --listFiles confirms both new files are in that program
  (⛔ not excluded as tests).
• pnpm lint:root exit 0, 0 errors.
• 12 derived gates exit 0, among them check:changeset-claims, check:required-check-set,
  check:action-ref-convention, check:control-bytes, check:unreferenced-sources.
• node scripts/check-governed-queue-guard.mjs --test — NOT GOVERNED, 4 paths, none matched.
• node scripts/check-changeset-presence.mjs — no changeset owed; nothing published moved, which
  is the measurement behind skip-changeset rather than a judgement call.
• check:doc-snippets and check:doc-examples are NOT MEASURED locally: both refuse to run
  without a full package build (PREREQUISITE NOT MET), and this diff adds no fenced snippet.
  Declared to CI.

Acceptance notes

• render-budget-comment.mjs stacks one comment per run on every packages/** pull request, with
  no marker and no in-place update. Out of scope here and ⛔ not filed: noted only, since this
  change now puts a working in-place mechanism next to it in the same repository.
• runGate in check-changeset-claims.test.ts dropped stderr on the success path, so a harness
  reading a green run could not see a warning the gate prints. Fixed in place — it is the same
  defect class as this card and one line of the same file.

---

Generated by Claude Code

[github-actions]

changeset-claim-re-read

✅ Nothing pending names a file this change touches

An earlier revision of this pull request did. That request to re-read does not apply to the current diff.

This comment is updated in place on every re-run rather than posted again, so the thread does not grow one per push.

Compared the checked-out tree with 4b9a0a8f0 (merge-base with origin/main): 6 file(s) changed outside .changeset/, read against 1096 pending declaration(s) that publish a body (1597 pending in total). · run

[os-try-charles]

⛔ RED — Test (shard 1/4), and it is this PR's own. Patch round in progress.

domain:devx @ objectui seat, session_015h79niBMyoB1xcaQje3uiz, R60, 2026-09-16T02:09Z. Full verdict and the fix instruction: objectui#9140 comment 5690924118. Posting here so the blocker is legible on the PR itself.

What is failing — check-run 104633696429 on 855673c4b0:

AssertionError: expected [ Array(1) ] to deeply equal []
+ "detail": "reads markdown the ledger does not describe (.changeset/7165-grid-dependent-values.md)."
+ "kind": "unadjudicated-test",
+ "test": "scripts/__tests__/render-changeset-claims-comment.test.ts"
❯ scripts/__tests__/markdown-test-inputs.test.ts:288

The new test file this PR adds reads a changeset that scripts/markdown-test-inputs.mjs's ledger does not describe.

Ruled out as not-this-PR's before calling it ours: git cat-file -e origin/main:scripts/__tests__/render-changeset-claims-comment.test.ts ⇒ absent on main, so the failure cannot pre-exist. ⛔ Not a flake either — the job ran 18.8 min and failed on an assertion with the test body executed; 3 of 4 shards green. ⛔ No re-run is being spent: 「flake」 is not a root cause.

Why the fix is not pushed yet — an ordering constraint, not a stall. The file that must change, scripts/markdown-test-inputs.mjs, is held by PR #9582 (card objectui#9472), which this seat enqueued at 02:03:40Z and which is not merged yet. The dev is resumed and instructed to: wait for #9582 to merge → git merge origin/main → then add the ADJUDICATED entry → show red-before / green-after on the same command. Editing first and merging after would manufacture a conflict that ordering avoids.

⚠️ content/docs/guide/ci-cd-pipeline.md here is also touched by PR #9584 (objectui#9499), which is blocked on a maintainer ruleset click. This PR lands first; #9584 merges main afterwards.

---

Generated by Claude Code