fix(release): refuse a Version Packages PR whose queue build lands behind main; mark next.2's 11 missed changesets

[objectstack-fleet]

Fixes #23818

Clause-②: no

What this PR does

Each Version Packages cut now records, by itself, what the previous cut shipped without a CHANGELOG entry. It never refuses or holds a release.

• New mode annotate-shipped in scripts/release-pending-publish.mjs.

  • It finds the last version commit and the changesets that sat unconsumed in its tree.

  • Each one still pending gets this lead line:

    **Shipped in VERSION**, whose CHANGELOG missed this entry; listed here one prerelease late.

  • changeset version then renders that line as the entry's first line under the next version.

• One package.json line. The root version script runs the step first, joined with ; so it cannot stop the version pass:

  node scripts/release-pending-publish.mjs annotate-shipped; changeset version && ...

  Every caller of pnpm run version gets it with no workflow edit.

• The merge-queue refusal is withdrawn. The queue-guard mode, its batteries and the lint.yml step are gone, and lint.yml has no diff against main. This PR is not governed: check-governed-merges --branch reads 0 of 2 paths.

• The 11 next.2 entries already landed in docs(changeset): mark the 11 changesets 18.0.0-next.2 shipped without a CHANGELOG entry #23835 (3c080a65c). This branch merged main, so its diff is 2 files: package.json (+1 / -1) and the script (+501 / -26). That is 529 changed lines.

Root cause: why #21373's guard did not catch next.2

#21373 added release-pending-publish.mjs unconsumed. release.yml's release-integrity job runs it in the push that carries the version commit.

• It lists every top-level .changeset/*.md in that commit's tree that pre.json does not record as consumed.
• It reports them as a ::warning:: and a job-summary section.
• Its contract: "The report never refuses a release."

On next.2 it measured correctly. Run 38841989023 (the push of e5136ff10f, 02:44Z) carried the warning 11 changeset(s) from 10 commit(s) are still in the tree of the version commit e5136ff10f .... The publish job started at 02:47:48Z. The miss was about timing, not pre mode:

• It reads after the landing. By then the CHANGELOG files are sealed into the version commit the publish ships. It only warns, and nothing acts on the warning.
• Pre mode played no part. @changesets/cli v3 moves what a prerelease pass consumes into .changeset/pre/, and pre.json lists no ids, so the top-level read is right in pre mode.

The card's premises, checked in a full-history clone:

• Ancestry. Each of the 11 add commits is an ancestor of e5136ff10f (exit 0) and not of the PR's base 4fe8b3def0 (exit 1). Control leg: root against 4fe8b3def0 gives exit 0.
• Not consumed. None of the 11 is under .changeset/pre/ at e5136ff10f.
• No CHANGELOG entry. No ## 18.0.0-next.2 section names any of them.

Why not refuse the landing

The maintainer asked, verbatim: 「23833 做的对吗？发版本的时候 main 上的队列就是不停在合并的」

The seat measured it (record 6211287288 on this PR):

• In the 24 h to 2026-10-16T08:00Z, main took 111 first-parent landings, and 77 of them added a changeset: about 3.2 an hour, with at least one in every hour.
• Queue time runs 18 to 33 minutes.
• So a refreshed Version Packages PR would get through a refusing guard about one time in ten, and the guard would turn a mis-dated CHANGELOG line into a release blocker.

The detection was right; refusing was the wrong remedy. This PR keeps the detection and moves the remedy to the next cut.

The annotate step

1. Find the last version commit on HEAD's first-parent chain, by select's definition: the CLI version differs from the first parent's.
2. Take the changesets left unconsumed there, the same set unconsumed reports. They are read from that commit's tree alone (pendingChangesetsAt, which unconsumed now shares), so the step needs history only back to that commit's parent.
3. Annotate each one still pending. The lead line goes right after the frontmatter, and every other byte is unchanged.
   • It is idempotent: a body whose first line already starts with **Shipped in is left as it is. That covers a second run and the hand-written lines from docs(changeset): mark the 11 changesets 18.0.0-next.2 shipped without a CHANGELOG entry #23835. The step's text differs from docs(changeset): mark the 11 changesets 18.0.0-next.2 shipped without a CHANGELOG entry #23835's only by docs(changeset): mark the 11 changesets 18.0.0-next.2 shipped without a CHANGELOG entry #23835's card number.
   • It annotates only when VERSION is on npm. A version commit nobody published shipped nothing, and its changesets then land in the next CHANGELOG correctly.
   • The line says "release" instead of "prerelease" for a version with no prerelease tag.
4. It never blocks.
   • The mode exits 0 on every path, and the ; keeps even a crash from stopping changeset version.
   • When it cannot decide, it prints a ::warning:: and writes nothing. That covers no version commit, unreachable history, an unreadable tree or pre.json, and npm unreadable.
   • A changeset it cannot parse is skipped with its own warning.
5. A shallow clone deepens itself, with bounds. It runs git fetch --no-tags --deepen=N origin HEAD-SHA with N = 100, 200, 400, 800, 1600, until the version commit and its parent are both present. It stops early, with a warning, when a round gains nothing. --no-deepen turns the fetch off.

Proof

Self-test. node scripts/release-pending-publish.mjs --self-test passes 112 cases across 28 batteries. The six annotate batteries:

• the next.2 shape (v3 pre-mode layout): exactly the 3 late changesets are annotated, with byte-exact output. A changeset added after the version commit and one consumed into pre/ are untouched. A CRLF changeset keeps its line endings, and a changeset with no fence is unparseable;
• a second run writes nothing, and every file stays byte-identical;
• a hand-annotated changeset (docs(changeset): mark the 11 changesets 18.0.0-next.2 shipped without a CHANGELOG entry #23835's form, card number included) is left byte-identical, and the other two are annotated once each, read from disk;
• non-pre mode (17.6.0 -> 17.7.0) uses the "release" form;
• a depth-1 clone deepens itself and annotates the same three, read from disk. With origin unreachable it warns, writes nothing, and the CLI exits 0. With --no-deepen it is undecided;
• the no-decision cases: no CLI manifest; a manifest born in the root commit; a manifest created later; a version not on npm (a plain line); npm unreadable; a run outside any git repository (the CLI exits 0 with a warning); an unreadable pre.json. Nothing is written in any of them.

Ablation. scripts/ablation-replace.mjs replaced the write writeFileSync(w.abs, w.next); with void w.next; (anchor 1 -> 0, blob 4bfd5209005c -> 9566045703cc). The self-test went red on 5 cases: byte-exact, second run, hand-annotated, non-pre, depth-1. Restore: the blob equals HEAD and git diff HEAD is empty.

Real history. The script is this branch's. Each clone below was made the way actions/checkout makes the version-pr job's (depth 1, sha-pinned) unless stated otherwise.

tree	result
origin/main 3fed1eb00, before #23835 landed	deepened by 100 commits in 6.9 s; last version commit e5136ff10f (next.1 -> next.2); exactly the 11 annotated; exit 0
same tree, second run	0 annotated, 11 already; tree byte-identical to the first run's
the same 11 compared with #23835's blobs	each differs only in that one line, by the (#23818) card number
#23835's head af52476f3	0 annotated, 11 already; nothing written
3c080a65c (#23835 landed; the base of the seat's 08:45Z re-cut of #23825, run 38875444505)	0 annotated, 11 already; nothing written
the re-cut #23825 head dedc6fe388	last version commit is the re-cut itself (next.3, not on npm), so "nothing shipped without an entry"; nothing written

The CHANGELOG renders the line once.

• Full pnpm run version, in a full-history clone of origin/main 3fed1eb00 with this branch's script and version line committed locally (never pushed): exit 0 in 14.5 s. The step annotated the 11, and next.3 carries the line on 19 entries across 12 packages, none twice.
• The seat's re-cut dedc6fe388 (built from docs(changeset): mark the 11 changesets 18.0.0-next.2 shipped without a CHANGELOG entry #23835's hand lines): 19 entries carry the line, none twice.

Every caller of pnpm run version, measured

caller	checkout	what the step does there	evidence
release.yml version-pr job, render step	depth 1 (default)	deepens the clone itself, then annotates	the depth-1 clone above (+100 commits, 6.9 s, exit 0). Moved paths with the step: 230; without (the old script on the same tree): 230, identical sets, so the SHAPE validation sees nothing new. All 10 content gates that step runs exit 0 on the annotated tree: check:docs-image-tag, check:docs-image-tag-sync, check:template-version-sync, check:release-index-currency-sync, check:skill-compatibility, check:nul-bytes, check:release-notes, check:release-page-status, check-release-section-coverage.mjs, check:published-readme-links
release.yml restore step, then changesets/action version-script (same job)	the deepened clone, after git reset --hard	annotates again on the fresh tree, with no second fetch; this is the tree the PR commits	the restore step's git checkout -- . puts the annotated files back with everything else; the 230-path set above is unchanged
cut-rc.yml	fetch-depth: 0	no fetch; annotates	its changeset gates run before pnpm run version; afterwards it stages .changeset wholesale, so the annotated files move to pre/ with the rest
local rehearsal (docs/releases-maintenance.md)	a clone of the shared checkout	exit 0, wrote only .changeset/ files	measured: it found next.1's version commit and annotated next.1's 6 leaked changesets (see Acceptance notes)

What to do about #23825 (next.3) now

#23825 was re-cut at 08:45Z from 3c080a65c, so it carries the 11 entries correctly. main has moved since (66d456d01, #23840), so as cut it is behind again.

Land this PR before the next.4 cut, then merge #23825 whenever the maintainer chooses. Whatever #23825 ships unlisted when it lands, the next cut annotates as "Shipped in 18.0.0-next.3". Nothing needs freezing or refreshing at merge time.

Acceptance notes

None of these is filed. The seat decides at landing.

• next.1 leaked too. Version commit 0c52e43075 (chore: version packages (next) #23382) left 6 changesets unconsumed: 23268-external-sharing-model-retired, 23268-skills-lint-rules-row, 23357-page-component-view-data-api-refused, 23387-two-master-names-release, 23397-ceremony-builtin-positions, 23399-ceremony-not-declared-column-drop. They shipped in next.1 and are listed in the published next.2 sections with no note: 0 next.1-section hits for each add commit. This is the same family as this card. This step covers every cut from here on; a published entry is corrected only by a docs-only amendment.
• The GA CHANGELOG will repeat the note. At pre exit, the GA CHANGELOG re-lists every prerelease changeset, so an annotated one carries "listed here one prerelease late" into the GA section too. The docs(changeset): mark the 11 changesets 18.0.0-next.2 shipped without a CHANGELOG entry #23835 lines do the same.
• The ADR-0087 pass line. check-adr-0087-registration's pass line counts inherited-breaking changesets as "non-breaking". Its inheritance exemption also does not re-ask an edited, already-breaking changeset for its disposition. This is read off the code.
• The post-landing warning's remedy. unconsumed's post-landing warning still says "Name them in the VERSION release notes". With this step, the next cut does that.

Local gates (final head 1cdd9d114, merge base 66d456d01)

• Derivation. node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 38 families. Each was run with its exit code captured before any pipe. All 38 exit 0. These include:
  • release-pending-publish.mjs --self-test;
  • check-self-test-wired and check-self-test-workflow-commands;
  • check:merge-driver and check:turbo-task-graph;
  • check:dts-closure, check:dual-build-cjs-loads, check:lean-entry-closure and check:sourcemap-no-sources-content, after a closure build under the verify lock (74/74 tasks, VERDICT command-exit 0);
  • pnpm check:pm-dispatch-gates (fast tier).
• Reconciliation: --ran reports 38 derived, 38 run, 0 NOT-MEASURED.
• Lint: eslint --no-inline-config scripts/release-pending-publish.mjs exits 0.
• Governance: check-governed-merges --branch reports 0 of 2 paths governed, 529 changed lines (+502 / -27). lint.yml has no diff against origin/main.

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · PATCH ROUND · PR #23833 (draft, head 1115d438b, closes #23818) · domain:devx seat 2 · session_016PVjjuVPte5XEJvaQx1E4t · 2026-10-16T07:41Z

Round 1 is accepted as far as it goes. The guard refuses nothing until it is wired, and the wiring is this round.

• Round 1, checked by this seat:
  • queueGuard judges only a merge_group build. It refuses a shallow clone, a missing or foreign base, and a base that is not an ancestor. It finds each version commit on the first-parent path base..head that moves the CLI version, and runs the existing unconsumedChangesets report on it. The verdict is behind when any of those commits leaves a changeset unconsumed. The ablation of that one line fails 5 cases.
  • On real history the guard gives the expected answer each time. chore: version packages (next) #23481's queue build exits 1 and names the card's 11 changesets. chore: version packages (next) #23825 squashed onto main 1ecb08a1c exits 1 and names feat(plugin-audit): sys_activity gains writer-stamped read-rule columns with an idempotent backfill, and the withheld-row rule is a predicate with no SYSTEM pre-scan (ADR-0139 E6) #23814's and fix(spec): four metadata type descriptions Setup shows are plain admin sentences #23817's changesets. chore: version packages (next) #23825 against its own base exits 0.
  • Route A matches the maintainer's ruling (6209999534 on release(next): 18.0.0-next.2 shipped 11 changesets with no CHANGELOG entry (the version PR merged behind main; #21361's class, in pre mode) #23818). Each of the 11 changesets gets one lead line, and every frontmatter is unchanged byte for byte.
  • The root cause is accepted, and it corrects the dispatch's premise. ci(release): the release-integrity audit names the changesets a version commit did not consume #21373's report did measure all 11 (run 38841989023). It runs after landing and only warns, and pre mode played no part.
• The seat's decisions on the two open questions:
  1. Wire the guard in lint.yml, lane Lint · CI, release & engine gates (option A). The seat read the lane on origin/main. It has no if: selector, lint.yml triggers on merge_group, and the lane already runs this script's self-test. The PR becomes Tier H and stays a draft until an authorised approval.
  2. Split route A out now (option B). The 11 lead lines are not governed. They go on a second branch as a Part of #23818 PR, which lands first, so chore: version packages (next) #23825 can be refreshed without waiting for the Tier H approval. This PR keeps the guard and closes the card. After the split lands, it merges main, and the 11 hunks drop out of its diff.
• Patch round:
  • Split. Branch claude/issue-23818-changeset-lead-lines from current origin/main, carrying only commit 15f51d126's 11 lead lines. Open it as a draft PR with Part of #23818 and no closing keyword.
  • Wire. Add one step to lint-ci-engine that runs node scripts/release-pending-publish.mjs queue-guard with the event and the group's base sha. Keep it away from feat(scripts): check:pnpm-flag-spellings — no committed pnpm call spells -s, --prod=VALUE, --production=VALUE or --no-production, which a global pnpm 11+/12 frontend rejects #23824's hunk near line 4057 in the same lane. Then prove three things:
    • the lane's verdict reads the new step with no roster edit;
    • the step answers "not a merge-queue build" on pull_request and push;
    • on a merge_group event it reads the full base sha from the event payload.
  • PR body. Give a replacement body for this PR and its sha256; the seat writes it (os-dev.md:64). Change "366 changed lines" to the measured count.
• Out of scope, noted and not filed in this act: the two check-adr-0087-registration observations in the report: the pass-line count, and the inheritance exemption read off the code. The seat decides at landing whether to file them.

---

Generated by Claude Code

[objectstack-fleet]

维护者速读 · #23833 · domain:devx seat 2 · 2026-10-16T08:13Z

• 改了什么: 合并队列里加了一道关，专拦落后于 main 的 Version Packages PR。这类 PR 进队时，关卡检查它的版本提交有没有漏掉生成之后才合进 main 的 changeset，漏了就拒绝入队，并提示先刷新再排队。普通 PR 只会看到一行"本次不涉及版本"。改动只有两处：scripts/release-pending-publish.mjs 新增 queue-guard 模式，lint.yml 的 Lint · CI, release & engine gates 车道加一步，这一步在必需检查 Lint & Repo Gates 之下。
• 为什么改: 18.0.0-next.2 的 Version PR 是从一个已经落后 main 的基线切出来的。结果有 11 个 changeset 的代码随 next.2 发出去了，CHANGELOG 里却没有。其中包括破坏性的 spec: PageTypeSchema says home is "the platform-level landing page" and utility a "floating utility panel", but the landing is the first navigation item and both types render as ordinary inline pages #23610：hotcrm 升级到 next.2 后 os validate 直接报错，而 CHANGELOG 里查不到原因。原来那道检查（ci(release): the release-integrity audit names the changesets a version commit did not consume #21373）其实测出了这 11 条，只是它在合入之后才运行，按约定只警告不拦截。现在待合的 next.3（chore: version packages (next) #23825）又落后 main 两条。
• 风险与代价(含回滚):
  • 代价：Version PR 只能在前面没有带 changeset 的 PR 时排队，否则会被退回，刷新后再排。
  • 风险低：关卡只读 git 历史，不发布、不写任何东西。对普通 PR 约 0.1 秒就放行，不在 merge queue 里时（PR、push、定时任务）一律放行。
  • 回滚：删掉 lint.yml 里新增的这一步，或 revert 本 PR。已发布的版本不受影响。
• 席位意见: 同意合入。关卡逻辑、接线位置、车道判定和真实历史上的五组读数，席位都逐条核过，详见下面的席位核对。那 11 条补记已拆到不受管的 docs(changeset): mark the 11 changesets 18.0.0-next.2 shipped without a CHANGELOG entry #23835，由席位先行落地，不等本 PR。
• 你要做的: 在 fix(release): refuse a Version Packages PR whose queue build lands behind main; mark next.2's 11 missed changesets #23833 留一条 Approve（os-zhuang 或 hotlong 任一）。批准之后，席位合并 main、等 CI 全绿，再转 ready、入队、确认落地。

席位核对 · ACCEPT · PR #23833 (draft, head 31e38ea07, Fixes #23818) · domain:devx seat 2 · session_016PVjjuVPte5XEJvaQx1E4t

Checked on GitHub and against the sources, not on the report's say-so. Round 1 was accepted in the patch-round record 6210600098. This record covers the patch round and the whole PR.

• Shape:
  • 13 files, +403 / −2, all inside the revised claim's surface on release(next): 18.0.0-next.2 shipped 11 changesets with no CHANGELOG entry (the version PR merged behind main; #21361's class, in pre mode) #23818. Eleven of them are docs(changeset): mark the 11 changesets 18.0.0-next.2 shipped without a CHANGELOG entry #23835's lead lines. Once docs(changeset): mark the 11 changesets 18.0.0-next.2 shipped without a CHANGELOG entry #23835 lands and this branch merges main, they drop out, leaving 2 files at +381 / −2. The dev measured that merge clean with git merge-tree.
  • Governed: .github/workflows/lint.yml is 1 of 13 paths, so this lands Tier H. It is under the 3000-line threshold.
  • The body's only closing keyword is Fixes #23818. Clause-②: no is at line start.
  • The seat wrote the body in this act from the dev's replacement, per os-dev.md:64. The sha256 is 7f770eb56bab…, it is 17389 bytes, and the read-back is identical.
• The wiring, read by this seat on the diff:
  • The PR adds one step to lint-ci-engine, right after Release version-commit selection self-test (hunk @@ -3328), well away from feat(scripts): check:pnpm-flag-spellings — no committed pnpm call spells -s, --prod=VALUE, --production=VALUE or --no-production, which a global pnpm 11+/12 frontend rejects #23824's step near line 4057.
  • The step has an id and continue-on-error: true, as the lane's collector expects. It runs queue-guard --event --base --head with github.event_name and github.event.merge_group.base_sha / head_sha passed through env, never interpolated into the script.
  • On origin/main the job has no if: selector, lint.yml triggers on merge_group, and the checkout is fetch-depth: 0.
  • The dev ran the real lane-verdict.mjs against the edited workflow. The new step is gate 15 of 60, and a red or unread outcome fails the lane, so no roster edit is needed.
• The guard:
  • On any event other than merge_group it answers "not a merge-queue build" and exits 0. CI shows this live: run 38869800551 (pull_request) ran the step green, and the lane verdict is green.
  • On merge_group it fails closed. It refuses a missing or short base, an empty or ref-name head, a base that is not an ancestor of the head, and a shallow clone.
  • It judges each version commit in base..head at that commit, so a later batch entry's changeset is not charged to this release.
  • Real history: chore: version packages (next) #23481's queue build exits 1 and names the card's 11. chore: version packages (next) #23825 squashed onto main exits 1 and names feat(plugin-audit): sys_activity gains writer-stamped read-rule columns with an idempotent backfill, and the withheld-row rule is a predicate with no SYSTEM pre-scan (ADR-0139 E6) #23814's and fix(spec): four metadata type descriptions Setup shows are plain admin sentences #23817's changesets. Both controls exit 0.
  • Self-test: 113 cases across 28 batteries. Disabling the behind branch fails 5 of them.
• Gates:
  • Local, by the dev: 68 derived families, 67 exit 0, --ran 0 NOT-MEASURED. The 1 exit 1 is check-empty-changeset --base on the 11 M rows, and it clears with the main merge after docs(changeset): mark the 11 changesets 18.0.0-next.2 shipped without a CHANGELOG entry #23835.
  • actionlint 1.7.7 found 0 issues on the edited lint.yml.
  • CI on 31e38ea07: 31 success, 7 roster skips, and 1 failure, Check Changeset. That failure is the same 11 rows and is not a required context; the required contexts on main are TypeScript Type Check, Test Core, Build Core, Lint & Repo Gates and Governed Surface Queue Guard.
• NOT MEASURED: a live merge_group checkout log (the job-log blob returns 403 from the container). The parsed fetch-depth: 0, and the guard's refusal of a shallow clone, stand in for it: a shallow checkout would turn the step red, never green.
• Out of scope: two check-adr-0087-registration observations (the body's Acceptance notes). The first is wording in the pass line. The second is an exemption read off the code and not exercised. The seat files neither: neither is a measured defect, and the second needs a reproduction before it is a card.
• Landing:
  1. This PR stays a draft. It carries needs-user-decision, and review is requested from os-zhuang and hotlong, all in this act.
  2. After docs(changeset): mark the 11 changesets 18.0.0-next.2 shipped without a CHANGELOG entry #23835 lands, the seat has this branch merge main (no history rewrite).
  3. After an authorised approval and green CI, the seat readies the PR, arms auto-merge and confirms the merge on origin/main.

---

Generated by Claude Code

[objectstack-fleet]

⛔ Approval request withdrawn: do not approve this head · domain:devx seat 2 · session_016PVjjuVPte5XEJvaQx1E4t · 2026-10-16T08:22Z

The seat's ACCEPT 6211127283 is withdrawn. The guard detects correctly, but refusing the queue build is the wrong remedy for how this repo's main lands.

The maintainer asked, verbatim: 「23833 做的对吗？发版本的时候 main 上的队列就是不停在合并的」

The seat measured it at this act:

• Landing rate. In the 24 hours since 2026-10-15T08:00Z, main took 111 first-parent landings, and 77 of them added a top-level changeset. Every clock hour in that span had at least one changeset-bearing landing, and the hourly average is about 3.2.
• The window. Queue time for recent PRs: fix(spec): four metadata type descriptions Setup shows are plain admin sentences #23817 31 min, feat(plugin-audit): sys_activity gains writer-stamped read-rule columns with an idempotent backfill, and the withheld-row rule is a predicate with no SYSTEM pre-scan (ADR-0139 E6) #23814 28 min, fix(devx): npm 10 crashes with edgesOut on the vendor-export probe and the blank scaffold — the probe installs with a pinned npm 11, the template overrides vitest #23799 18 min, chore: version packages (next) #23481 33 min. A refreshed Version Packages PR must get through the dispatch, the enqueue and that build with no changeset-bearing entry landing or queued ahead of it.
• The result. At about 3.2 changeset landings an hour, a window of about 45 minutes passes clean roughly one time in ten (Poisson, e^−2.4 ≈ 0.09). So this guard would refuse most release attempts, and the only way through is to freeze the queue for every cut. That trades a mis-recorded CHANGELOG for a release blocker.

What replaces it (the next round on #23818). Instead of refusing, each new cut records the leak itself, with no human step:

• The cut already runs pnpm run version. Ahead of changeset version, a step will find the changesets that sat in the last version commit's tree unconsumed, the set ci(release): the release-integrity audit names the changesets a version commit did not consume #21373's unconsumed already computes.
• It gives each one the same Shipped in <that version> lead line that docs(changeset): mark the 11 changesets 18.0.0-next.2 shipped without a CHANGELOG entry #23835 adds by hand, idempotently, so a line already present is not doubled.
• It never refuses a release. When it cannot decide, for example when history is missing, it warns and annotates nothing.

That is the maintainer's route A, automated, and it needs no workflow edit. The lint.yml step is dropped from this PR, which then stops being Tier H, and needs-user-decision comes off when the reworked head lands here.

#23835 is unaffected and stays in the queue. Its 11 lines are what the automated step would write.

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · ACCEPT · PR #23833 (draft, head 1cdd9d114, Fixes #23818) · domain:devx seat 2 · session_016PVjjuVPte5XEJvaQx1E4t · 2026-10-16T09:24Z

Checked on GitHub and against the sources, not on the report's say-so. This record replaces the withdrawn ACCEPT 6211127283, and covers the redesign the seat ordered in 6211287288.

• Shape:
  • 2 files, +502 / −27, inside the revised claim's surface (6211304647 on release(next): 18.0.0-next.2 shipped 11 changesets with no CHANGELOG entry (the version PR merged behind main; #21361's class, in pre mode) #23818).
  • package.json: one line. The root version script now starts with node scripts/release-pending-publish.mjs annotate-shipped; and everything after it is unchanged. The root package is private: true.
  • scripts/release-pending-publish.mjs: annotate-shipped is added, and queue-guard is removed with its batteries.
  • .github/workflows/lint.yml has no diff against origin/main.
  • Not governed: this seat ran check-governed-merges --pr 23833 and it reads 0 of 2 paths. So needs-user-decision is removed in this act, and this PR needs no approval. The review requests to os-zhuang and hotlong from the withdrawn round are moot.
  • The body's only closing keyword is Fixes #23818. Clause-②: no is at line start.
  • The seat wrote the body in this act from the dev's replacement, per os-dev.md:64. It is 12580 bytes, sha256 2930ef81b827…, and the read-back is identical.
• The step, read by this seat on the source:
  • locateLastVersionCommit walks the first-parent chain over the CLI manifest, using select's definition. In a shallow clone it answers need-history, and annotateShipped deepens with git fetch --no-tags --deepen=N origin <sha> for N from 100 to 1600. It stops as soon as a round gains nothing.
  • It acts only when that version is on npm. If the version is absent, it writes nothing. If npm cannot answer, it warns and writes nothing.
  • It annotates pendingChangesetsAt(versionCommit).unrecorded, the set unconsumed reports, and skips files that no longer exist.
  • withLeadLine keeps the frontmatter fence byte for byte, follows the file's line ending, and treats a first body line starting **Shipped in as already annotated. That covers docs(changeset): mark the 11 changesets 18.0.0-next.2 shipped without a CHANGELOG entry #23835's 11.
  • A failed write puts back the files it already wrote. Any exception ends in undecided with a warning, and the CLI exits 0. The ; in the version script means even a crash cannot stop changeset version.
• Measured by the dev:
  • Self-test: 112 cases across 28 batteries. An ablation of the single write fails 5.
  • A depth-1 clone of pre-docs(changeset): mark the 11 changesets 18.0.0-next.2 shipped without a CHANGELOG entry #23835 main deepens by 100 commits in 6.9 s and annotates exactly the 11. A second run is byte-identical.
  • 3c080a65c and the re-cut chore: version packages (next) #23825 head both annotate nothing.
  • A full pnpm run version gives 19 next.3 entries carrying the line once each. The moved-path set is identical to the old script's (230 = 230), and the 10 render-step content gates exit 0.
• Gates:
  • Local: 38 derived families, 38 exit 0, --ran 0 NOT-MEASURED.
  • CI on 1cdd9d114: 33 success, 6 roster skips, and 1 failure, Check Changeset ("adds no changeset"). The seat applied skip-changeset in this act: scripts/** and the private root package.json ship in no package.
• Out of scope, decided by this seat:
  • next.1 leaked too. Six changesets that shipped in next.1 are listed under next.2 with no note. This is the same family, so it is not filed. Every cut from here on is covered, and a published section changes only by a docs amendment, which is the release owner's call.
  • The GA note. At pre exit, the GA CHANGELOG repeats the lead line. That is accurate, and it is not filed.
  • Two check-adr-0087-registration observations. One is wording; the other is read off the code and not exercised. Neither is filed.
• Landing: once Check Changeset reads green on this head, the seat readies the PR, arms auto-merge, and confirms the merge on origin/main.

---

Generated by Claude Code