ci(changeset-gate): a level-axis reading that did not happen no longer concludes success, and the PR body is re-read on edited - #16897

Part of #16776 — the two defects the card carries. It does NOT close the card: this PR lands the gate half, and the card's second direction for defect B (the declaration written at PR-creation time) reaches .claude/agents/os-dev.md, a governed surface no seat here may land. See "What is deliberately NOT here".

⛔ Not addressed here: 16361, the same gate's opposite direction (a false red from predicate scope). Untouched by this diff, held by the PM seat behind this PR.

The defect, re-driven before it was fixed

The card's Boundaries block says every reading in it is second-hand and was not re-driven by triage. It was re-driven here, on this branch's base, with the real script and real --event payloads, on the very commit the card names (273247e56f, PR 16342's pre-fix head — @objectstack/spec: patch and @objectstack/runtime: patch beside a diff that moves both packages' src/**).

The firing control is what makes row 3 readable: rows 1 and 2 refuse the byte-identical tree, so row 3's green was about the declaration and never about the diff.

Correction to one inherited reading, re-derived from the file rather than the card: the card and its source comment both say the Check Changeset job "skips label events". On this base it does not — only Check PR Size and Auto Label carry that exclusion. Nothing in defect B depends on it (there was still no edited trigger), but the sentence should not be inherited.

Defect A — what changed, and why it had to be the conclusion

NOT MEASURED was one verdict at exit 0, so the check run concluded success whether the reading had passed or had never happened. It is now split by the only question that matters — could the missing reading have changed the answer?

• not-measured-moot — no changeset grades patch a package whose packages/*/src/** this diff moves, so yes and no reach the same verdict. Exit 0, and the line now says why it is green rather than printing a tick that means nothing.
• not-measured-material — a patch sits on a package this diff grew, so the declaration is the difference between clean and enforce, and it was not readable. Exit 1, naming the changeset, the package, and both declarations.

⛔ No tolerance, no allowlist, no comment-only heuristic, and nothing was weakened to make a case go green: the explicit Clause-②: no remains a pass on the very tree the unread reading refuses, and every previously-refusing input still refuses.

Why the conclusion route and not the output/summary route. Measured, not assumed, on a real run of this job (Check Changeset, job 101999797457, 2026-09-08): the check run's output.title is null and its output.summary is the empty string. A GitHub Actions job publishes no check-run output of its own, so "put it in the summary" is not a cheaper spelling of the same fix — it is a request for a second mechanism (a checks: write API call creating a check run) whose only readers would be human.

⚠️ One inherited premise did NOT survive re-driving, and it narrows the claim rather than the fix. The card says the required-check set reads the conclusion. Check Changeset is not in that set: read live from ruleset 12119582 (repository-sourced, active, includes_parents=true returns only it), the required contexts are TypeScript Type Check, Test Core, Dogfood Regression Gate, Build Core, Temporal Conformance (live PG + MySQL), Lint and Repo Gates, Governed Surface Queue Guard. So this gate is advisory at the ruleset layer — and that makes the conclusion route stronger, not weaker: the conclusion is the ONLY authority this gate has (the red X, gh pr checks, every summary view), and it is the same authority through which its "you forgot a changeset" verdict is enforced today. A step log is one layer below the only surface that carries this gate at all. That the set does not include it is recorded in the acceptance notes below, not fixed here.

Defect B — edited, and what it costs

The remedy for the new refusal is a PR-body edit, and a pull_request payload is a snapshot that rerun_failed_jobs replays. Without an edited trigger the red could not be cleared by anything short of pushing a commit — the permanently-red-by-construction shape 5580 and 6378 exist to remove. So the two halves of this card are one change: A's refusal is unshippable without B.

pr-automation.yml now subscribes to edited, exactly as this repo's two other PR-body-scoped blocking checks (duplicate-fix-guard.yml, partof-closing-keyword-guard.yml) already do, and for the argument their headers already carry.

Added run volume, measured (2026-09-01 to 2026-09-08, this repo's own run counts through GET /actions/workflows/FILE/runs?event=pull_request):

The two edited readings agree exactly, which is the control on the arithmetic; a paths-filtered workflow over the same window returns 1363, which is the control that the endpoint is not answering with a constant. So edited is about 557 events / 8 days, ~70 a day, about +15% on this workflow's own 3684 — and it buys one job, not three: Check PR Size and Auto Label are excluded from edited by the same sentence they already carry for label events (a title or body edit moves no file), which also keeps their behaviour byte-identical to before. One Check Changeset job is ~46s (measured on the same job above).

⚠️ Deliberately NOT filtered to github.event.changes.body. It would trim title-only edits, and its failure direction is this defect returning silently: an expression that misjudges changes.body on an empty previous body stops the gate re-reading and nothing says so. 70 runs a day does not buy that risk.

Blast radius, measured on the population rather than argued

Every one of the 45 most recent merges to main, judged with the real script against each PR's real body and labels, before and after this change (31 judged, 14 exempt by skip-changeset):

• 25 of 31 already carry a readable declaration — the line is routine, not a new obligation.
• 6 read NOT MEASURED. Five are moot (a forced yes still reaches clean), so they stay green and now say why.
• Exactly one flips 0 to 1, and it is the true positive: 16775, whose body writes the declaration inside a sentence rather than at the start of a line, so the gate read nothing and concluded success over @objectstack/spec: patch beside a 124-line move in packages/spec/src/api/rest-server.zod.ts. Its author had done the thinking and written it down; the gate could not read it and said so where nobody with merge authority looks. That is this card, live, after the fact.

The whole population is its own control: every other row is byte-identical before and after.

Two lanes that must NOT be able to red, and are pinned so

cut-rc.yml runs this same script over a whole RC snapshot range on a workflow_dispatch, where there is no pull request and no declaration to read. A rule that reddened there would be unshippable, so the absence of a pull_request payload is its own verdict (no-pull-request, exit 0) rather than an unread declaration — and the same absence ON a pull_request run is a failure instead, because the runner writes that file. The self-test pins both directions, pins that no cut-rc.yml call site grows an --event, and pins that cut-rc.yml stays off pull_request triggers.

The stand-down lane needs a positive payload: false from the reader: a caller that omits the flag falls through to the lanes that can refuse. Unknown provenance enforces.

Verification

• node scripts/check-changeset-no-major.mjs --self-test — 179 assertions, exit 0. The LEVEL battery grew 41 to 56 cases and the wiring battery 15 to 22; both floors ratcheted to the new counts.
• Ablation 1 (the materiality split deleted, mutation proved on disk by blob hash and by counting the removed text): 6 assertions red, and the live specimen row returns to exit 0 — the defect itself, restored. Restore verified byte-identical (blob 46edc93a6) and green again.
• Ablation 2 (edited removed from the trigger list, same proof): the wiring assertion reds by name, quoting the trigger list it read. Restore verified byte-identical (blob 6f349934a) and green again.
• Full repo lint, not a narrowed one: node --stack-size=4000 node_modules/eslint/bin/eslint.js . --no-inline-config over 6376 files, 0 errors, 0 warnings, exit 0, at commit 675e3d0a50.
• The gate family derived by node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack from the working change set: 50 commands, 49 green. The one exception is pnpm check:pm-dispatch-gates, which exceeded the container's foreground limit twice while a sibling agent held the same gate; it is reported as NOT MEASURED rather than as a pass or a failure, and CI runs it.
• No changeset, skip-changeset instead, measured rather than assumed: all 23 published packages ship dist, README.md and CHANGELOG.md and nothing else (positive control: dist present in 23 of 23), so no files[] entry can carry .github/** or scripts/**.

What is deliberately NOT here

The card's second direction for defect B — requiring the Clause-②: line in the PR body from the first push — is partly a change to os-dev's own contract in .claude/agents/os-dev.md. That path is a governed surface (docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md), so it is not in this diff and is not this seat's to land. The gate half stands on its own and does not depend on it: this PR refuses only where the missing declaration decides the verdict, which is a much narrower demand than "every PR must declare".

验收备注

• Check Changeset is not in the repository's required-status-check set (measured above). A gate that carries a maintainer ruling being advisory at the ruleset layer is a fact worth someone's decision, and it is a repository setting no PR can change — noted for the maintainer, not filed and not fixed here.
• The edited trigger fires on title edits too. Left unfiltered on purpose, with the argument and the volume above.
• The residual this change does not close: a PR that carries allow-major skips the whole guard step, this axis included. Unchanged, and already recorded in the script's own header.

Generated by Claude Code