fix: pre-landing review fixes (oxlint config counts as a gate edit; docs name the bin/ and rename limits)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

CONTRIBUTING.md

@@ -37,7 +37,10 @@ or repeated finding fails with `LINT_RATCHET_NEW` and its file, line and rule, a
 with `LINT_RATCHET_FIXED` until `bun run lint --write-baseline` locks it in (that flag only
 shrinks the baseline). The baseline records the oxlint version, which must match `package.json`'s
 exact pin; after bumping oxlint, run `bun run lint --write-baseline --oxlint-upgrade` in the same
-change. Editing `lib/cso/*.ts`? Run `bun run format:cso` before committing; CI runs
+change. Findings are keyed by file, so renaming or splitting a file moves its findings and they count as
+new: fix them, or mark an intended one with `// oxlint-disable-next-line <rule> -- <reason>`. oxlint
+picks files by extension, so the extensionless Bun scripts in `bin/` are not linted yet. Editing
+`lib/cso/*.ts`? Run `bun run format:cso` before committing; CI runs
 `format:cso:check`. All four run in the required `free-tests` check.
 
 Now edit any `SKILL.md`, invoke it in Claude Code (e.g. `/review`), and see your changes live. When you're done developing:

changelog.d/gsta203-pr4-oxlint-ratchet.md

@@ -1,11 +1,12 @@
-**gstack now lints its own JavaScript and TypeScript with oxlint, held to a ratchet (GSTA-203 PR 4).** CI had no JS/TS linter, and the one real error oxlint found (a second `import * as os` in `browse/test/commands.test.ts`) slipped past the product typecheck. `bun run lint` runs oxlint's correctness rules in well under a second and fails only on findings that are new; the 971 existing ones are recorded in a baseline that can only shrink.
+**gstack now lints its own `.ts` and `.js` files with oxlint, held to a ratchet (GSTA-203 PR 4).** CI had no JS/TS linter, and the one real error oxlint found (a second `import * as os` in `browse/test/commands.test.ts`) slipped past the product typecheck. `bun run lint` runs oxlint's correctness rules in well under a second and fails only on findings that are new; the 971 existing ones are recorded in a baseline that can only shrink.
 
 ### Added
-- **`bun run lint`** (`scripts/lint-ratchet.ts`, `.oxlintrc.json`, `scripts/lint-baseline.json`): oxlint 1.90.0, pinned exactly, with its correctness rules over the repository, skipping `design-html/vendor` and `test/fixtures`. Findings are keyed by file, rule and message, not line, so moving code does not churn the baseline. Each failure prints a stable code: `LINT_RATCHET_NEW` (file:line, rule, "Fix them; do not add them to the baseline" and a reproduce command), `LINT_RATCHET_FIXED` (run `--write-baseline`, which only shrinks), `LINT_BASELINE_INVALID` (an unreadable or malformed baseline, or one written by another oxlint version; never rewritten on its own), `OXLINT_MISSING` (run `bun install`) and `OXLINT_CRASH` (with the oxlint version and config path). After an oxlint bump, `bun run lint --write-baseline --oxlint-upgrade` rebuilds the baseline in the same change.
+- **`bun run lint`** (`scripts/lint-ratchet.ts`, `.oxlintrc.json`, `scripts/lint-baseline.json`): oxlint 1.90.0, pinned exactly, with its correctness rules over the repository, skipping `design-html/vendor` and `test/fixtures`. oxlint picks files by extension, so the extensionless Bun scripts in `bin/` are not linted yet. Findings are keyed by file, rule and message, not line, so moving code does not churn the baseline. Each failure prints a stable code: `LINT_RATCHET_NEW` (file:line, rule, "Fix them; do not add them to the baseline" and a reproduce command), `LINT_RATCHET_FIXED` (run `--write-baseline`, which only shrinks), `LINT_BASELINE_INVALID` (an unreadable or malformed baseline, or one written by another oxlint version; never rewritten on its own), `OXLINT_MISSING` (run `bun install`) and `OXLINT_CRASH` (with the oxlint version and config path). After an oxlint bump, `bun run lint --write-baseline --oxlint-upgrade` rebuilds the baseline in the same change.
 - **A lint step in the required `free-tests` check**, inside the existing typecheck job.
 
 ### Changed
 - **`browse/test/commands.test.ts`**: the duplicate `import * as os` is gone; the test asserts the same things. `scripts/typecheck-test-baseline.json` drops the matching TS2300 entry.
 - **Dependabot skips oxlint**, because a bump needs the baseline rebuilt by a maintainer.
 - **`lib/run-evidence.ts`**: `NAME`'s character class drops a needless `\/` escape that landed on main before the ratchet (the same strings match).
+- **`lib/gate-diff/classify.ts`**: `.oxlintrc*` and `oxlint.config*` count as lint configuration, so /review lists an edit to them as a gate edit.
 - **`docs/ship-policy.md`** (A lint finding that appears only in the train): when a stamp commit's lint step reports `LINT_RATCHET_NEW`, the slot owner fixes the finding on the PR branch as a new pin and the train is rebuilt, or the controller drops that slot. The baseline never grows.

lib/gate-diff/classify.ts

@@ -53,7 +53,7 @@ const CONFIG_BASENAMES = new Set([
   'karma.conf.js', 'playwright.config.ts', 'playwright.config.js', 'cypress.config.ts', 'cypress.config.js', 'phpunit.xml', 'phpunit.xml.dist',
   '.pre-commit-config.yaml', 'lefthook.yml', '.lefthook.yml', 'mypy.ini', '.flake8', 'ruff.toml', '.ruff.toml', 'biome.json', '.prettierrc',
 ]);
-const CONFIG_BASENAME_PREFIXES = ['vitest.config', 'jest.config', '.eslintrc', 'eslint.config', 'tsconfig', 'golangci', '.golangci'];
+const CONFIG_BASENAME_PREFIXES = ['vitest.config', 'jest.config', '.eslintrc', 'eslint.config', '.oxlintrc', 'oxlint.config', 'tsconfig', 'golangci', '.golangci'];
 /** Files whose hunks are config only inside a tool section (checked per hunk by `hunkTouchesToolSection`). */
 const SECTIONED_CONFIG = new Set(['package.json', 'pyproject.toml']);
 

test/gate-diff.test.ts

@@ -302,7 +302,7 @@ describe('gate-diff classify: floor matcher and CLAUDE.md block', () => {
     expect(classifyPath('.github/workflows/ci.yml', ctx)).toBe('ci');
     expect(classifyPath('.gitlab-ci.yml', ctx)).toBe('ci');
     expect(classifyPath('Jenkinsfile', ctx)).toBe('ci');
-    for (const p of ['vitest.config.mts', 'jest.config.js', 'pytest.ini', 'setup.cfg', 'tox.ini', 'bunfig.toml', '.eslintrc.json', 'eslint.config.js', 'tsconfig.build.json', '.rubocop.yml', '.golangci.yml']) {
+    for (const p of ['vitest.config.mts', 'jest.config.js', 'pytest.ini', 'setup.cfg', 'tox.ini', 'bunfig.toml', '.eslintrc.json', 'eslint.config.js', '.oxlintrc.json', 'oxlint.config.ts', 'tsconfig.build.json', '.rubocop.yml', '.golangci.yml']) {
       expect([p, classifyPath(p, ctx)]).toEqual([p, 'config']);
     }
     expect(classifyPath('x/__snapshots__/a.snap', ctx)).toBe('snapshot');