[Release] Composer follow-ups from PR #2248: rehearsal preview tag, legacy-tag re-dispatch, semver changelog base, ungated composer suite

[Chris0Jeky]

Follow-ups from the PR #2248 reviews (release-page composer, #2234). None affects the v0.3.0-rc.1 publish path; all recorded at the two-round ceiling rather than fix-cycled.

• Rehearsals cannot preview the real page. A blank-tag no-publish dispatch resolves to v0.0.0-dryrun+<sha7>, so the composer always takes the prerelease fallback (no ## v0.0.0-dryrun UPGRADING section, no notes file) and the uploaded composed-page-body is not a preview of the page the real tag will render. Add a preview_tag dispatch input (prospective tag used only for rendering, never for publishing) so a rehearsal can prove the stable fail-closed path and show the actual body before the tag.
• Re-dispatching a pre-ci(release): compose the release page — download button first, BREAKING, highlights, grouped changelog #2248 tag fails at compose time. The workflow checks out the tagged commit (by design, Harden release-desktop.yml workflow_dispatch path: tag-input injection + dispatch provenance (spun out of #1303) #1795) and runs scripts/ci/compose-release-notes.mjs from it; v0.2.0 (48c05e1dc) has no such file, so a resumable re-publish of an older tag dies with MODULE_NOT_FOUND after the full build. Decide: run workflow tooling from the workflow revision (separate checkout path) while reading release content from the tagged commit, or document that pre-0.3 tags are not re-dispatchable.
• Changelog base is the globally newest stable, not the stable preceding the target. gh release list --exclude-pre-releases --exclude-drafts --limit 1 picks by release date; re-running v0.3.0-rc.1 after v0.3.0 exists would send previous_tag_name=v0.3.0. Select the newest stable tag that sorts before the target (semver compare against the tag being built); the same call is unretried under set -e (fails closed) — give it the same bounded retry as generate-notes.
• scripts/ci/compose-release-notes.test.mjs is not run by any workflow (33 tests). Add one node --test line beside the dispatch suite in ci-required.yml.
• extractUpgradingSection stops at any #/## line, including inside a fenced code block; relative anchors lifted from UPGRADING are dead links on a release page.

[Chris0Jeky]

[Claude lane claim v2]
lane: beta-platform-integrity (session taskdeck-beta-a5)
issue: #2250, items 4 and 5 only (the ungated composer suite, and extractUpgradingSection stopping inside fenced code blocks plus relative anchors that are dead on a release page). Items 1 to 3 (preview_tag input, legacy-tag re-dispatch tooling checkout, semver changelog base) are release-desktop.yml logic and stay open for a separate slice.
scope: scripts/ci/compose-release-notes.mjs (fence-aware section extraction; rewrite relative links and bare anchors lifted from UPGRADING.md to absolute blob/<tag> URLs so the release page renders working links), scripts/ci/compose-release-notes.test.mjs (red-first cases for a heading inside a fenced block, a fenced block that closes before the next real heading, a relative link, a bare #anchor, and an unchanged absolute link), and one node --test scripts/ci/compose-release-notes.test.mjs step in .github/workflows/ci-required.yml beside the dispatch and cache-contract suites.
branch: issue-2250/composer-fences-and-suite (worktree codex-2250-composer-fences-and-suite)
proving checks: node --test scripts/ci/compose-release-notes.test.mjs red first then green; node --test scripts/ci/release-desktop-dispatch.test.mjs and scripts/ci/release-cache-contract.test.mjs unchanged and green; node scripts/ci/compose-release-notes.mjs dry run over the repository's UPGRADING.md for the current tag shape; workflow lint on ci-required.yml (node scripts/ci/smart-ci/*.test.mjs if the workflow contract tests cover it).
merge disposition: scripts/ci/** and .github/workflows/** are control-plane; the PR is opened ready-for-review with its fresh-context review posted and parked for the maintainer under SC-10, like #2608 and #2610. Nothing on the v0.3.0-rc.1 publish path changes behaviour except link rendering inside the UPGRADING section.

[Chris0Jeky]

Items 4 and 5 are in PR #2684 (head 6150eb1, two fresh-context SHIP rounds), parked under SC-10 for the maintainer because it touches scripts/ci and ci-required.yml. Residuals recorded there for a later slice: (a) a fence left open inside the tag's section but closed by an unrelated fence lower in the document is not caught by the end-of-document guard and swallows the next version's section (cheap heuristic: a '## v' heading inside a fence within the lifted section is malformed); (b) an unterminated fence opened above the tag heading reads as a missing section rather than malformed; (c) fences indented four or more spaces inside list items are not recognised; (d) angle-bracketed destinations containing spaces are not matched. Items 1 to 3 (preview_tag input, legacy-tag re-dispatch tooling checkout, semver changelog base) stay open.

[Chris0Jeky]

[Claude lane claim v2]
lane: beta-platform-integrity (session taskdeck-beta-a5)
issue: #2250, items 1 to 3 (items 4 and 5 are in parked PR #2684)
scope: .github/workflows/release-desktop.yml and its contract suite scripts/ci/release-desktop-dispatch.test.mjs only: (1) a preview_tag workflow_dispatch input used solely for rendering the composed page on a no-publish rehearsal, never for publishing, so a rehearsal can prove the stable fail-closed path and show the actual body before the tag; (2) run the workflow's own tooling (scripts/ci/compose-release-notes.mjs and any sibling script the workflow revision ships) from the workflow revision's checkout while release content is still read from the tagged commit, so a pre-#2248 tag can be re-dispatched, or, if that split is unsafe for the checksum chain, document in the workflow header that pre-0.3 tags are not re-dispatchable and make the failure explicit before the build; (3) the changelog base becomes the newest stable tag that sorts before the target by semver instead of the globally newest stable by release date, with the gh release list call given the same bounded retry as generate-notes.
branch: issue-2250/release-rehearsal-and-changelog-base (worktree codex-2250-release-rehearsal-and-changelog-base)
proving checks: node --test scripts/ci/release-desktop-dispatch.test.mjs red first then green for each item; node --test scripts/ci/smart-ci/*.test.mjs; node scripts/check-github-ops-governance.mjs; workflow lint as the repo runs it; a local dry run of any extracted shell or node logic (semver ordering, base selection) with fixture tag lists.
merge disposition: control-plane; opened ready-for-review with its fresh-context review posted, then parked under SC-10 for the maintainer, like #2684, #2608 and #2610. Nothing on the v0.3.0-rc.1 publish path changes unless the maintainer merges it.