Make the runtime boundary check blame only a PR's own increase (#15153)

Pull request runs now compare against the base branch, so a PR is judged
on its own change. Comparing absolute counts blamed every open PR for an
increase merged to main by another PR (#15136 after #15134). The check
nets increases out per Deno API and per std module before any file is
blamed, so a renamed file or a moved call is not a finding.

An increase is an error only for a Deno API that src/deno_ral covers
equivalently (build.os and build.arch, in scopes that can import it).
Every other increase is a warning on the added line, and the job
summary gives the per-scope delta and the baseline bump a maintainer
accepts with --accept-increase. Std imports get only a suggested
replacement, since a name check cannot show that a wrapper exports what
the file uses. Pushes to main and manual runs keep the absolute baseline
gate.

- Delta mode reads the baseline committed at the base revision. A PR
  that adds nothing while main is above baseline gets only a notice.
- Delta mode lists the whole base tree rather than passing every changed
  path to git, which keeps long comparisons under the Windows
  command-line limit.
- Counts use a prototype-free dictionary, so an identifier such as
  constructor is an ordinary key.
- src/core/lib is browser-shared and cannot import src/deno_ral, so an
  increase there is a warning, not an error.

Related to #15134, #15135 and #15136.

Author: cderv

.github/workflows/runtime-boundary.yml

@@ -1,7 +1,11 @@
 # Runtime boundary ratchet for the Deno -> Node migration.
-# Fails when the number of `Deno.` occurrences or direct std-library imports
-# (per scope: src, src-js, resources, package/src, tests) rises above
-# tools/runtime-boundary-baseline.json.
+# Counts `Deno.` occurrences and direct std-library imports per scope
+# (src, src-js, resources, package/src, tests). Two modes:
+#   - pull_request: compares the merge commit with its first parent (the base
+#     branch tip) and fails only for a Deno.* API that src/deno_ral replaces;
+#     other increases are warnings plus a maintainer block in the job summary.
+#   - push (main) and workflow_dispatch: fails when a count rises above
+#     tools/runtime-boundary-baseline.json.
 # See dev-docs/runtime-migration/02-runtime-boundary-check.md.
 name: Runtime Boundary
 on:
@@ -34,6 +38,8 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v6
+        with:
+          fetch-depth: 2
 
       - name: Set Path
         shell: bash
@@ -45,5 +51,12 @@ jobs:
 
       - name: Check runtime boundary
         shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
         run: |
-          quarto run --dev tools/check-runtime-boundary.ts
+          if [ "$EVENT_NAME" = "pull_request" ]; then
+            # The checkout is the merge commit: HEAD^1 is the base branch tip.
+            quarto run --dev tools/check-runtime-boundary.ts --against HEAD^1
+          else
+            quarto run --dev tools/check-runtime-boundary.ts
+          fi

dev-docs/runtime-migration/01-quick-fixes-from-spike.md

@@ -5,7 +5,7 @@
 
 **Goal:** Land the two runtime-neutral fixes the spike found: `with { type: "json" }` on the two dynamic JSON imports, and a deterministic (sorted) order for the bslib Sass files.
 **Phase:** 0.
-**Depends on:** 02 (lands first in Phase 0; this PR's test imports `tests/asserts.ts` and raises the `tests` baseline with `--accept-tests-increase`).
+**Depends on:** 02 (lands first in Phase 0; this PR's test imports `tests/asserts.ts` and raises the `tests` baseline with `--accept-increase`).
 **Unblocks:** PR 26 (the Node bundle job needs both).
 **Branch:** `rt/01-quick-fixes-from-spike`.
 **Suggested executor:** Sonnet.
@@ -75,7 +75,7 @@ export const bslibComponentRules = (): string; // unchanged signature; now `conc
 - `package/dist/bin/quarto dev-call build-artifacts` completes and `git status --short src/resources/editor` is empty (the bundles do not change).
 - `concatenateDirFiles` returns file contents in sorted-name order regardless of creation order (unit test).
 - `bslibComponentRules()` equals `concatenateDirFiles` of `bslib-scss` followed by `concatenateDirFiles` of `components/scss` (the five `bslib-scss` files precede the nine `components/scss` files) (unit test).
-- `quarto run --dev tools/check-runtime-boundary.ts` passes after `--update-baseline --accept-tests-increase`: `src` unchanged (the helper keeps the 2 `Deno.` calls the old loop had), `tests` +6.
+- `quarto run --dev tools/check-runtime-boundary.ts` passes after `--update-baseline --accept-increase`: `src` unchanged (the helper keeps the 2 `Deno.` calls the old loop had), `tests` +6.
 - `cd tests && QUARTO_TESTS_NO_CONFIG=true ./run-tests.sh --agent unit/format-html-bslib-order.test.ts smoke/site/render-site-themes.test.ts smoke/render/render-html.test.ts` is green.
 
 ## Plan
@@ -310,7 +310,7 @@ Remove `/tmp/rt01` afterwards.
 
 - [ ] **Step 6: Record the new test in the ratchet baseline**
 
-Run: `package/dist/bin/quarto run --dev tools/check-runtime-boundary.ts --update-baseline --accept-tests-increase && git diff tools/runtime-boundary-baseline.json` Expected: one `::warning::tests baseline raised from N to N+6 (Deno.* calls)` line; the diff changes only `tests.denoCalls` (+6, the six `Deno.writeTextFileSync` fixture writes; PR 09 provides `deno_ral` file writers for later tests).
+Run: `package/dist/bin/quarto run --dev tools/check-runtime-boundary.ts --update-baseline --accept-increase && git diff tools/runtime-boundary-baseline.json` Expected: one `::warning::tests baseline raised from N to N+6 (Deno.* calls)` line; the diff changes only `tests.denoCalls` (+6, the six `Deno.writeTextFileSync` fixture writes; PR 09 provides `deno_ral` file writers for later tests).
 List the file and its count in the PR description.
 
 - [ ] **Step 7: Commit**

dev-docs/runtime-migration/02-runtime-boundary-check.md

@@ -1,5 +1,7 @@
 # PR 02: Runtime boundary ratchet in CI, and `tests/asserts.ts`
 
+**Amended by:** PR 02c (PR-mode comparison, replacement maps, `--accept-increase`).
+
 > **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task.
 > Steps use checkbox (`- [ ]`) syntax for tracking.