fix(gates): an RC tag would have hijacked the metamodel-version baseline

`check-metamodel-version.mjs` diffs `expected-registry.json` against the last
release tag, chosen with `git tag --list 'v[0-6].*' --sort=-version:refname`.
git's version sort has no notion of a semver pre-release unless
`versionsort.suffix` is configured, and this repo configures none — measured in a
scratch repo, the descending order of four tags is:

    v1.0.1, v1.0.0-rc.5, v1.0.0, v0.25.0

So `v1.0.0-rc.5` sorts ABOVE the release it is a candidate for. The repo has
carried no pre-release tag until now, which is the only reason this has never
bitten; cutting a tagged RC introduces one, and from the 1.0 cut until the next
tag the gate would diff the vocabulary against a CANDIDATE rather than against
what adopters resolve.

The baseline is now the last STABLE tag. The exclusion is derived from the tag
string — a semver pre-release is exactly "a `-` after the version core" — not a
list of RC spellings, so any future pre-release scheme is covered by construction.

`pickBaselineTag` is extracted and exported so the gate's own test drives it
without git. Six cases, fed git's real output order; three go red with the filter
removed. The first case is deliberately the post-cut list `[v1.0.0-rc.5, v1.0.0,
v0.25.0]` and not one led by a higher stable tag, which would have passed either
way and proved nothing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NTcEKXTQMYt84fAjuw5A2M

Author: dmealing

scripts/check-metamodel-version.mjs

@@ -276,16 +276,28 @@ function diffChildren(baseKids, curKids, where, breaking, additive) {
 const git = (...args) =>
   execFileSync("git", args, { cwd: REPO, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
 
-/** The highest published release tag on the npm/PyPI/NuGet line (`v0.*` / `v1.*` …).
- *  The four registries cut together, so any one line dates the metamodel baseline. */
-function lastReleaseTag() {
-  const tags = git("tag", "--list", "v[0-6].*", "--sort=-version:refname")
-    .split("\n")
+/** The highest published STABLE release tag on the npm/PyPI/NuGet line (`v0.*` / `v1.*` …).
+ *  The four registries cut together, so any one line dates the metamodel baseline.
+ *
+ *  Pre-release tags (`v1.0.0-rc.5`) are excluded, and the exclusion is load-bearing:
+ *  `--sort=version:refname` has no notion of a semver pre-release without
+ *  `versionsort.suffix` configured, so it sorts `v1.0.0-rc.5` ABOVE `v1.0.0` — an RC
+ *  tag would keep winning the baseline after the release it was a candidate for
+ *  shipped, and this gate would then diff the vocabulary against a candidate rather
+ *  than against what adopters actually resolve. Derived from the tag string (a semver
+ *  pre-release is exactly "a `-` after the version core"), never a list of RC names. */
+export function pickBaselineTag(tagLines) {
+  const tags = tagLines
     .map((t) => t.trim())
-    .filter(Boolean);
+    .filter((t) => t && !t.includes("-"));
   return tags[0] ?? null;
 }
 
+function lastReleaseTag() {
+  // git already sorted these descending; pickBaselineTag only drops pre-releases.
+  return pickBaselineTag(git("tag", "--list", "v[0-6].*", "--sort=-version:refname").split("\n"));
+}
+
 /**
  * Read the baseline manifest, distinguishing "genuinely not there yet" (skip) from
  * "something went wrong" (fail). The previous form swallowed EVERY error into `null`,

scripts/test-metamodel-version.mjs

@@ -10,7 +10,7 @@
 //
 //   node scripts/test-metamodel-version.mjs
 
-import { classify, requiredBump, satisfies, parseVersion } from "./check-metamodel-version.mjs";
+import { classify, requiredBump, satisfies, parseVersion, pickBaselineTag } from "./check-metamodel-version.mjs";
 
 let fails = 0;
 const ok = (m) => console.log(`ok:   ${m}`);
@@ -335,5 +335,36 @@ else ok("2.0 → 1.9 is a REGRESSION across majors and must not satisfy");
 if (!sat("minor", "1.9", "2.0")) bad("1.9 → 2.0 moves forward across a major and satisfies a minor");
 else ok("1.9 → 2.0 moves forward across a major and satisfies a minor");
 
+// ---------------------------------------------------------------------------
+// Baseline tag selection — the gate diffs against the last STABLE release.
+// ---------------------------------------------------------------------------
+// `git tag --sort=version:refname` has no notion of a semver pre-release unless
+// `versionsort.suffix` is configured, so it sorts `v1.0.0-rc.5` ABOVE `v1.0.0`.
+// Measured, not assumed: with four tags in a scratch repo the descending order is
+// v1.0.1, v1.0.0-rc.5, v1.0.0, v0.25.0. An RC tag left in the candidate set would
+// therefore keep winning the baseline after the release it was a candidate FOR had
+// shipped, and this gate would diff the vocabulary against a candidate instead of
+// against what adopters resolve. These feed pickBaselineTag git's own output order.
+const stable = (label, lines, expect) => {
+  const got = pickBaselineTag(lines);
+  if (got !== expect) bad(`${label}: expected ${expect}, got ${got}`);
+  else ok(label);
+};
+stable(
+  "an RC tag sorted above its own release does NOT become the baseline",
+  // exactly git's descending output once v1.0.0 is cut alongside v1.0.0-rc.5
+  ["v1.0.0-rc.5", "v1.0.0", "v0.25.0"],
+  "v1.0.0",
+);
+stable(
+  "with only an RC above it, the last STABLE tag is the baseline",
+  ["v1.0.0-rc.5", "v0.25.0", "v0.24.5"],
+  "v0.25.0",
+);
+stable("a stable-only list is unchanged", ["v0.25.0", "v0.24.5"], "v0.25.0");
+stable("blank lines from git's trailing newline are ignored", ["", "v0.25.0", ""], "v0.25.0");
+stable("an all-pre-release list yields no baseline", ["v1.0.0-rc.5", "v1.0.0-rc.4"], null);
+stable("an empty list yields no baseline", [], null);
+
 console.log(fails === 0 ? "\nmetamodel-version classifier: all checks passed" : `\n${fails} failure(s)`);
 process.exit(fails === 0 ? 0 : 1);