[woodsonl]

⚠️ base-red inherited: #15306

Dedicated base-reds PR per AGENTS.md — no feature changes. Three CI defects red PRs against release/v3.8.52 regardless of their code (evidence: #15346, CI runs 37009496871 / 37337133696 / 37337133864, job 111855214488). None are listed in #15306 yet.

1. Cycles gate — fix(ci): run the fast-gates cycles gate in ratchet mode

Since #15281 (69cb18d), scripts/check/check-cycles.mjs exits 1 on ANY cycle unless --ratchet is passed; #15281 moved ci.yml to check:cycles:ratchet (ceiling quality-baseline.json → metrics.cycles = 14) but left quality.yml's fast-gates loop on the plain check. Every PR failed Fast Quality Gates → Gate / Quality with the same 14 SCCs.

Fix: move cycles from the gates array into ratchet_gates (the loop appends --ratchet), identical semantics to ci.yml.

Validation: npm run check:cycles → exit 1 (cycles=14); npm run check:cycles -- --ratchet (the exact command the loop now runs) → exit 0. Workflow-only change, checked with the gate script locally as allowed by the base-red protocol.

2. Complexity ratchet — fix(quality): diff new-code gates against the merge ref's first parent

PR_BASE_SHA comes from github.event.pull_request.base.sha, which stays at the commit the PR was opened against. The job tests a merge into the live base tip (HEAD is GitHub's merge commit, first parent = live base tip), so git merge-base <stale-sha> HEAD made the base's newer commits part of the diff. #15346 and #15322 were both blamed for FeatureFlagCard.tsx 1 → 2, a violation #12740 introduced on the base.

Fix: resolveMergeBase() returns HEAD^1 when HEAD is a merge commit and the base sha is an ancestor of it (exactly the PR's new code, matching GitHub's Files changed view). Linear/local HEADs and diverged branches keep merge-base semantics. Both consumers (complexity-ratchets, dead-code) route through this helper.

Validation (TDD): new unit tests in tests/unit/build/new-code-mode.test.ts build a real merge-ref-shaped git repo; the merge-commit test fails on the old implementation and passes with the fix (11/11 green).

3. Integration port race — fix(dev): retry the run-next listen on a transiently busy port

tests/integration/batch-e2e-rate-limit.test.ts picks SERVER_PORT via getFreePort() (bind 0 → close) at module load; run-next.mjs binds only after prepareWithHeal, 15-18s later. An occupant in that window killed the boot with listen EADDRINUSE → exit 1 (job 111855214488). The suite runs --test-concurrency=1, so the conflicts are transient (previous file's teardown), not a long-lived sibling.

Fix: new scripts/dev/listen-with-retry.mjs — bounded listenWithRetry (6 tries, 5s apart) that retries EADDRINUSE and rejects with the original error once exhausted; wired into run-next.mjs with the fatal post-listen error handler attached after a successful bind.

Validation (TDD + live repro): tests/unit/run-next-listen-retry.test.ts (3 tests: retry-to-success, exhaustion, free port) — red before the helper existed, green after; all 26 run-next-related unit tests green. Live repro of the defect: a 25s port squatter no longer kills the boot — the server logged 4 retries and bound after release (old code exits on the first attempt).

Notes

• test:unit files touched: 2 added/extended; no production routing/DB code changed.
• Changelog fragment to follow once this PR has a number.