#593 [Documentation] Record lessons from the Form audit PR

What

Writes down what the Form audit PR (#592) ran into, so the next component PR doesn't hit the same things.

• CLAUDE.md: a change under gem/lib/ruby_ui/ needs the MCP registry rebuilt (cd mcp && bundle exec exe/ruby-ui-mcp-build). CI's "MCP registry up to date" check failed on #592 until it was. The layout table no longer says the registry is only rebuilt in releases, and PR images now point to the pr-assets branch.
• shadcn-audit skill:
  • New section "Before/after images for a fix PR": keep the main report before fixing, shoot the same states after, compose main | PR | shadcn images, publish them to the orphan pr-assets branch with git plumbing, and link them by commit SHA. GitHub has no API to attach files to a PR; GitHub's own gh-aw (upload-assets) and Roborazzi also host PR images on orphan branches.
  • Step 2.6: pick a free port pair when another audit already holds 5179/3179.
  • Step 1: .shadcn-audit/ lives in the checkout, so removing the worktree deletes the runs.
• ruby-ui-stimulus skill: the "no fixed timeouts" rule gets one exception, setTimeout(fn) to treat a burst of browser events as one round (as in form_controller.js), and why queueMicrotask doesn't work there.

How to test

Docs only. I ran the pr-assets recipe in zsh without pushing: it kept the existing form-shadcn-fidelity/ folder and chained onto the current pr-assets commit.

🤖 Generated with Claude Code

---

Summary by cubic

Records what the Form audit PR (#592) ran into so the next component PR avoids the same issues.

• Any change under gem/lib/ruby_ui/, to dependencies.yml, or to VERSION now requires rebuilding and committing mcp/data/registry.json in the same PR; CI's registry check fails otherwise.
• Adds a recipe for publishing before/after PR images to the orphan pr-assets branch, linked by commit SHA, since GitHub has no API to attach files to a PR.
• The shadcn-audit skill now documents picking free ports when another audit holds the defaults, and that .shadcn-audit/ lives in the checkout and is deleted with the worktree.
• The Stimulus skill documents one exception to the no-fixed-timeouts rule: setTimeout(fn) with no delay to treat a burst of browser events as one round, and why queueMicrotask doesn't work there.