fix(#4282): register PATTERNS.md as a canonical .planning/ artifact (#4618)

* test(#4282): prove PATTERNS.md is unrecognized by the artifact registry

Regression test only, no fix yet: CANONICAL_EXACT in src/artifacts.cts was
never updated when workflows/graduation.md started writing .planning/
PATTERNS.md, same omission class as the already-fixed #3224 (WINDOWS.md).

Expected RED on this commit (src/artifacts.cts is unchanged).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(#4282): register PATTERNS.md as a canonical .planning/ artifact

CANONICAL_EXACT in src/artifacts.cts was never updated when
workflows/graduation.md started writing .planning/PATTERNS.md for the
`patterns` graduation-target category -- same omission class as the
already-fixed #3224 (WINDOWS.md). validate.health's W019 falsely flagged it
as unrecognized on every repo that has run the graduation scan.

Also backfilled 5 other pre-existing stale rows in
gsd-core/templates/README.md's artifact table (WINDOWS.md, STATE-ARCHIVE.md,
milestone.lock, state.json, skill-manifest.json) that were already in the
source registry but missing from the docs table -- found while fixing this
exact drift class, cheap to close alongside it.

RED proven on f3dd791fb8cda18196803e7144ce20e506d6490b (test-only commit,
gsd-test outcome:failed, exactly the new PATTERNS.md test failing).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* docs(#4282): fix stale function name in skill-manifest.json comment

Review finding: both the source comment and the new docs row said
"routeSkillManifest" -- no such symbol exists (verified via Memtrace); the
actual function is cmdSkillManifest (src/init.cts). Copied verbatim from a
pre-existing comment, not introduced by this PR, but cheap to fix alongside.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* docs(#4282): add changeset fragment

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* docs(#4282): backfill changeset PR number

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix: isolate lint-vendored-deps-manifest.test.cjs's fixRow tests from the real vendor file

Genuine, pre-existing defect found and fixed per this repo's no-defer policy
(discovered while investigating a real CI failure during this PR's own
merge attempt, user-directed investigation -- not deferred to a separate
issue since it was actively blocking work and root-caused with concrete
evidence, not speculation).

Root cause: fixRow(row) (scripts/lint-vendored-deps.cjs) unconditionally
does fs.copyFileSync(upstreamCjs, vendoredCjs) as its first line. All three
tests in the #4573 describe block called fixRow(row) with the REAL js-yaml
row, so all three wrote to the real, shared gsd-core/bin/lib/vendor/
js-yaml.cjs -- a file other test files' require() calls can read at any
moment, since node --test runs files concurrently in this repo.
fs.copyFileSync's write is not atomic against a concurrent reader on every
filesystem; a concurrent require() elsewhere caught the file mid-overwrite
and read a truncated file, crashing an entirely unrelated test
(m9-statelock-write-error-orphan.test.cjs) with a SyntaxError.

Confirmed via two real CI log fetches, not assumed: the exact same shard
grouping (same 308 files) ran clean ~90 minutes earlier during PR #4615's
own final merge CI, with the identical #3660 reap-fix code already present
-- ruling out a deterministic connection to that change and confirming a
genuine, non-deterministic timing race in this pre-existing test design.

Fix: all three tests now redirect row.vendoredCjs to a private os.tmpdir()
path via a cloned row object before calling fixRow, so the real vendored
file is never touched. upstreamCjs stays pointed at the real node_modules
copy (read-only, safe to share).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix: also isolate fixRow's package.json pin-rewrite from the real file

Review finding (major) on the previous race-condition fix: fixRow's pin
-rewrite path still hardcoded path.join(ROOT, 'package.json'), so the third
#4573 test still wrote the real, shared package.json -- read at module
top-level by dozens of other test files, the same concurrent-file race
class already fixed for the vendored .cjs copy.

Adds an optional pkgRoot parameter (defaults to the real ROOT) threaded
through readPinState/checkRow/fixRow -- fully backward-compatible, every
existing call site (the CLI --fix path, any other caller) is unaffected
since the default is unchanged. The pin-rewrite test now builds an isolated
temp root (its own package.json + node_modules/js-yaml/package.json) and
passes it explicitly, so the real package.json is never touched either.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix: use helpers.cleanup instead of raw fs.rmSync in test cleanup

CI caught it: local/no-raw-rmsync-in-tests flagged the three t.after temp-dir
cleanup calls added for the fixRow isolation fix. helpers.cleanup() carries
the Windows-EBUSY retry budget (maxRetries/retryDelay) that raw fs.rmSync
lacks.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Co-authored-by: sim <sim@local>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Tom Boucher
2026-09-10 22:46:18 -04:00
committed by GitHub
parent 1316e03b84
commit 523be34133
6 changed files with 101 additions and 35 deletions

View File

@@ -233,13 +233,17 @@ function checkHandAuthoredTwin(row) {
* installed version. Shared by checkRow (compares) and fixRow (rewrites) so
* the two can never silently diverge on how a pin is read.
* @param {VendoredPackage} row
* @param {string} [pkgRoot] Override for testing -- defaults to the real repo ROOT. Lets a
* test point fixRow's pin-rewrite at an isolated temp package.json instead of writing the
* real, shared one, which other concurrently-running node --test files read at module
* top-level (the same race class already fixed for the vendored .cjs copy).
* @returns {{pinnedSpec: string | undefined, installedVersion: string | undefined}}
*/
function readPinState(row) {
const pkgPath = path.join(ROOT, 'package.json');
function readPinState(row, pkgRoot = ROOT) {
const pkgPath = path.join(pkgRoot, 'package.json');
const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
const pinnedSpec = pkg.devDependencies && pkg.devDependencies[row.name];
const installedPkgPath = path.join(ROOT, 'node_modules', row.name, 'package.json');
const installedPkgPath = path.join(pkgRoot, 'node_modules', row.name, 'package.json');
let installedVersion;
if (fs.existsSync(installedPkgPath)) {
installedVersion = JSON.parse(fs.readFileSync(installedPkgPath, 'utf8')).version;
@@ -250,9 +254,13 @@ function readPinState(row) {
/**
* Run all applicable freshness checks for one vendored package row.
* @param {VendoredPackage} row
* @param {string} [pkgRoot] Override for testing -- defaults to the real repo ROOT. Lets a
* test point fixRow's pin-rewrite at an isolated temp package.json instead of writing the
* real, shared one, which other concurrently-running node --test files read at module
* top-level (the same race class already fixed for the vendored .cjs copy).
* @returns {string[]} findings (empty when the row is fresh)
*/
function checkRow(row) {
function checkRow(row, pkgRoot = ROOT) {
const findings = [];
const cjsDrift = compareFiles(row.vendoredCjs, row.upstreamCjs);
@@ -271,7 +279,7 @@ function checkRow(row) {
findings.push(...checkHandAuthoredTwin(row));
}
const { pinnedSpec, installedVersion } = readPinState(row);
const { pinnedSpec, installedVersion } = readPinState(row, pkgRoot);
if (!pinnedSpec) {
findings.push(`package.json devDependencies.${row.name} is missing`);
} else if (installedVersion === undefined) {
@@ -303,9 +311,13 @@ function checkRow(row) {
* after this runs, that is by design: the caller must not treat it as
* fixed.
* @param {VendoredPackage} row
* @param {string} [pkgRoot] Override for testing -- defaults to the real repo ROOT. Lets a
* test point fixRow's pin-rewrite at an isolated temp package.json instead of writing the
* real, shared one, which other concurrently-running node --test files read at module
* top-level (the same race class already fixed for the vendored .cjs copy).
* @returns {string[]} findings remaining after the fix (empty when fully resolved)
*/
function fixRow(row) {
function fixRow(row, pkgRoot = ROOT) {
fs.copyFileSync(resolvePath(row.upstreamCjs), resolvePath(row.vendoredCjs));
if (row.twinKind === 'upstream-verbatim' && row.upstreamDts) {
@@ -313,18 +325,18 @@ function fixRow(row) {
if (row.srcTwin) fs.copyFileSync(resolvePath(row.upstreamDts), resolvePath(row.srcTwin));
}
const { pinnedSpec, installedVersion } = readPinState(row);
const { pinnedSpec, installedVersion } = readPinState(row, pkgRoot);
if (pinnedSpec && installedVersion !== undefined) {
const newPin = `${pinOperatorPrefix(pinnedSpec)}${installedVersion}`;
if (newPin !== pinnedSpec) {
const pkgPath = path.join(ROOT, 'package.json');
const pkgPath = path.join(pkgRoot, 'package.json');
const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
pkg.devDependencies[row.name] = newPin;
fs.writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
}
}
return checkRow(row);
return checkRow(row, pkgRoot);
}
function main() {