The windows-test-parity ratchet greps test source for fs.rmSync-without-
maxRetries (and six other Windows-portability anti-patterns), failing when an
integer offender COUNT exceeds a frozen baseline (rmSync: 95). A count ratchet
is a Goodhart metric: fixing one offender and adding another keeps the count
constant, so a new defect slips through green. Replace it — and every other
count ratchet in the repo — with a layered, masking-proof design.
Behavioral seam test
- tests/helpers-cleanup.test.cjs proves helpers.cleanup() carries the Windows
EBUSY retry budget. cleanup() delegates retries to Node's fs.rmSync via
maxRetries (it owns no loop), so the test asserts the option contract
(recursive/force/maxRetries>0/retryDelay>0) + real-FS removal + the cwd-guard,
rather than a loop that does not exist. The EBUSY risk is now tested ONCE at
the helper, not approximated textually at every call site.
Write-time ESLint rule (AST-accurate, replaces the grep)
- eslint-rules/no-raw-rmsync-in-tests.cjs (error in tests/**/*.test.cjs) bans
raw fs.rmSync, steering to cleanup(). Catches member, computed (fs['rmSync']),
destructured and aliased forms; escape hatch is inline
`// eslint-disable-next-line local/no-raw-rmsync-in-tests -- <reason>` only.
- Migrated 336 raw fs.rmSync teardown calls across ~116 test files to cleanup().
~18 genuinely load-bearing sites (mid-test SUT/fault-injection removals,
error-swallowing or name-colliding local teardown helpers) keep the raw call
with an inline eslint-disable + reason.
Shared anti-ratchet primitive
- scripts/lib/allowlist-ratchet.cjs:
- assertWithinAllowlist: fails on NOVEL ids (new offender introduced) AND on
STALE ids (a known offender was fixed but not pruned) — identity, not count,
and a ratchet DOWN toward zero.
- assertTightCeiling: a size/length budget whose ceiling must stay within a
grace band of the high-water mark, so budgets may only tighten, never creep.
Ratchets converted onto the primitive
- windows-test-parity-guard.test.cjs: rmSync rule deleted (now ESLint-enforced);
the remaining six patterns moved from integer baselines to named-set
allowlists with ratchet-down.
- scripts/lint-test-file-count.{cjs,allowlist.json}: per-module integer counts →
named filename sets (closes the swap-a-file-keep-the-count blind spot); a
module dropping under cap now FAILS to force pruning its allowlist entry.
- enh-2790 skill-count `<= 63` → named skill allowlist (ratchets toward ~58).
Size budgets hardened (tighten-only)
- agent-size / workflow-size / feat-3039 help-tiered: ceilings lowered to the
current high-water mark and an assertTightCeiling anti-creep check added per
tier. Fixed external-contract limits (description ≤100 chars, agent ≤100 KB)
are intentionally left as-is — they are not grandfathered creeping budgets.
No user-facing behavior change (tests + tooling only); no USER_FACING_PREFIXES
touched, so no changeset fragment is required.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* chore(#191): migrate gsd-sdk query call sites to gsd-tools query
Retiring the gsd-sdk shim. gsd-tools.cjs already accepts `query` as a
meta-prefix (gsd-tools query <command>), so this is a behavior-preserving 1:1
swap across the runtime reference prompts, the graphify hook's commit-detection
gate, and two bin/lib comment/message references.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* chore(#191): remove vestigial gsd-sdk shim code from installer + projection
The gsd-sdk shim was already not wired up (no gsd-sdk bin in package.json;
buildWindowsShimTriple had zero call sites). Remove the dead code:
- shell-command-projection.cjs: buildWindowsShimTriple + formatSdkPathDiagnostic
(+ their now-unused PACKAGE_NAME import) and exports
- install.js: the re-export wrappers + imports, the #3406 stale-standalone-sdk
detection (detectStaleStandaloneSdk/formatStaleStandaloneSdkWarning + its
global-install call site), and the exports
Preserved (retained, not gsd-sdk): buildCodexHookWindowsShimIR (#3426) — only
its comments referenced the gsd-sdk pattern; reworded. Also kept the
homePathCoveredByRc 'reopen your shell' branch in maybeSuggestPathExport — its
logic is bin-dir-agnostic, only the message mentioned gsd-sdk; reworded to use
the actual bin dir.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* test(#191): update tests for retired gsd-sdk shim
- bug-3441/bug-3442: drop the formatSdkPathDiagnostic / buildWindowsShimTriple
assertions (functions removed); retained PATH-action + drift-guard tests stay
- bug-505: remove the 'still exported' assertions for detectStaleStandaloneSdk /
formatStaleStandaloneSdkWarning / the shim contract surface (#505 kept them;
#191 removes them)
- graphify-auto-update: migrate the hook-dispatch inputs gsd-sdk query commit ->
gsd-tools query commit to match the migrated commit hook
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* docs(#191): point active docs at gsd-tools query (gsd-sdk shim retired)
Update the user/agent-facing docs (AGENTS, COMMANDS, CONFIGURATION, USER-GUIDE,
ship-pr-body-sections) that presented gsd-sdk query as a current command to
gsd-tools query. Historical docs (ADRs, PRDs, release notes) left untouched.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* docs(#191): correct state.load vs state.json description for gsd-tools query
Adversarial-review (codex) finding: the migrated USER-GUIDE line claimed both
'gsd-tools query state.json' and 'state.load' resolve to the frontmatter-rebuild
handler. Verified they don't — state.load returns the CJS load shape
(config + state_raw + flags), state.json returns the frontmatter shape. Both are
available via gsd-tools query; corrected the text to say so.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* chore(#191): add changeset for gsd-sdk shim retirement
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The hook detaches a background rebuild; the tests raced it two ways on
slow/contended Docker (Mac passed): (1) a tight ~2.2s status poll budget
expired before the detached rebuild wrote its terminal status -> "1 subtest
failed"; (2) cleanupHookRepo's rmSync threw EBUSY/ENOTEMPTY while the child
was still writing -> "failed running after hook".
Replace the ad-hoc poll budgets with a shared waitForBuildStatus() that
waits for the real terminal status ('ok'/'failed') under a generous 30s
deadline (all assertions are outcome-based, so this is deterministic, not a
timing assertion), and make teardown best-effort so a residual temp dir can
never fail a passing test. No production/hook code changed; no assertion
weakened.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(3803): replace wall-clock polls with Atomics.wait barrier (mirrors c22e869b)
Three execFileSync('sleep', ...) wall-clock deadline spins in
graphify-auto-update tests replaced with Atomics.wait-based atomicSleep
helper. This is the same pattern established in c22e869b (PR #3790) for
locking-bugs:180.
- cleanupHookRepo: 50 ms Atomics.wait steps instead of spawning a POSIX
sleep process per iteration while waiting for .rebuild.lock to clear.
- "completes to status=ok" poll: 100 ms Atomics.wait steps instead of
execFileSync('sleep', ['0.1']) while waiting for the detached rebuild
process to write the final status file.
- "completes to status=failed" poll: same fix.
The ceiling deadlines (4 s / 15 s) remain as timeout guards — they are
not the synchronization primitive. The CPU-yielding wait is now
Atomics.wait so no external process is spawned per iteration.
All 36 tests in the suite pass (node --test tests/graphify-auto-update.test.cjs).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(3803): replace wall-clock deadline polls with behavior-anchored iteration counts
The previous commit (752a5684) replaced execFileSync('sleep') with
Atomics.wait but kept the `Date.now() + 15000` wall-clock deadline
pattern in the two assertion-path polls. That is still the timing-flake
antipattern described in #3803: the loop bound is an absolute time, not a
function of the mock's known behavior.
This commit removes both `const deadline = Date.now() + 15000` /
`while (Date.now() < deadline)` loops and replaces them with
iteration-count bounds derived from the mock's declared sleepMs:
waitBudget = sleepMs + 2000 (2 s covers two bash spawn overheads:
hook script + detached rebuild subprocess)
maxIter = ceil(waitBudget / 100) (100 ms poll step)
The 2 s buffer absorbs process spawn + filesystem write latency without
anchoring to an absolute wall-clock value. If the budget is exhausted the
assertion below fires with a clear diagnostic instead of a silent
time-dependent pass.
Same antipattern fixed by PR #3793 (bug-1974-context-exhaustion-record).
Verified: 3 consecutive local runs, 0 failures each (~80-100 s/run).
Anti-pattern sweep results (Date.now() + N in tests/):
- tests/locking-bugs-1909-1916-1925-1927.test.cjs:291,448 — coordination
BARRIER backstops (wait for both subprocesses to reach gate), not
completion polls; different pattern, out of scope for this PR.
- tests/graphify-auto-update.test.cjs:286 — cleanupHookRepo backstop
(not an assertion path); acceptable.
- tests/bug-2962-windows-sdk-shim.test.cjs:132 — Date.now() + 20 (20 ms
relative offset used in a deadline expiry calculation, not a spin loop).
- tests/core.test.cjs:2006 — timeAgo(new Date(Date.now() + 5000)) (a
value assertion for the timeAgo utility, not a polling loop).
No additional assertion-path wall-clock polls found.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
