fa41bfec5c
* test(#3942): failing-first suite for the emitted-drift ack commit trailer Binds 37 input classes from the phase test matrix to the behavior ADR-3942 specifies, before any of it exists. Stubs return benign empty values rather than throwing, deliberately: several rows assert that something DOES throw (cap overflow, uncomputable commit range), and a throwing stub would turn those green for the wrong reason and destroy the red. The two rows that carry the design's load: - merge-base semantics. The range is $(git merge-base base HEAD)..HEAD, not base..HEAD, because changedPaths comes from `git diff base...HEAD` (three dot). Two-dot would let the ack set and the change set disagree about which commits are this PR's. The fixture forks a topic branch, puts a trailer on each side, and asserts only the topic-side trailer is in range. - fail-closed on an uncomputable range. With fragments a depth-1 checkout passes VACUOUSLY, every fragment reading as brand-new. With trailers the range cannot be computed at all, and returning an empty set would silently disarm the gate, so it must throw. The fixture builds a genuine shallow clone rather than simulating one. Also covers the self-inflicted case: this change's own documentation quotes the trailer syntax, so an example landing at the end of a commit message would arm a live acknowledgment keyed on the literal placeholder text. Keys carrying angle brackets or whitespace are rejected. Authored per the phase artifacts 40-design.md and 50-test-matrix.md. Not yet run on the remote runner — this commit exists to be tested. Refs #3942 * chore(#3942): move the emitted-drift ack to a commit trailer Implements ADR-3942, superseding ADR-2719 section 3 and its #2789 amendment. Sections 1, 2 and 4-7 are retained: the conservation law is unchanged, only the storage of its escape hatch moved off the working tree. An acknowledgment explains one PR's ripple, and the moment that PR merges the ripple is in the base, so it can never clear anything again. It was stored in permanent shared state anyway, and every consequence of that mismatch had to be built and then maintained. The chain is #2789 -> #2914 -> #3078 -> #3842 -> #3823 -> #3875, each fix generating the next defect, ending in a scheduled sweeper whose own first PR could not merge itself. Added parseAckTrailers + renderAckTrailer (pure) and readAckTrailers (IO shell), reading Emitted-Drift-Ack-Hash: / Emitted-Drift-Ack-Growth: trailers over the merge-base range. tests/emitted-ack-trailer.test.cjs, 37 cases, written failing-first and confirmed red before any of this existed. Changed diffEmitted takes two structurally distinct key-space maps instead of one shared paths map. That closes a latent defect: the spaces were separated by convention only, so a growth key satisfied a hash lookup by naming coincidence. staleAcks now reports which space a key was declared in. REMEDIATION teaches the trailer, per space, with its example rendered through renderAckTrailer so the taught grammar cannot drift from what the parser accepts. Removed the sweep workflow, the guard-no-ack-on-next job, the standalone linter and its lint:ci entry, the fragment directory and its three spent fragments, the legacy single-file union, and the baseAck/spentAcks mechanism -- spentness is now structural, not computed. Two range properties carry the design and are pinned by tests rather than asserted: the range is merge-base scoped, matching git diff base...HEAD, so an already-merged trailer is out of range by construction; and an uncomputable range throws instead of reading as zero acknowledgments, which is the inverse of the fragment guard's vacuous pass. Three deliberate observable changes, each disclosed in the changeset: the unread runtime field is gone, the legacy file is no longer read, and cross-space excusal no longer works. Ten open PRs carry fragments and will meet a modify/delete conflict. Measured before landing and accepted deliberately; the one-line migration is in the PR body. Verified: lint:ci exit 0. Remote runner to follow on this exact sha. Refs #3942 * fix(#3942): silent trailer collapse, lost coverage, and an unbounded cap Six findings from the orthogonal review round, all fixed in place. BLOCKER -- two trailers of the same name on one commit collapsed silently. readAckTrailers built `separator=1d` where git needs `separator=%x1d`: the `separator=` value inside a %(trailers:...) placeholder is itself a pretty-format string, so the bare hex was emitted as two literal characters and the split on \x1d never matched. Two same-name trailers therefore joined into one value with errors empty -- the first reason absorbing the second entry's key. Silent truncation, the exact class MAX_ACK_TRAILERS throws to prevent. Confirmed with od -c against real git output before and after. The failing-first matrix did not catch it because its "both spaces coexist" row uses Hash plus Growth -- different trailer NAMES -- so the value separator was never exercised. Two regression tests now cover same-name trailers directly. Coverage recovered: normalizeAckReason and INVISIBLE stayed on the live path via parseAckTrailers but lost every test when the old suite was pruned. Back under test against the current surface -- all six invisible codepoints individually, whitespace collapse, trim, CRLF, and two seeded fast-check properties. Dropping any single codepoint now fails. MAX_ACK_TRAILERS counted raw trailers before de-duplication, so one trailer carried forward across rebased commits counted once per commit and could throw on a legitimate branch. Now counts distinct entries; 100 identical repeats dedupe to one. diffEmitted validated baseline, current and changedPaths but not the new ackHash/ackGrowth, so a bad shape raised an unhandled TypeError instead of an error verdict -- the same defect shape this file documents for #2778. Docs: CONTRIBUTING and TESTING-SUITES were rewritten only in their first sections; the later passages still taught fragments, git rm and the deleted guard, contradicting the new text directly above them. Finished. Also extends lint-removed-but-needed to exempt docs/adr and docs/research. That gate fails on any docs mention of a file deleted in the same diff, which makes it impossible to document a deletion in the PR performing it -- an ADR's whole job is naming what it retired. Exemption is narrow and comes with a test proving the gate still fires for a live consumer elsewhere under docs/. A guard that cannot fail is worse than no guard. Maintainer-approved. CONTEXT.md names the retired machinery by role rather than by filename: its generated projection lands in docs/, which that gate does scan. Adds docs/how-to/acknowledge-emitted-drift.md. The required docs set is Reference and Explanation, so the task quadrant can be empty with every gate green -- and this change has a real multi-step journey, including the fragment migration ten open PRs now need. lint:ci exit 0. Refs #3942 * docs(#3942): correct the duplicate-trailer rule in CONTRIBUTING Both axes of the code review independently flagged the same passage, without seeing each other's output. It claimed two declarations of the same key are always "a hard, loudly-reported error, not a silent last-wins". That is only half true, and the missing half is the one contributors hit: identical declarations -- same key, same reason -- dedupe silently, because a trailer legitimately survives a rebase and reappears on every rebased commit. Failing there would red a branch for doing nothing wrong, which is exactly why the dedup exists. Only a same-key/different-reason pair errors, and that one is a genuine ambiguity about which explanation holds. As written, the paragraph told a contributor that a rebase-carried trailer breaks the gate -- the opposite of the behavior. CONTEXT.md's parallel entry already stated it correctly; this brings CONTRIBUTING into line. Doc-only, root-level markdown. Refs #3942 * chore(#3942): backfill changeset PR number to 3954 --------- Co-authored-by: sim <sim@local>
tests/qa/smell-acks/
Per-PR acknowledgment fragments for scripts/qa-smell-ratchet.cjs (#2966).
The two terminal states (read this before adding a fragment)
Every smell the ratchet reports must end in exactly ONE of two states — there is no third "accepted with a good explanation" state:
- REAL — an assigned defect. File it, then add a fragment here citing that issue's number.
- FALSE POSITIVE — the oracle (
tests/qa/oracles.cjs) is wrong. Fix the oracle so it stops firing. Do NOT add a fragment for it.
A free-text reason can NEVER substitute for a real issue — it is at most
an optional human note alongside a real issue, never a replacement for one.
Why fragments, not one shared file
Same reason .changeset/ uses fragments instead of one shared mutable
document: a single tests/qa/smell-baseline.json
that every acknowledging PR has to rewrite guarantees a merge conflict
between any two such PRs in flight at once. A fragment per PR — uniquely
named so concurrent PRs never touch the same file — means two PRs can never
conflict on this seam.
Why this directory survived when tests/emitted-drift-acks/ did not
(ADR-3942). That one was deleted because an emitted-drift acknowledgment is
spent the instant its PR merges: its ripple is in the base, so it can never
clear anything again, and every merged fragment became cruft a scheduled bot
had to garbage-collect. A smell acknowledgment is the opposite — it is a
standing decision that stays valid for as long as the smell keeps firing, which
is precisely why it folds into a durable shrink-only baseline rather than
evaporating. Same fragment shape, opposite data lifetime. Do not "consistently"
migrate this directory to a commit trailer; the trailer is right only for data
whose life ends at merge.
Shape
One fragment = one acknowledged smell finding:
{
"version": 1,
"key": "<fingerprint from the ratchet's failure output>",
"id": "<oracle id, e.g. value-hygiene>",
"scenario": "<scenario name, e.g. greenfield-happy-path>",
"issue": 2966,
"reason": "<optional human note — never a substitute for issue>"
}
issue is REQUIRED and must be a positive integer naming the tracking issue
for the underlying defect (a REAL smell) — it is not a PR number and it is
not satisfied by prose. reason is OPTIONAL; when present it must be a
non-empty string that is not the literal TODO(qa-smell-ratchet):-prefixed
placeholder --update writes for a brand-new (untriaged) entry.
A missing, zero, non-integer, or non-numeric issue — or a reason still
carrying that placeholder text — is rejected by a plain (non---update)
ratchet run, with a message naming exactly which field is wrong.
Naming
Name the file so nobody else can collide with it: include the tracking issue number and something identifying the smell, e.g.:
tests/qa/smell-acks/2979-untyped-success-smart-entry.json
If one PR needs to acknowledge more than one NEW smell, add one fragment file per smell — do not bundle several findings into one fragment (that would defeat the "uniquely named, never conflicting" property for a PR that adds a second smell to an existing fragment someone else is also touching).
Lifecycle
- The ratchet's failure output for a NEW smell prints a paste-ready skeleton
for exactly this shape — copy it, fill in the real
issuenumber, done. There is no "write a reason instead" option: the two legitimate responses to a NEW smell are fixing the detector (false positive) or filing a defect and citing its issue number (real) here. - A fragment is honored by
scripts/qa-smell-ratchet.cjsfor as long as it exists here, in addition to whatever is already in the committedtests/qa/smell-baseline.json. - When a maintainer runs
node scripts/qa-smell-ratchet.cjs --update, every currently-firing smell (including ones only acknowledged via a fragment here) is folded into the regeneratedtests/qa/smell-baseline.json, carrying over each fragment's ownissue(andreason, if any).--updatenever invents an issue number: a genuinely new, never-acknowledged smell is written withissue: nulland a TODOreason, and the very next plain (non---update) run REJECTS that entry — forcing a human to triage it before it can ship. Delete the fragment once its entry is folded into the baseline — a fragment left behind after that point is redundant (the ratchet will say so, non-fatally, pointing at the exact file) and should be removed in the same PR that runs--update. - If the underlying behavior is fixed instead of accepted, delete the
fragment (or, if it was already folded, let
--updateprune it from the baseline as a STALE entry) rather than leaving a dead acknowledgment behind.