Files
msd-core/eslint-rules/no-duplicate-fold-marker.cjs
Tom Boucher c28134ab39 fix(#3271): delete 25 duplicated folded test suites and fix three runner defects found doing it (#3285)
* test(#3271): guard against a folded suite appearing twice in one host

Adds local/no-duplicate-fold-marker, an AST rule that reports the second and
every subsequent `folded:<name>` marker in a host file, plus RuleTester cases
and a tree-wide regression assertion.

Failing-first on purpose: the rule is registered at error and the 25 duplicated
regions are still present, so eslint and the new tree-wide test are RED. The
deletions land in the next commit.

The marker key is the whitespace-delimited token after `folded:` — not the
issue's `[a-z0-9-]*` slice, which truncates at `.` and false-positives on
tests/model-resolver.test.cjs where feat-443-effort-fast-mode.integration and
feat-443-effort-fast-mode are two distinct folded suites.

Refs #3271

* fix(#3271): delete 25 duplicated folded suites from three install hosts

Three consolidated install suites each carried a verbatim second copy of a
contiguous run of #1969 B1 folded blocks. Byte-identical, constant offset, and
green — each duplicated block registered and ran twice on every lane.

  tests/install.test.cjs                   5981-9937  (3957 lines, 18 blocks)
  tests/install-minimal-hooks.test.cjs     2734-4015  (1282 lines,  5 blocks)
  tests/install-write-confinement.test.cjs 1754-2321  ( 568 lines,  2 blocks)

Introduced by 6d072435d (#1975 re-applying #1970's hunks on a tree that already
had them, 2026-07-03) — one stale-base re-application, three files, one commit.
Verified by marker-count bisect: 1 at 4f779eda4 and 0cc7a1a42, 2 from 6d072435d
onward.

The later copy is deleted in each case, so every file returns to what its
authoring batch produced and blame on the surviving lines stays accurate.
local/no-duplicate-fold-marker, red on the previous commit, is now green.

tests/model-resolver.test.cjs is untouched: the issue lists it, but its two
blocks are folded from two different files and are not identical. It is a false
positive of the issue's own grep, whose `[a-z0-9-]*` key truncates at `.`.

Fixes #3271

* test(#3271): property-test marker identity and pin the alias non-goal

Three review findings, all fixed inline:

1. foldMarkerOf is a parser and carried no fast-check property test. Raised
   independently by the /code-review standards axis and the isolated adversarial
   pass; the file already establishes the fc.property-driving-ruleTester idiom
   for a sibling rule. Added, two arms over markers generated from [a-z0-9-._]:
   the same marker twice always reports exactly once against firstLine 1, and
   two distinct markers never collide. The alphabet includes `.` on purpose —
   an implementation keyed on the issue's [a-z0-9-]* slice passes arm 1 and
   fails arm 2, which is exactly the model-resolver false positive.

2. meta.docs.category was the novel value 'Test hygiene'; all 16 sibling local
   rules use 'Best Practices', 'Portability' or 'Reliability'. Now
   'Best Practices'.

3. A call through a further alias (const d = __foldDescribe) was unreported and
   undocumented — accidental rather than deliberate. It is now the fourth entry
   in the rule's documented non-goals, with the reason, and pinned by a valid
   RuleTester case so it cannot drift silently.

Refs #3271

* test(#3271): name the step and elapsed time when a baseline build fails

buildBaselineAtRef runs four bounded steps and, when one exceeded its bound,
threw a bare "spawnSync ETIMEDOUT" naming neither the step nor how long
anything took. Diagnosing one real failure took four separate experiments to
recover information the throw already had.

Each step is now timed, and any throw carries the breakdown: which step failed,
its elapsed time, the timings of every step that completed before it, all three
bounds, and the tail of the child's captured stdout/stderr.

The failure message is deliberately the carrier. On the remote runner the
captured output field comes back empty in failures.json while error and stack
survive verbatim, so the message is the only channel that reaches a reader of a
remote verdict.

Refs #3271

* fix(#3271): size the baseline generator bound for the machine it runs on

Instrumentation from a real remote-runner failure gave the breakdown:

  git-worktree-add=15.1s  npm-run-build-lib=19.8s  gen-emitted-baseline=FAILED@300.1s

Steps 1 and 2 are comfortable. Only the generator exceeds its bound, and it is
not hung — it needs more than 300s there.

Measured ladder for that step: ~22s idle in a container, ~39s end-to-end in a
clean container, ~142s with 8 CPU burners on 8 cores, and >300s under the real
suite. Its cost is 19 sequential installer spawns, and spawn latency is exactly
where a container degrades worst (3.9x slower than host, against 1.1x for file
IO) — which is why a CPU-only load test did not reproduce it and why four
earlier hypotheses (container slowness, network, shallow clone, CPU contention)
all measured clean.

The 300s bound was sized on an idle machine for a step that never runs on one.
Under the remote runner the on-disk baseline cache is structurally absent — CI
restores it via actions/cache keyed on github.event.pull_request.base.sha, a key
that exists only inside GitHub Actions — so this slow path runs on every remote
verification. The result: this gate has passed 0 times in 754 runs, failing 80
times and never once executing successfully.

Raised to the 600000ms ceiling that local/no-unbounded-spawn treats as the
largest meaningful bound; the other two bounds are untouched. This makes the
gate RUN, which is the point: the alternative considered and rejected was
degrading the timeout to a skip, and that was measured to turn the suite green
with the gate silently not running at all.

The real remedy is making the cache reachable from the remote runner so the
in-job build returns to being the rare fallback ADR-2719 §5 describes. That is a
gsd-test-runner change, not one this repo can make.

Refs #3271

* fix(#3271): tolerate an overlay source that vanishes mid-walk

Observed on the remote runner, three runs across three different branches:

  ENOENT: no such file or directory, link '/work/hooks/dist/gsd-config-reload.js'
    -> '/tmp/gsd-2930-overlay-6nOZay/hooks/dist/gsd-config-reload.js'

buildOverlayRepo enumerates names with readdirSync and then acts on each one, so
statSync, copyFileSync and linkSync all sit in a TOCTOU window. hooks/dist is
regenerated by an ATOMIC REPLACE (scripts/build-hooks.js unlinks and renames), so
any concurrently running test that rebuilds hooks retires a just-listed name
mid-walk and the overlay dies on it. linkOrCopyFile already tolerated EXDEV and
EPERM; ENOENT went straight through.

On ENOENT the source is now re-examined ONCE rather than slept on. An atomic
rename is a single syscall, so by the time the failure surfaces the successor is
either already in place (the retry succeeds) or the path has genuinely left the
tree, in which case there is nothing to mirror and the leaf is skipped. No sleep
and no spin: a timing-based wait here would be the very flake being fixed. Every
other errno still propagates untouched, so a real permission or IO fault stays a
hard failure.

Five tests hold the boundary: gone-for-good skips without retrying, mid-replace
retries exactly once and places the file, EACCES still throws, a real linkSync
ENOENT is injected by monkeypatching fs and restoring it in a finally (never a
mode-bit trick, which root bypasses), and isMissingPath accepts only ENOENT.

Refs #3271

* fix(#3271): order the timeout ladder inward-out and lock it

Two review blockers, both real.

The generator bound had been raised to 600000ms — exactly the whole-chunk timeout
in scripts/run-tests.cjs:973. A step bound equal to the chunk ceiling loses the
race: the chunk is killed first and the failure arrives as an opaque "no failed
step" kill, so the per-step diagnostic added a commit earlier was built and then
made unreachable in the same change.

Separately the #2767 test declared a per-test timeout of 300000ms, BELOW the
inner bound it was meant to permit, so it could still die at the exact 300s
ceiling this was supposed to lift — via node:test's timeout rather than
spawnSync's. Its sibling declared 900000ms, above the chunk ceiling, which is the
same opaque-kill hazard from the other direction.

The three bounds only produce a useful failure if they fire inward-out, so they
now do: step 360s, per-test 480s, chunk 600s. 360s is ~3x the passing observation
(91.6s / 115.8s) and 20% above the censored 300.1s timeout, while leaving 240s of
chunk headroom for every other file sharing it. Four tests lock the ordering,
including a drift guard on the exported values — without it, editing a call
site's literal timeout would leave the ordering assertions passing while the real
ladder inverted.

Also from review:

- err.gsdBaselineStep and err.gsdBaselineTimings were written and never read
  anywhere in the tree; only the rewritten message is consumed. Removed rather
  than kept as speculative surface.
- buildOverlayRepo discarded placeVanishableLeaf's boolean at both call sites, so
  a vanished leaf left the overlay with no accounting at all. It now collects the
  skipped paths and warns once. Not thrown: a source that left the tree really is
  not part of the snapshot, and throwing would reintroduce the crash the
  tolerance removes — but silence would let a dropped leaf resurface later as an
  unrelated missing-file assertion.
- The instrumentation commit shipped no test. One now drives a real failure and
  asserts the message names the step, its elapsed time, and the bounds.

Refs #3271

* chore(#3271): backfill the changeset PR number

* fix(#3271): bound a hook fan-out as its own class, not as a bare probe

CI failure on PR #3285, job full test (windows-latest, 22, shard 2/3) — every
other lane green, including windows-latest node 24 across all three shards:

  not ok 1 - blocks push when any to-be-pushed commit matches local blocked regex
    error: bash .githooks\pre-push failed — outcome=timed_out exitCode=null stderr=
    duration_ms: 15040.2168

A bound, not a hang: the test supplies stdin via input:, so the hook is not
blocked reading its ref list, and the duration lands exactly on the 15000ms
bound.

The site used PROBE_TIMEOUT_MS, which tests/helpers/timeouts.cjs documents as "a
single short CLI query or node -e probe against a temp fixture". This is not
that. It spawns bash running .githooks/pre-push, and the hook then invokes a MOCK
git that is itself a bash script, so one runHook is roughly four Git Bash spawns.
On Windows each is Defender-scanned and the first hook test in a file pays cold
start on top. That module's own docstring warns against precisely this: a call
site that differs from its class must not be forced onto a shared value that does
not describe it.

HOOK_FANOUT_TIMEOUT_MS is that missing class — 60000ms, 4x the bound that failed
and half INSTALL_TIMEOUT_MS, which is the right order: a hook fan-out is much
lighter than a full installer run and far heavier than reading back a version
string. Two tests lock the ordering against both neighbours, including one
asserting real margin over the censored 15040ms observation, since a bound that
merely matched what was measured would be the same defect again.

Scoped deliberately: the other ~360 runHook sites keep their current bounds. This
adds the norm and applies it where a real failure demonstrated the need, rather
than sweeping a value across sites with no evidence for any of them.

Refs #3271

---------

Co-authored-by: sim <sim@local>
2026-08-09 23:41:44 -04:00

185 lines
7.9 KiB
JavaScript

'use strict';
/**
* no-duplicate-fold-marker
*
* Flag a `folded:<name>` marker that appears more than once in the same file.
*
* Consolidation epic #1969 moved standalone regression suites into shared host
* files. Each moved suite is wrapped in a self-contained block:
*
* // ──────────────────────────────────────────────────────────────────────
* // Folded from tests/bug-376-claude-js-hook-gsd-rewriter.test.cjs — …
* // ──────────────────────────────────────────────────────────────────────
* {
* const { describe: __foldDescribe } = require('node:test');
* __foldDescribe("folded:bug-376-claude-js-hook-gsd-rewriter (… B1 #1970)", () => {
* …
* });
* }
*
* Because each block is self-contained, a second verbatim copy in the same host
* parses, registers, and PASSES — twice. Nothing reports it. #3271 found 25 such
* copies (~5,800 lines) across three suites, all introduced by one stale-base
* re-application in `6d072435d` (#1975 re-applying #1970's hunks).
*
* Two concrete costs, both invisible to a green suite:
* 1. Every duplicated block executes twice on every lane of the matrix.
* 2. DEFECT.GENERATIVE-FIX — a contributor fixing one of these regressions
* edits the copy they found and leaves the other asserting the old
* behavior. The suite stays green while the two copies disagree.
*
* ── What is keyed ─────────────────────────────────────────────────────────────
*
* The marker is the WHITESPACE-DELIMITED token after `folded:` in the title
* literal passed to the fold alias — NOT the whole title, and NOT a
* `[a-z0-9-]*` slice of it.
*
* "folded:bug-376-claude-js-hook-gsd-rewriter (consolidation epic #1969 B1 #1970)"
* → marker `bug-376-claude-js-hook-gsd-rewriter`
*
* Both halves of that definition are load-bearing:
*
* (a) Stopping at whitespace and NOT at `.` keeps
* `feat-443-effort-fast-mode.integration` distinct from
* `feat-443-effort-fast-mode`. Those are two different folded suites that
* coexist in tests/model-resolver.test.cjs; a `[a-z0-9-]*` key collides
* them and reports a duplicate that does not exist (#3271's own
* reproduction command has this bug).
*
* (b) Keying on the marker rather than the full title means a re-fold under a
* different batch label ("… B1 #1970" vs "… B5 #1975") is still caught.
* The batch label is provenance, not identity.
*
* ── What is deliberately NOT flagged ──────────────────────────────────────────
*
* - A `__foldDescribe` title without a `folded:` prefix. The alias is reused
* for at least one ordinary describe block
* (tests/review-default-reviewers-workflow.test.cjs). Those are not folds
* and carry no uniqueness obligation.
* - A plain `describe("folded:…")`. The convention this rule enforces is the
* fold alias; a bare `describe` with a colliding title is a different
* (and currently non-existent) shape.
* - A non-literal title (`__foldDescribe(name, …)`, template literal with a
* substitution). Nothing can be proven about it statically, so it is
* skipped rather than guessed at.
* - The SAME marker in two DIFFERENT files. The defect class is intra-file
* duplication — one host running one suite twice. Cross-file reuse would be
* a different question and is not decided here.
* - A call through an ALIAS of the alias (`const d = __foldDescribe; d("folded:a …")`).
* The rule keys on the callee identifier being literally `__foldDescribe`;
* resolving a further alias through scope would buy nothing today — every
* one of the 365 fold sites in the tree calls the alias directly, and zero
* rebind it — while adding a scope walk to a rule that currently needs none.
* If a rebinding ever appears, it is the rebinding that is the anomaly.
*
* The rule reports the SECOND and every subsequent occurrence, never the first,
* and names the line the first occurrence sits on — so the failure message
* points at both ends of the duplication.
*
* DEFECT category: DEFECT.GENERATIVE-FIX
*/
/** The `describe` alias that consolidation epic #1969 folds are wrapped in. */
const FOLD_ALIAS = '__foldDescribe';
/** Title prefix that marks a folded suite. */
const FOLD_PREFIX = 'folded:';
/**
* Extract the fold marker from a describe title.
*
* Returns the whitespace-delimited token following `folded:`, or null when the
* title is not a fold title (no prefix) or carries an empty marker.
*
* @param {string | null} title
* @returns {string | null}
*/
function foldMarkerOf(title) {
if (typeof title !== 'string') return null;
if (!title.startsWith(FOLD_PREFIX)) return null;
const marker = title.slice(FOLD_PREFIX.length).split(/\s/, 1)[0];
return marker.length > 0 ? marker : null;
}
/** @type {import('eslint').Rule.RuleModule} */
const rule = {
meta: {
type: 'problem',
docs: {
description:
'Disallow the same consolidation-epic folded suite appearing twice in one host file',
category: 'Best Practices',
},
schema: [],
messages: {
duplicateFoldMarker:
'Folded suite "{{marker}}" is already present in this file at line {{firstLine}} ' +
'(DEFECT.GENERATIVE-FIX). A second copy runs the same tests twice on every lane and ' +
'lets the two copies drift apart silently — a contributor fixing the regression edits ' +
'one copy and leaves the other asserting the old behavior, with the suite still green. ' +
'Delete this copy; keep the one at line {{firstLine}}.',
},
},
create(context) {
/**
* marker → line of its first occurrence in this file.
* Rebuilt per file: `create` runs once per linted file.
* @type {Map<string, number>}
*/
const firstSeen = new Map();
/**
* Returns the static string value of a title argument, or null when the
* title is not a plain string literal (identifier, template literal with a
* substitution, computed expression, …).
*
* A substituted template cannot be resolved statically, so it is skipped
* rather than guessed at.
*
* @param {import('eslint').Rule.Node | undefined} node
* @returns {string | null}
*/
function staticTitleOf(node) {
if (!node) return null;
if (node.type === 'Literal') {
return typeof node.value === 'string' ? node.value : null;
}
if (node.type === 'TemplateLiteral') {
// Only a substitution-free template has a knowable value.
if (node.expressions.length !== 0) return null;
if (node.quasis.length !== 1) return null;
return node.quasis[0].value.cooked ?? null;
}
return null;
}
return {
CallExpression(node) {
// Only the fold alias — a bare `describe` is a different convention.
if (node.callee.type !== 'Identifier') return;
if (node.callee.name !== FOLD_ALIAS) return;
if (node.arguments.length === 0) return;
const marker = foldMarkerOf(staticTitleOf(node.arguments[0]));
if (marker === null) return;
const firstLine = firstSeen.get(marker);
if (firstLine === undefined) {
firstSeen.set(marker, node.loc.start.line);
return;
}
context.report({
node: node.arguments[0],
messageId: 'duplicateFoldMarker',
data: { marker, firstLine: String(firstLine) },
});
},
};
},
};
module.exports = rule;