From ded6cb197c8e6e1fcad8b77b585750d718d94db9 Mon Sep 17 00:00:00 2001 From: Timothy Date: Sat, 22 Aug 2026 17:44:07 +0200 Subject: [PATCH] docs(806): record the SPA page-size guard as assessed-and-deferred (#819) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The whole-repo sweep in cold review — looking past the file list #806 names, the same method that found `test_pr_changed_files.py` inside this PR — turned up one more instance of the shape: `web/src/api/pageSizeCallSites.guard.test.ts` derives its population from `import.meta.glob('/src/**/*.{ts,tsx,mts,cts}')` and then asserts exact completeness against `REGISTRY`. An untracked `.ts` under `web/src/` containing a page-size call enters the population and fails as unregistered on that checkout while CI never sees it. NOT FIXED HERE, and the reason is a documented obstacle rather than scope fatigue. The glob is a deliberate workaround: `@types/node` is kept out of `tsconfig.app.json` because that project covers production browser code, and a file-local `/// ` was tried and REVERTED — under `tsc -b` it leaked Node's ambient `setTimeout` into the whole app project and broke three unrelated `window.setTimeout` mocks. Filtering the glob against `git ls-files` therefore needs `node:child_process` in a project that excludes Node types, which is the wall the previous attempt hit. #819 carries the evidence and two fix shapes that sidestep it (a Vite `define` or a vitest `globalSetup`, both of which run where Node IS available). The direction is the safe one — it over-enumerates, so it fails loudly rather than going blind — which is why it is a follow-up rather than a blocker. Recorded in the audit table as DEFERRED rather than left silent, which is what #806 asks for every population it assesses: "completeness claim over tracked files, or not — recorded either way". A guard nobody wrote down is indistinguishable from one nobody looked at. refs #806 refs #819 Co-Authored-By: Claude Opus 5 (1M context) --- docs/guard-inventory.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/guard-inventory.md b/docs/guard-inventory.md index 0790f1fe7..21d972519 100644 --- a/docs/guard-inventory.md +++ b/docs/guard-inventory.md @@ -131,6 +131,7 @@ The audit #806 asked for, recorded whichever way it came out, because "we looked | `test_hook_fire_log.py` | `.claude/hooks/*.sh` | **yes** — every hook must be instrumented | converted; an untracked scratch `.sh` used to demand instrumentation and redden the suite on that checkout alone | | `test_ci_image_pin_population.py` | `.gitea/workflows/*.yml` + `*.yaml` | **yes** — "docker-build is the ONLY workflow pinning the toolchain image" | converted, and `*.yaml` added: Gitea accepts both spellings, so a `.yaml` workflow was structurally invisible while the test read as covering all of them | | `test_pr_changed_files.py` | `.gitea/workflows/*.y*ml` | **yes** — "no OTHER workflow writes the review-verdict status" | converted. Not on #806's list and found by cold review on the pushed head: an untracked `.yaml` dropped in `.gitea/workflows/` reddened two guards while absent from the index — the issue's list of files to assess was a starting point, not the population | +| `web/src/api/pageSizeCallSites.guard.test.ts` | `web/src/**/*.{ts,tsx,mts,cts}` via `import.meta.glob` | **yes** — an unregistered discovered site fails | DEFERRED to #819, assessed not skipped. The glob is a documented workaround: `@types/node` is deliberately out of `tsconfig.app.json`, and wiring it in was tried and reverted (it leaked Node's `setTimeout` into the app project and broke three unrelated tests), so there is no `node:child_process` to reach the index from. Over-enumerates, so it fails loudly rather than going blind | | `test_ci_release_path_scan_job.py` | `.gitea/workflows/*.y*ml` + `scripts/**` | **no** — a fixture assembling a tmp harness, asserted about behaviour not membership | takes its file LIST from the index anyway, for hermeticity not completeness: `shutil.copytree` copied whatever was on disk, including untracked files and `scripts/__pycache__`, into a tree whose behaviour the probes then measure. Content still comes from the working tree. The copy is not a git repo, so the two files this step RUNS may not use the helper — see the fixture docstring | | `test_ci_dropped_step_guard.py` | the parsed workflow document | **no filesystem population at all** | unchanged; its residual is `MARKED_JOBS`, a SCOPE mirror of the required contexts on `main`, which #806 does not close |