Round 5 found a BLOCKER, and it is the sharpest kind: I made the exact mistake I had
described one screen earlier. `test_only_the_PINNED_npm_SCRIPTS_run_vitest` SELECTED the
scripts to pin by asking whether their body contained the literal `vitest` — a selector,
the category this file calls the worst-behaved because going short is silent — and then
its docstring claimed "going short is caught by the equality below", which is false: a
script the substring misses is absent from the compared map, so the equality still holds.
Four one-line `web/package.json` edits, none of which spells `vitest`, each put the suite
back into the gitless stage with the whole guard green: `"build": "npm run test -- --run
&& …"`, the same via `npm t`, and the `prebuild` / `preinstall` LIFECYCLE HOOKS, which
npm runs for `npm run build` and `npm ci` without anything naming them. That is #883
verbatim, through the route round 4 identified and the previous commit reported closed.
The fix is the one the file's own vocabulary prescribes: pin the WHOLE script map. A
script that does not exist cannot be a lifecycle hook, and one that changes is not equal.
The category disappears rather than being widened by two entries.
ALSO CLOSED, all measured:
* `web/vite.config.ts`'s `test:` block is now pinned. `npm test -- --run` collects what
that file says, so `test.exclude` is where a filter would now naturally be written —
it is the only place left after this change removed the Dockerfile's. Three mutants
narrowed the gating suite through it with the step's own command unchanged.
* A step-level `shell:` and a job-level `defaults:` each override the pinned workflow
default. Both forbidden.
* `test_no_run_BODY_builds_or_pushes_an_image` is RESTORED — I dropped it in the parser
withdrawal, and a job publishing via `run: docker build … && docker push …` was then
outside the action-derived population with anti-vacuity none the wiser.
* A leading-slash context copy (`COPY /web/. ./web/`) was not recognised.
* The sweep gains `yarn test`, `pnpm test`, `bun test`.
The residual naming the uncovered COPY shapes was wrong for the SECOND consecutive round —
it named `COPY --from=X /source/web /elsewhere`, which is covered (only the destination is
renamed). The real gaps are an ANCESTOR source (`/source` brings `/source/web` along) and
`/source/.`. Both measured.
Route count: five, then six, now seven. It has been wrong at every count, so it is now
stated as a running total with that history attached rather than as an enumeration.
Battery 51 -> 60, 0 missed.
Refs: #887
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019T79beF1Ufid3dXju4yqkF
timothyandClaude Opus 5
9b99a23835