@sleepy_panda_srl/portulan 0.1.1 → 0.1.3

package/cli/pack-identity.mjs

@@ -43,8 +43,15 @@ class CannotRun extends Error {}
 
 const run = (cmd, args, opts = {}) => execFileSync(cmd, args, { encoding: "buffer", maxBuffer: 64 * 1024 * 1024, ...opts });
 
-/** What the package would contain, as repo-relative paths. */
-function packedPaths(root) {
+/**
+ * What the package would contain, as repo-relative paths.
+ *
+ * **Exported because `./payload.mjs` classifies exactly this roster**, and two enumerations of *what
+ * npm would pack* is the second-carrier defect this repository keeps paying for. That rail asks which
+ * files ship; this one asks whether each is byte-identical to its source. One question about
+ * membership, asked once, answered here.
+ */
+export function packedPaths(root) {
     let out;
     try {
         out = run("npm", ["pack", "--dry-run", "--json"], { cwd: root, stdio: ["ignore", "pipe", "pipe"] }).toString("utf8");

package/cli/pack-version.mjs

@@ -13,6 +13,13 @@
 // for a single field. `portulan.version` is per-pack, so it cannot contend. Tying the bundle to the pack
 // manifests is arm 4 of the issue and is deliberately NOT here.
 //
+// **Re-measured 2026-08-29: the bundle now agrees with NEITHER pack** — `rituals/checkpoints` moved to
+// `0.3.0` when proposal `0035` added an obligation to its pre-commit verdict, while the bundle stayed
+// `0.2.1` and `tools/github` stayed `0.1.0`. The measurement above is stamped to `c93a819` and remains
+// true of that commit; what changed is that the coincidence it names has ended, which STRENGTHENS the
+// argument rather than dating it. A reader finding three different numbers is looking at three
+// independently versioned things, not at drift.
+//
 // ## Why the whole `contributes` block, not only `gates`
 //
 // The issue's title asks about gate fragments; arm 3's own text says *"touching a pack's `contributes`

package/cli/recipe-set.mjs

@@ -61,7 +61,8 @@ import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 
-import { resolvePack, rootPlan } from "./compile.mjs";
+// `shadowedCopy` rides along: one carrier for *is this pack shadowed*, per #316.
+import { resolvePack, rootPlan, shadowedCopy } from "./compile.mjs";
 import { AUTO, discoverPackRoots, namedWithAuto } from "./discover.mjs";
 
 /**
@@ -82,6 +83,12 @@ import { AUTO, discoverPackRoots, namedWithAuto } from "./discover.mjs";
 export const RECIPE_SET_READERS = Object.freeze([
     ".github/workflows/verify.yml",
     "cli/doctor.mjs",
+    // Added 2026-08-25 with milestone 8 clause (d). `cli/drills.mjs` reads the set to know which rails
+    // it must drill — and it is the reader that shows the live sweep's own boundary: it calls
+    // `recipeSet()` rather than enumerating `verify.recipes`, so the sweep for an undeclared
+    // *enumeration* could not see it and this roster went stale in the one way the pair above was
+    // arranged not to allow. Raised as a suppressed note by Copilot, round 1 on #343.
+    "cli/drills.mjs",
     "cli/stop-gate.mjs",
     "cli/vendor.mjs",
 ]);
@@ -288,6 +295,46 @@ export function resolverFor({ workspaceDir, manifest, repoRoot = ".", named = []
     if (plan.refusal) throw new Error(`recipe-set: ${plan.refusal}`);
     if (plan.couldNotRun) throw new Error(`recipe-set: ${plan.couldNotRun}`);
     const roots = plan.roots ?? [];
+    const originAt = (r) => (plan.origins ?? []).find((o) => path.resolve(o.root) === path.resolve(r))?.origin;
+
+    // **A shadowed pack is refused here too** (#318), and this tool's ground is the strongest of the
+    // three. `compile` refuses even an agreeing shadow because its artifact records which root
+    // answered; `index` refuses one although its artifact deliberately does not. Here the answering
+    // root is not merely recorded — **it is spliced into the output**: `${PACK_ROOT}` expands to the
+    // root that answered, so two copies whose manifests are byte-identical still yield different `run`
+    // lines pointing at different files. What CI runs and what a bare local run runs would diverge,
+    // with nothing in either output to say so.
+    //
+    // So the agreeing case is not a carve-out anyone could argue for here, and the honest predicate was
+    // never manifest comparison: it is output equality, computable only by resolving both worlds.
+    // Refusing the ambiguity is what remains.
+    //
+    // **Checked HERE rather than inside the returned closure**, which is where a first cut put it. The
+    // closure runs during `recipeSet`, outside the `try` that wraps this constructor — so the refusal
+    // escaped as an uncaught throw, exit 1 with a stack trace, in a tool whose whole contract is exit 2
+    // for could-not-run. Measured, not reasoned about. Throwing from the constructor puts it on the
+    // path `plan.refusal` already uses and the caller already catches.
+    //
+    // **Only where the caller did not choose** — a named root replaces the derived one, `auto` is
+    // discovery elected — which is `compile`'s guard shape, bound to it deliberately.
+    if (!forced && plan.source !== "named") {
+        const declared = Array.isArray(manifest?.packs) ? manifest.packs : [];
+        for (const ref of declared) {
+            const found = resolvePack(String(ref), roots);
+            if (!found?.dir) continue;
+            // Path-resolved, matching `compile` — see the sibling note in `index.mjs`.
+            const behind = shadowedCopy(String(ref), originAt(found.root), roots, originAt);
+            if (!behind) continue;
+            throw new Error(
+                `recipe-set: \`${ref}\` is SHADOWED — it resolved under ${found.root}, a root discovered on ` +
+                    `this host, while the root ${path.relative(path.resolve(repoRoot), behind.root)} also carries it. ` +
+                    "A composed recipe's ${PACK_ROOT} expands to whichever root answered, so the two compose to " +
+                    "run lines pointing at different files. Refusing to pick: name the root — `--pack-root packs` " +
+                    "for the tree, which is what CI runs, or `--pack-root auto` for the installed copy.",
+            );
+        }
+    }
+
     return (ref) => {
         const found = resolvePack(ref, roots);
         // `resolvePack` returns `manifest` as the PATH to `pack.json`, not as the parsed object —