rvlib-shipkit 1.4.0 → 1.6.0

package/src/ledger/toolchain-identity.ts

@@ -1,4 +1,4 @@
-// WHAT PROGRAM IS ABOUT TO RUN, as one hash.
+// WHAT PROGRAM IS ABOUT TO RUN, as hashes.
 //
 // A cache key built from the repo's git tree answers "what source is being
 // gated". It cannot answer "what is doing the gating", and those two already
@@ -16,8 +16,12 @@
 //      package.json files of exactly the same byte length, so only the parsed
 //      `version` separates them.
 //
-// So the key has three parts: the runtime, the gate binary, and what is
-// actually installed.
+// So there are three parts: the RUNNER (the runtime, the gate code that runs
+// and stores every answer, the data files a check reads), the INSTALL (what is
+// actually in node_modules), and the toolkit SOURCE, which each check is keyed
+// on through its own module closure (LibSource), never as a whole. A whole
+// tree hash made a css edit in the hub, or a new test file, move every key in
+// every repo on the machine, and a repo that links the toolkit paid it twice.
 //
 // THE ONE DELIBERATE MISS: a human hand-editing a file inside `node_modules`
 // is accepted, not caught. Catching it means content-hashing the whole tree,
@@ -26,16 +30,22 @@
 // cache slower than the gate it caches. No tool produces that state; a human
 // debugging on purpose can delete the ledger.
 import { createHash } from 'crypto'
-import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync } from 'fs'
-import { isAbsolute, join, relative, resolve } from 'path'
+import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync, statSync } from 'fs'
+import { dirname, isAbsolute, join, posix, relative, resolve } from 'path'
+import { ALWAYS_SKIP, type RvtConfig } from '../ts/config.ts'
+import { extractSpecs, resolveSpec } from '../ts/source-graph.ts'
+import { blobOid } from '../core/read-set.ts'
 
 export type Toolchain = {
-    /** the identity, 16 hex chars, stable for identical programs */
+    /** the RUNNER, 16 hex chars: the runtime, the gate code that runs and
+     *  stores every answer, and the data files a check reads. Every key
+     *  carries it */
     id: string
-    /** non-empty means DO NOT CACHE this run: something in the toolchain is
-     *  neither in the repo's git tree nor pinned by a version string, so no
-     *  key can describe it. Each entry says which package and why. */
-    uncacheable: string[]
+    /** what is installed, 16 hex chars. Only a key whose answer runs the
+     *  repo's own tools carries it: a content or a world check */
+    install: string
+    /** the toolkit's source, for a check's own module closure */
+    lib: LibSource
 }
 
 /** the gate binary driving THIS process, which is what the key hashes when a
@@ -62,23 +72,202 @@ function installedNames(nm: string): string[] {
     return names.sort()
 }
 
-/** the gate binary's own source, content-hashed. This is what makes editing
- *  shipkit invalidate every key in every repo, in-repo copy or dependency. */
-function hashCliTree(h: ReturnType<typeof createHash>, cli: string): void {
-    const srcRoot = resolve(cli, '..')
-    const files: string[] = []
-    const walk = (d: string): void => {
-        for (const e of readdirSync(d, { withFileTypes: true })) {
-            if (e.name === 'node_modules' || e.name.startsWith('.')) continue
-            const p = join(d, e.name)
-            if (e.isDirectory()) walk(p)
-            else files.push(p)
+/** every file under `dir`, hashed as its path, its size and its bytes in
+ *  path order, so a rename or a line moved between files moves the hash too.
+ *  Its own installs and dot entries are left out. A symlink is followed (a
+ *  cycle is walked once), and one that cannot be read THROWS: a tree only
+ *  partly read must never be keyed as if it were whole */
+function hashTree(h: ReturnType<typeof createHash>, dir: string, tag: string): void {
+    const files: { rel: string; abs: string }[] = []
+    const seen = new Set<string>()
+    const walk = (d: string, rel: string): void => {
+        const real = realpathSync(d)
+        if (seen.has(real)) return
+        seen.add(real)
+        for (const name of readdirSync(d)) {
+            if (name === 'node_modules' || name.startsWith('.')) continue
+            const abs = join(d, name)
+            const r = rel === '' ? name : `${rel}/${name}`
+            if (statSync(abs).isDirectory()) walk(abs, r)
+            else files.push({ rel: r, abs })
         }
     }
-    walk(srcRoot)
-    files.sort()
-    for (const f of files) h.update(readFileSync(f))
-    h.update(`clifiles=${files.length}\n`)
+    walk(dir, '')
+    files.sort((a, b) => (a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0))
+    for (const f of files) {
+        const bytes = readFileSync(f.abs)
+        h.update(`${f.rel}\0${bytes.length}\0`)
+        h.update(bytes)
+    }
+    h.update(`${tag}=${files.length}\n`)
+}
+
+/** a path with its links resolved, as given when it cannot be (a file not
+ *  there yet): /var and /private/var must name one file */
+const real = (p: string): string => { try { return realpathSync(p) } catch { return p } }
+
+/** the modules that run a check and store its answer, relative to the
+ *  toolkit's src. A gate binary without them (a test fixture) is keyed on its
+ *  own entry's closure */
+export const RUNNER_ENTRIES = ['core/run-ci.ts', 'core/run-check.ts']
+
+/** file kinds under src that no check and no runner reads: the page the hub
+ *  serves and the mac app's source. Every other non code file there is data a
+ *  check can read (the scaffold templates), so it is in the runner id */
+const NOT_READ_BY_CHECKS = /\.(css|html|swift)$/
+
+/**
+ * the toolkit's source, keyed one module closure at a time. A check is keyed
+ * on the files its own module can reach, the runner on the files the runner
+ * can reach, and a file neither reaches (the hub page, a test) moves nothing.
+ * Each file is hashed once per process.
+ */
+export class LibSource {
+    /** the package root, resolved: the dir holding the source dir */
+    readonly pkgRoot: string
+    /** the source dir, resolved: the gate binary's own dir */
+    readonly srcDir: string
+    private readonly cfg: RvtConfig
+    private readonly oids = new Map<string, string>()
+    private readonly closures = new Map<string, string[]>()
+    /** file → the files it imports directly, so a file shared by many
+     *  closures is read and parsed once */
+    private readonly direct = new Map<string, string[]>()
+    private readonly probed = new Map<string, boolean>()
+    /** the package name a repo imports the toolkit by, null for a toolkit
+     *  with no package.json (a test fixture) */
+    readonly name: string | null
+
+    constructor(cliEntry: string) {
+        this.srcDir = dirname(realpathSync(cliEntry))
+        this.pkgRoot = dirname(this.srcDir)
+        let name: string | null = null
+        try { name = (JSON.parse(readFileSync(join(this.pkgRoot, 'package.json'), 'utf8')) as { name?: string }).name ?? null } catch { name = null }
+        this.name = name
+        // the toolkit imports itself by its package name, and a closure that
+        // could not follow those would stop at the first such import
+        this.cfg = { root: this.pkgRoot, roots: [relative(this.pkgRoot, this.srcDir)], skip: [...ALWAYS_SKIP], packages: name == null ? [] : [{ name, dir: '.' }] }
+    }
+
+    /** the toolkit file a package specifier names (`rvlib-shipkit/src/x.ts`),
+     *  or null when it names none */
+    fileOf(spec: string): string | null {
+        if (this.name == null || !spec.startsWith(`${this.name}/`)) return null
+        const abs = join(this.pkgRoot, spec.slice(this.name.length + 1))
+        return this.owns(abs) && existsSync(abs) ? abs : null
+    }
+
+    /** is this absolute path a source file of the toolkit? */
+    owns(abs: string): boolean {
+        const r = relative(this.srcDir, real(abs))
+        return r !== '' && !r.startsWith('..') && !isAbsolute(r) && /\.tsx?$/.test(abs)
+    }
+
+    /** package-relative files one entry can reach, dynamic imports included.
+     *  The same walk as `importClosure`, with each file's imports kept */
+    closureOf(abs: string): string[] {
+        const rel = relative(this.pkgRoot, real(abs)).replace(/\\/g, '/')
+        let c = this.closures.get(rel)
+        if (c == null) {
+            const seen = new Set<string>([rel])
+            const queue = [rel]
+            while (queue.length > 0) for (const t of this.importsOf(queue.shift()!)) if (!seen.has(t)) { seen.add(t); queue.push(t) }
+            c = [...seen].sort()
+            this.closures.set(rel, c)
+        }
+        return c
+    }
+
+    private importsOf(file: string): string[] {
+        let d = this.direct.get(file)
+        if (d == null) {
+            const has = (p: string): boolean => {
+                let r = this.probed.get(p)
+                if (r == null) { r = /\.tsx?$/.test(p) && existsSync(join(this.pkgRoot, p)); this.probed.set(p, r) }
+                return r
+            }
+            let text = ''
+            // the entry itself must exist: a missing one throws below, when it is hashed
+            try { text = readFileSync(join(this.pkgRoot, file), 'utf8') } catch { text = '' }
+            const resolveHere = (spec: string): string | null => resolveSpec(this.cfg, file, spec, has)
+            const targets = [...extractSpecs(text, { dynamic: true }).map(resolveHere), ...pathLiterals(text, file, resolveHere)]
+            d = [...new Set(targets.filter((t): t is string => t != null).map((t) => posix.normalize(t)))]
+            this.direct.set(file, d)
+        }
+        return d
+    }
+
+    /** blob id of one package-relative file. A file that cannot be read
+     *  THROWS: a closure only partly read must never be keyed */
+    private oid(rel: string): string {
+        let o = this.oids.get(rel)
+        if (o == null) { o = blobOid(readFileSync(join(this.pkgRoot, rel))); this.oids.set(rel, o) }
+        return o
+    }
+
+    /** the identity of what these entries can reach, 16 hex chars */
+    closureKey(absEntries: string[]): string {
+        const files = [...new Set(absEntries.flatMap((e) => this.closureOf(e)))].sort()
+        const h = createHash('sha256')
+        for (const f of files) h.update(`${f}=${this.oid(f)}\n`)
+        h.update(`n=${files.length}\n`)
+        return h.digest('hex').slice(0, 16)
+    }
+
+    /** the data files under src a check can read, as lines */
+    dataLines(): string[] {
+        const out: string[] = []
+        const walk = (dir: string, rel: string): void => {
+            for (const name of readdirSync(dir).sort()) {
+                if (name === 'node_modules' || name.startsWith('.')) continue
+                const abs = join(dir, name)
+                const r = `${rel}/${name}`
+                if (statSync(abs).isDirectory()) walk(abs, r)
+                else if (!/\.tsx?$/.test(name) && !NOT_READ_BY_CHECKS.test(name)) out.push(`data:${r}=${this.oid(r)}`)
+            }
+        }
+        walk(this.srcDir, relative(this.pkgRoot, this.srcDir))
+        // the version a check compares a repo's pin against
+        if (existsSync(join(this.pkgRoot, 'package.json'))) out.push(`data:package.json=${this.oid('package.json')}`)
+        return out
+    }
+}
+
+/** toolkit modules a file RUNS by path rather than imports: a preload handed
+ *  to bun, a cli spawned through `c.exec`. `join(import.meta.dir, 'x.ts')`,
+ *  `new URL('x.ts', import.meta.url)` and `import.meta.resolve('pkg/x.ts')`,
+ *  resolved like an import. The gate's own `cli.ts` is left out: a module
+ *  that names it spawns the whole program, and what of it produces an answer
+ *  is the runner every key already carries */
+function pathLiterals(text: string, file: string, resolveSpecifier: (spec: string) => string | null): (string | null)[] {
+    const out: (string | null)[] = []
+    const str = /'([^'\n]+)'|"([^"\n]+)"/g
+    const strings = (s: string): string[] => [...s.matchAll(str)].map((x) => x[1] ?? x[2]!)
+    const rel = (parts: string[]): string | null => {
+        const target = posix.normalize(posix.join(posix.dirname(file), ...parts))
+        if (target.endsWith('/cli.ts') || target === 'cli.ts') return null
+        return resolveSpecifier(`./${posix.relative(posix.dirname(file), target)}`)
+    }
+    for (const m of text.matchAll(/join\(\s*import\.meta\.dir\s*,((?:\s*(?:'[^'\n]*'|"[^"\n]*")\s*,?)+)\)/g)) {
+        const parts = strings(m[1]!)
+        if (parts.length > 0 && /\.tsx?$/.test(parts.at(-1)!)) out.push(rel(parts))
+    }
+    for (const m of text.matchAll(/new URL\(\s*('[^'\n]+'|"[^"\n]+")\s*,\s*import\.meta\.url\s*\)/g)) {
+        const p = strings(m[1]!)[0]!
+        if (/\.tsx?$/.test(p)) out.push(rel([p]))
+    }
+    for (const m of text.matchAll(/import\.meta\.resolve\(\s*('[^'\n]+'|"[^"\n]+")\s*\)/g)) {
+        const p = strings(m[1]!)[0]!
+        if (!p.endsWith('/cli.ts')) out.push(resolveSpecifier(p))
+    }
+    return out
+}
+
+/** the runner: the modules that run a check and store its answer, plus the
+ *  data files a check reads */
+function runnerLines(lib: LibSource, cliEntry: string): string[] {
+    const entries = RUNNER_ENTRIES.map((e) => join(lib.srcDir, e)).filter((e) => existsSync(e))
+    return [`runner=${lib.closureKey(entries.length > 0 ? entries : [realpathSync(cliEntry)])}`, ...lib.dataLines()]
 }
 
 /**
@@ -118,19 +307,14 @@ export function installIdentity(nodeModules: string): string {
  * moves an mtime without changing content produces no miss.
  */
 export function toolchainIdentity(repoRoot: string, cliEntry: string): Toolchain {
-    const h = createHash('sha256')
-    const uncacheable: string[] = []
     // BOTH sides resolved, or the comparison is wrong on macOS: /var is a
     // symlink to /private/var, so an in-repo cli under a resolved path reads
     // as outside an unresolved root. That mistake is silent and expensive: it
-    // content-hashes the gate binary on every single run, and folds absolute
-    // paths into the id, which is what would stop two worktrees agreeing.
+    // folds absolute paths into the id, which is what would stop two
+    // worktrees agreeing.
     const root = ((): string => { try { return realpathSync(repoRoot) } catch { return resolve(repoRoot) } })()
 
-    // the runtime. Free, and a bun upgrade genuinely changes behaviour
-    h.update(`bun=${Bun.version}\n`)
-
-    // the gate binary, ALWAYS content-hashed, and its path never folded in.
+    // the gate code, ALWAYS content-hashed, and its path never folded in.
     //
     // The earlier shape wrote `cli=in-repo` for a binary inside the repo and
     // leaned on the git tree key to cover it. Both halves were wrong, and both
@@ -139,39 +323,58 @@ export function toolchainIdentity(repoRoot: string, cliEntry: string): Toolchain
     // covered none of it. And between a checkout that HOSTS the binary and a
     // worktree that runs the same one through the global shim, one wrote
     // `in-repo` and the other wrote an absolute path, so two checkouts running
-    // one identical program could never agree on a key. Content-hashing costs
-    // 3.5 to 9.2ms on a 163-file tree, and it is the only form that is the
-    // same value wherever the caller stands.
-    hashCliTree(h, realpathSync(cliEntry))
+    // one identical program could never agree on a key. Package-relative
+    // content is the only form that is the same value wherever the caller
+    // stands.
+    const lib = new LibSource(cliEntry)
+    const r = createHash('sha256')
+    // the runtime. Free, and a bun upgrade genuinely changes behaviour
+    r.update(`bun=${Bun.version}\n`)
+    for (const l of runnerLines(lib, cliEntry)) r.update(`${l}\n`)
+    return { id: r.digest('hex').slice(0, 16), install: installOf(root, lib), lib }
+}
 
-    // what is installed. The lockfile states the intent; the tree states the fact
+/** what is installed. The lockfile states the intent; the tree states the fact */
+function installOf(root: string, lib: LibSource): string {
+    const h = createHash('sha256')
     const lock = join(root, 'bun.lock')
     h.update(`lock=${existsSync(lock) ? createHash('sha256').update(readFileSync(lock)).digest('hex') : 'none'}\n`)
     const nm = join(root, 'node_modules')
     if (!existsSync(nm)) {
         // a worktree nobody installed is a REAL difference, not a missing input
         h.update('nm=absent\n')
-        return { id: h.digest('hex').slice(0, 16), uncacheable }
+        return h.digest('hex').slice(0, 16)
     }
     const names = installedNames(nm)
     for (const n of names) {
         const dir = join(nm, n)
         let link = ''
+        let outside: string | null = null
         try {
             if (lstatSync(dir).isSymbolicLink()) {
                 const target = realpathSync(dir)
                 link = `->${target}`
-                // a `bun link`ed package is live source under someone else's
-                // edit: its content is in neither this repo's git tree nor its
-                // version string, so nothing here can describe it
-                if (!inRepo(root, target)) uncacheable.push(`${n} links outside the repo (${target})`)
+                if (!inRepo(root, target)) outside = target
             }
         } catch {}
+        // a `bun link`ed package is live source under someone else's edit:
+        // neither this repo's git tree nor its version string describes it, so
+        // its files do, and so does what it has installed itself, since its
+        // own imports resolve there. Outside the try on purpose: a linked tree
+        // that cannot be read throws, and the key layer then keys nothing.
+        //
+        // The toolkit running this gate is the one exception: each check is
+        // keyed on its own closure of it, and hashing it whole here put a css
+        // edit of the hub into every content key of every repo that links it
+        if (outside != null && outside !== lib.pkgRoot) {
+            hashTree(h, outside, `linked:${n}`)
+            h.update(`${installIdentity(join(outside, 'node_modules'))}\n`)
+        }
         let version = 'MISSING'
         try { version = (JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')) as { version?: string }).version ?? '?' } catch {}
-        h.update(`${n}@${version}${link}\n`)
+        h.update(`${n}@${version}${link === '' || outside === lib.pkgRoot ? '' : link}\n`)
     }
     // the count catches a removal that leaves every survivor identical
     h.update(`n=${names.length}\n`)
-    return { id: h.digest('hex').slice(0, 16), uncacheable }
+    return h.digest('hex').slice(0, 16)
 }

package/src/plan/repo-source.ts

@@ -12,6 +12,7 @@ import { Ledger } from '../ledger/ledger.ts'
 import { answersDb } from '../ledger/store.ts'
 import { hasWorld, worldKeyOf, type WorldCache } from '../ledger/world-cache.ts'
 import { FOREVER, FOREVER_MS } from '../core/wire.ts'
+import { planned } from '../core/runs.ts'
 import { ONCE, type LastResult } from './cadence.ts'
 import { openDb } from '../ledger/db.ts'
 import { readLastResults } from '../ledger/run-log.ts'
@@ -21,57 +22,33 @@ import { movedSince } from '../serve/tracked-watch.ts'
 import type { RepoConfig } from '../repo-config.ts'
 import type { PlanCheck, PlanReason, PlanSource } from './planner.ts'
 
-/** the rows the plan covers: what a gate or a health pass runs. A release
- *  check, an off one and an opt in build step wait for whoever names them */
+/** the rows the plan covers: every live row declaring `onSave` or
+ *  `onClock` (core/runs.ts). Nothing else is ever planned */
 export function plannable(row: CheckRow): boolean {
-    if (row.when.at !== 'always' && row.when.at !== 'health') return false
-    // nothing to do in this repo on a clock (check.ts planOff)
-    if (row.planOff != null) return false
-    if (row.optIn) return false
-    return !(row.build && row.when.at === 'health')
+    return planned(row.runs)
 }
 
-/** a REPO check nothing can key and that declares no cadence runs about
- *  once a day, never in step, until it declares what it depends on. No
- *  built-in may land here (tests/plan-default-range.test.ts) */
-const DEFAULT_EVERY: [string, string] = ['20h', '28h']
-
 /** why the plan cannot tell when this check's answer moves, or null when it
- *  can: a key, a ttl, a build step or a declared cadence says it */
+ *  can. With every axis explicit, a planned row always says: kept as the
+ *  burn-down reader for rows declaring a save trigger on nothing keyed */
 export function planGap(row: CheckRow): string | null {
+    if (row.runs.onSave !== 'moved') return null
     const pop = populationOf(row.decl)
-    if (pop === 'content' || pop === 'reads' || pop === 'world' || row.build) return null
-    if (row.plan?.every !== undefined || row.plan?.cron != null) return null
-    const why = row.decl.never != null && row.decl.never !== '' ? `never cached (${row.decl.never})` : (row.decl.uncacheable ?? 'declares neither inputs nor ttl')
-    return `${why}, and no every: nothing says when its answer moves`
+    if (pop === 'content' || pop === 'reads' || isForever(row)) return null
+    return `onSave 'moved' but nothing keys it (${row.decl.uncacheable ?? row.decl.declError ?? 'no key'}), so every save moves it`
 }
 
-/** one inventory row as a plan check. A world check keeps its ttl as its
- *  cadence; a build step and a check keyed on its files wait for a save (its
- *  answer replays until a file moves, so a clock re-asks nothing); a repo
- *  check with no cadence runs at its own stable point of the default range,
- *  and a built-in with none waits for a save and shows on the burn-down */
+/** one inventory row as a plan check, straight from its declared axes:
+ *  `onClock` is the cadence, `onSave` whether a save can make it due */
 export function planCheckOf(row: CheckRow): PlanCheck {
-    const pop = populationOf(row.decl)
-    const keyed = pop === 'content' || pop === 'reads'
-    const ttl = row.decl.ttl != null && row.decl.ttl !== '' ? row.decl.ttl : null
-    const fallback =
-        ttl === FOREVER ? { value: ONCE, why: 'a decided fact: ttl forever' }
-        : ttl != null ? { value: ttl, why: 'its ttl' }
-        : row.build ? { value: null, why: 'a build step' }
-        : keyed ? { value: null, why: 'keyed on its files' }
-        : row.from === 'repo' ? { value: DEFAULT_EVERY, why: 'the default range' }
-        : { value: null, why: 'a built-in declaring nothing, see shipkit keys --burn-down' }
-    // a gate check nothing can key waits for a save only when no cadence
-    // says when to run it: a range or an every it declares is the rule
-    const clocked = fallback.value != null || row.plan?.every !== undefined || row.plan?.cron != null
+    const clock = row.runs.onClock
+    const plan = clock === false ? {} : clock === ONCE ? { every: ONCE } : { every: clock.every, whenInactive: clock.inactive }
     return {
         id: row.decl.id,
         title: row.title,
-        plan: row.plan ?? {},
-        // a decided fact is keyed on its declaration, so a save can move it
-        onChange: isForever(row) || (pop !== 'world' && (keyed || (row.gate && !clocked))),
-        fallback,
+        plan,
+        onChange: row.runs.onSave !== false,
+        fallback: { value: null, why: 'onClock false: only a save runs it' },
     }
 }
 
@@ -182,6 +159,8 @@ export function repoSource(d: RepoSourceDeps): PlanSource {
                     moved.delete(c.id)
                     continue
                 }
+                // 'burst': every quiet save burst, whatever moved
+                if (r.runs.onSave === 'burst') { out.push(c.id); continue }
                 const k = ledger.layer.keyFor(c.id)
                 if (k.key == null) {
                     out.push(c.id)

package/src/problems/extract.ts

@@ -10,6 +10,7 @@ import { existsSync } from 'fs'
 import { isAbsolute, relative, resolve } from 'path'
 import type { Line } from '../core/wire.ts'
 import type { Problem, Severity } from './problem-line.ts'
+import { BUN_RECAP } from '../suite/judge-suites.ts'
 
 export type ExtractCtx = {
     /** the repo root every file is made relative to */
@@ -124,6 +125,8 @@ export function fromBunTest(text: string, ctx: ExtractCtx): Problem[] {
     for (const raw of stripAnsi(text).split('\n')) {
         const s = BUN_SUITE.exec(raw)
         if (s != null) { suite = repoFile(ctx, s[1]!, false); error = null; at = null; continue }
+        // every line after it repeats a failure already read above
+        if (BUN_RECAP.test(raw)) break
         const e = BUN_ERROR.exec(raw)
         if (e != null) { error = e[1]!.trim(); at = null; continue }
         const f = BUN_FRAME.exec(raw)

package/src/release/run-release.ts

@@ -112,6 +112,11 @@ export type ReleaseOpts = {
 export async function runReleaseGate(root: string, config: RepoConfig, print: (l: string) => void, o: { fix?: boolean; units?: ReleaseUnit[] } = {}): Promise<number> {
     return await runCi(root, {
         fix: o.fix ?? false,
+        // a check's repair never runs on the release path (runs.onRelease):
+        // only the mechanical slots (the formatter) may, when bump asks
+        fixRules: false,
+        // the rows declaring onRelease, whatever the tier
+        release: true,
         frozen: true,
         status: false,
         config,