[imanimanyara]

Summary

The reconciler detected drift and then fixed none of it, in every repository, in every account —
and reported a clean-looking uniform status while doing so.

check --write creates the file, or appends an ecosystem the file is missing. It does not
rewrite a file that already covers every ecosystem and is simply wrong, which is exactly what drift
is. So every drifting repository ran the write, reached changed_paths, found nothing, and came
back skipped:write-made-no-change.

Measured 2026-11-02, dry run across simtabi:

repo	before	after
cli-kit-js	skipped:write-made-no-change	—
mesobia	skipped:write-made-no-change	would-open
netsapiens-api	skipped:write-made-no-change	would-open
repo-templates	skipped:write-made-no-change	—
sis-sdk	skipped:write-made-no-change	would-open

render --write replaces everything outside the local block, which is what the reconciler exists to
do. Verified by hand that it keeps a # >>> local (kept by the generator) block verbatim, so the
one thing a repository owns is not lost.

Why the suite passed

The defect was in the double, not in the assertions — the fake generator was more capable than the
real one, so the tests exercised a world where the bug cannot exist. Three corrections:

Fake behaviour	Problem	Now
git clone made an empty directory	every repository looked like a first-time write, so check --write always had a file to create	materialises a wrong dependabot.yml for a repository the generator calls drifting — the only state in which the bug exists
check --write wrote unconditionally	more capable than the generator	writes only when there is no file
git status --porcelain called the tree dirty whenever the file existed	with a file present from the clone, existence proves nothing	compares contents

With those three corrected and check --write still in place, five tests fail. That was the red;
render is the green. A new test, test_the_rewrite_uses_render_not_check, pins the call directly,
beside the existing test_write_never_carries_strict.

Context

This is the second link in the same chain. #15 fixed the first: the write call carried --strict,
which the generator refuses with exit 2, so every repository was skipped:write-exit-2. Both
failures looked identical from the summary — a uniform skipped: for the whole estate, with the run
reporting success — which is why neither was noticed. Both were found while investigating why
simtabi/netsapiens-api has a valid dependabot.yml and has never had a Dependabot pull request.

Second commit

__pycache__/ added to .gitignore. Running either test suite leaves bytecode beside the sources,
so every session after the first opens on a dirty tree and has to decide whether five .pyc files
are work.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.