[systemfsoftware-maker]

Summary

The e2e bake stopped resolving dependencies. Each fixture now installs with one npm ci from its committed package-lock.json, so an upstream npm publish can no longer stall or change the lane. Main's e2e has been stuck since @effect/platform-node@4.0.3 was published: it requires peer effect@^4.0.3, which does not exist, and a fresh resolution of ^4.0.0 picks it.

Plan: docs/plans/2026-10-11-1203-fix-e2e-locked-fixtures-plan.md.

What changes

• bake-fixtures.sh runs one npm ci --no-audit --no-fund --loglevel=error per fixture. The two npm install calls, --min-release-age, timeout and kill wrapper are gone. On failure the script passes npm's output and exit code through unchanged and adds one line naming fixtures:lock.
• The committed locks leave out each closure tarball's integrity and version. At bake time the harness copies version, bin, dependencies, optionalDependencies, peerDependencies and peerDependenciesMeta onto every closure entry from that tarball's freshly packed manifest (filledLockOf in @systemfsoftware/stryker-e2e-core). A source edit or a release therefore installs without regenerating any lock.
  • version and the edge fields are what npm ci validates (npm/lib/utils/validate-lockfile.js; arborist builds edges from those four fields in node.js loadDeps).
  • bin is there because npm links bins from the lock's metadata, not from the extracted tarball (arborist/lib/arborist/rebuild.js calls binLinks({ pkg: node.package })). Without it, a changed bin would install the stale link with exit 0.
• pnpm pack --out <packs>/%s.tgz writes tarballs without a version in the file name. The staged fixture manifest lists the whole closure, aliases included, as file:../../packs/<name>.tgz devDependencies (ClosureInstall.dependencies).
• pnpm --filter @systemfsoftware/stryker-e2e fixtures:lock (BakedFixtureCache.lockProgram) stages every fixture the way the bake does, runs npm install --package-lock-only --ignore-scripts, and writes the lock back with closure integrity and version removed.
• The seven test/e2e/testResources/*/package-lock.json files are seeded from fix(repo): resolve the e2e fixture bake against a pinned registry snapshot #285's locks and regenerated by that script. Re-running it leaves all seven byte-identical (checked after the bin change too).

Done (c): the @effect pins equal pnpm-lock.yaml

pnpm-lock.yaml:
  effect@4.0.0
  @effect/platform-node@4.0.0
  @effect/platform-node-shared@4.0.0

fixture                          effect platform-node platform-node-shared
calc-fixture                     4.0.0 4.0.0 4.0.0
enterprise-monorepo-fixture      4.0.0 4.0.0 4.0.0
failing-fixture                  4.0.0 4.0.0 4.0.0
svelte-app-fixture               4.0.0 4.0.0 4.0.0
typescript-checker-fixture       4.0.0 4.0.0 4.0.0
vitest-nested-describe-fixture   4.0.0 4.0.0 4.0.0
vm-vitest-fixture                4.0.0 4.0.0 4.0.0

Each row is jq -r '[.packages["node_modules/effect"].version, .packages["node_modules/@effect/platform-node"].version, .packages["node_modules/@effect/platform-node-shared"].version]|join(" ")' over that fixture's lock.

No closure entry in any lock keeps integrity or version. jq '[.packages[]|select((.resolved//"")|startswith("file:"))|select(has("integrity") or has("version"))]|length' prints 0 for all seven.

Done (d): drift fails with npm's own error

This ran in a scratch copy outside the worktree, with no VM. calc-fixture was staged the way the bake stages it: catalog specs resolved, closure devDependencies written, lock filled from 17 freshly packed tarballs. The control npm ci exited 0 (added 149 packages in 1s), and node_modules/.bin/stryker pointed to ../@systemfsoftware/stryker-js/dist/main.mjs. Each case below then ran the bake script against that directory.

Lock deleted:

[bake] calc-fixture: npm ci
npm error code EUSAGE
npm error
npm error The `npm ci` command can only install with an existing package-lock.json or
npm error npm-shrinkwrap.json with lockfileVersion >= 1. Run an install with npm@5 or
npm error later to generate a package-lock.json file, then try again.
...
[bake] calc-fixture: npm ci exited 1; if package-lock.json drifted or is missing, run pnpm --filter @systemfsoftware/stryker-e2e fixtures:lock and commit the result

effect bumped from ^4.0.0 to ^4.0.2 in the staged package.json:

[bake] calc-fixture: npm ci
npm error code EUSAGE
npm error
npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm error
npm error Invalid: lock file's effect@4.0.0 does not satisfy effect@4.0.3
...
[bake] calc-fixture: npm ci exited 1; if package-lock.json drifted or is missing, run pnpm --filter @systemfsoftware/stryker-e2e fixtures:lock and commit the result

Both failed in under a second, with exit code 1 from npm.

Why npm hung instead of failing with ETARGET

The cause is unknown. In a scratch install, a packed tarball depending on @effect/platform-node@^4.0.0, installed with no lock, printed nothing and ignored SIGTERM until it was killed at 125 s. The same edges declared in the root manifest failed with ERESOLVE in 2 s.

Known gap: regeneration does not pin to pnpm-lock.yaml

The root ruled that a fixture lock and pnpm-lock.yaml must record the same version wherever both resolve a package. This PR does not enforce that yet.

• fixtures:lock copies each fixture's directory, committed lock included, into staging (test/e2e/src/Harness/fixture-cache.service.ts:301, fs.copy). It then runs npm install --package-lock-only there (:738, LOCK_ONLY_INSTALL at :114). npm keeps every locked version that still satisfies its range, so the 4.0.0 pins survive only because fix(repo): resolve the e2e fixture bake against a pinned registry snapshot #285's locks carried them.
• With a missing lock, a new fixture, or a closure member's range change, ^4.0.0 resolves fresh and picks @effect/platform-node@4.0.3, the same release that stalled the bake.
• Of the 242 package names that both pnpm-lock.yaml and the seven locks resolve, 53 already differ in version (e.g. @redis/client 6.3.0 vs 6.2.1). None of them is one of the @effect packages above.
• The proposed fix is a catalog-scoped pin. Regeneration would take each catalog name's version from pnpm-lock.yaml's catalogs.default section, which records one version per name, and would apply it the same way at bake time so npm ci still matches. The root has not yet decided whether that lands in this PR (as more commits on this branch) or in a follow-up.

Known risks

• Install scripts. Closure entries keep hasInstallScript from the lock, and the fill-in does not refresh it. None of the 17 packed closure manifests has a preinstall, install or postinstall script (scanned with tar -xOzf <tgz> package/package.json), so nothing changes today.
• committableLockOf has no unit test. Its output is the seven committed locks; the jq check above shows no closure entry keeps integrity or version.
• withClosureDevDependencies has no unit test. Only the bake covers it, and only indirectly. In the scratch copy, a staged manifest without the closure devDependencies still passed npm ci (exit 0, added 39 packages), because npm prunes the lock's extra closure entries instead of refusing them. The fixture then has no node_modules/.bin/stryker, so the e2e legs fail at the first CLI run rather than at the bake.
• A stalled npm ci has no bound. The plan and the root ruled out any timeout, kill wrapper or retry. The [bake] <fixture>: npm ci line printed before each install still names the fixture.
• A fixture's own file: tarball dependency would break. The strip removes integrity and version from every file:*.tgz entry, but only closure tarballs are refilled. None of the seven locks has such an entry.
• Tarball names can collide. Without the version, @x/y and x-y would both pack to x-y.tgz. That cannot happen while every closure member is @systemfsoftware-scoped.
• The bake cache key does not cover harness code (filledLockOf, withClosureDevDependencies). A local baked entry can outlive a change to them, as before this PR; CI starts cold.

Tests

• In-source property suite in test/e2e-core/src/closure-lock.ts. It sits in-source because the repo's test-discipline lint rejects a src/__tests__ property file for a module that is not a workflow.
  • ∀m_StaleClosureEntry_≡ManifestVersionDependenciesAndBin: a stale closure entry takes the manifest's version, dependencies and bin, and nothing else (the manifest's license must not be copied).
  • ∀d_DependencyAbsentFromLock_∈FilledEntry: a dependency the lock lacks lands in the filled entry.
  • ∀r_RegistryEntry_≡Unchanged: registry entries pass through unchanged.
• Red runs:
  • Against a stub fill-in that returned the lock unchanged, the first two properties failed and the third passed.
  • Against the previous five-field list without bin, the stale-entry property was refuted (2 shrinks).
  • Neither red was committed.
• pnpm --filter @systemfsoftware/stryker-e2e-core test at 670048b92: 45 files, 349 tests pass. After the bin change the property suite passes 3/3, and typecheck, oxlint and tsgo lint are clean for e2e-core. Typecheck and lint are also clean for e2e. pnpm format:check exits 0.
• No local e2e or mutation run. The five e2e legs on this PR are the end-to-end proof.

Size

git diff --numstat origin/main...HEAD, excluding docs/plans and the package-lock.json files. 254 hand-written lines; the 3 pnpm-lock.yaml lines are generated.

File	Added	Removed
docs/solutions/build-errors/e2e-bake-resolved-an-npm-alias-edge-from-the-registry.md	3	3
docs/solutions/build-errors/e2e-lane-packed-a-subset-of-its-workspace-closure.md	4	4
pnpm-lock.yaml (generated tsx edge)	3	0
test/e2e-core/src/closure-lock.ts	117	0
test/e2e-core/src/install-closure.workflow.ts	12	5
test/e2e-core/src/mod.ts	1	0
test/e2e/AGENTS.md	1	1
test/e2e/README.md	2	2
test/e2e/package.json	2	0
test/e2e/scripts/lock-fixtures.ts	7	0
test/e2e/src/Harness/bake-key.schema.ts	0	12
test/e2e/src/Harness/fixture-cache.service.ts	99	64
test/e2e/tests/__fixtures__/bake-fixtures.sh	6	19
Total	257

Review notes

• Simplify pass: done. Two reviewers reported, and every suggestion was line-neutral or added lines, so none was applied. The third reviewer was stopped.
• Code review: lighter than the full reviewer set: one correctness read plus one local adversarial reviewer, since no outside-model reviewer was installed. Compound Packs were not assessed in that review.
  • P1, regeneration pinning: the "Known gap" above, deferred to the root.
  • P2, bin drift: fixed in bdff834ea.
  • Two P3 doc findings: fixed in 4696b2199.
• Supersedes ci/e2e-postsubmit's edits to bake-fixtures.sh and the README's install paragraph.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Compound pack check (report-only, ruled by the sub-conductor)

Against the changed files: 7 rules pass, 2 fail, 22 don't apply. Both failures are declared here, not fixed:

• schema-laws rich-type-over-foreign-encoded: test/e2e-core/src/closure-lock.ts reads npm lock fields as plain JSON with no decoded type. This is deliberate: the unit's contract rules out npm wire schemas (plan KTD1).
• boundary-testing pin-dependency-semantics: the tarball naming of pnpm pack --out (fixture-cache.service.ts:126) and the lock fields npm ci reads (closure-lock.ts) have no dedicated test that runs pnpm or npm. Two things exercise them for real instead: the five e2e legs, which pack the closure and run npm ci against the filled locks, and the Done (d) scratch runs above. A pnpm or npm upgrade that changes either behaviour fails an e2e leg. No extra test was added, to stay within the line limit.

Simplify pass: done with reason. Two reviewers reported suggestions that kept or added lines, and the third was stopped. The code review was report-only and lighter than the full reviewer set.

[ryanleecode]

Verified at 4696b21: all 5 e2e legs, check, checker-parity and Nix green; up to date with main; 0 open threads; ~250 hand-written lines plus 7 committed fixture locks; no skips, disables, caps or force flags. Only red is the bench enterprise leg's setup-timed-out, which fails on every PR and leaves PRs with Stream G's bench-main-only.