The new commit-time docs-mirror guard carries the forbidden branch-tip
docs URL as a scan constant, and the repo-wide link-drift smoke test
flagged the guard's own source for containing it, failing Script smoke
tests on main. Assemble the constant from parts so the runtime value is
unchanged while the literal never appears in the file. Both the drift
test and the mirror check pass locally at head.
Docs under frontend-modern/public/docs are byte-for-byte copies of repo
docs, but the only guard was a CI vitest the git hooks never run. On
2026-09-01 two commits (f4886c2dfb, f313882a7b) each edited a mirrored
doc without its copy, passed the hooks, and broke main's Frontend job.
Add scripts/check_docs_mirror.py with an index-blob --staged mode wired
into the pre-commit hook: a commit that stages either side of an
out-of-sync pair (or an orphan shipped copy) fails with the exact sync
command, while pre-existing drift from other commits only warns. The
worktree mode runs as a named step in the public-docs workflow, with
unit tests in scripts/tests picked up by the existing runner. The
docsLinks vitest stays as the CI backstop.
Build-time generation of public/docs was considered and rejected: the
shipped set is a curated subset (61 of 421 docs), so generation still
needs a hand-maintained manifest while adding build, dev-server, and
test-order coupling.
The dependency-floor smoke test asserted exact go list output, so the
maintainer lane's legitimate x/crypto v0.55.0 bump (which moved x/net to
v0.57.0) failed the Script smoke tests job on main even though both
versions clear the advisory floor. Compare versions with sort -V against
the advisory-safe minimum instead: upgrades pass, only a downgrade below
the floor fails. Verified the failing direction and the equal-version
case locally.
The Go linker's dsymutil step writes DWARF output under TMPDIR rather
than GOTMPDIR, so backend builds failed with ENOSPC on the
space-constrained boot volume even with GOCACHE and GOTMPDIR already on
the Development SSD. hot-dev now exports TMPDIR from the machine's
configured GOTMPDIR when one exists, keeping every build temp file on
the same volume as the rest of the build state.
Harden release workflow input transport and make native lifecycle proof honor each platform security boundary. Refresh stale telemetry and delivery qualifications.
Contract-Neutral: Formatting-only catalog updates and browser-verified alert copy; release compiler and native lifecycle changes update their owning contracts.
rcourtman