Overnight loop iteration 3. api-content.ts was the highest-churn untested lib
module (7 commits; the command layer tests mock it, so nothing exercised it).
Nine tests over the REAL path — no module mocks (bun mock.module leaks across
files), just a globalThis.fetch override + the documented BUNDLE_PUBLIC_KEYSET
dev override with a generated ed25519 key, so real api-client envelope and real
crypto run: valid triad accepted, fail-closed on tampered body / unknown key /
invalid signature / incomplete headers / missing signatures, API error envelopes
pass through, path+query encoding pinned.
LATENT BUG FOUND (pinned, not fixed — flagged for morning review): fetchHealth's
documented `code: "timeout"` is dead code — apiGet collapses the AbortError to
network_error first, so doctor.ts:159's timeout branch can never fire; on a hung
API doctor shows the generic network diagnostic instead of the timeout one.
Gate: typecheck OK; oxlint 2 warnings (baseline); bun test 463 pass (+9), exactly
the 8 pinned pre-existing failures. Map refreshed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GpGAGRG6UpHpCzxzgqXgMt
The catalog's lint gate called the npm .bin shim under plain node, which fails to
resolve the platform binary on bun-installed layouts (macOS darwin-arm64 here).
Invoke oxlint the way the repo's own lint script does: bun run --bun
node_modules/oxlint/bin/oxlint. Refresh context/map over the merge commits.
All gates green on macOS: oxlint 2 warnings / 0 errors (ratchet: 6 -> 2), bun test
454 pass / 8 pre-existing fails unchanged, repo-map:check 0, examples:catalog:check 0.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GpGAGRG6UpHpCzxzgqXgMt
The scan stamp embeds the HEAD sha, so every new commit falsely registered as
drift — --check was permanently red and the weekly workflow would have opened a
PR every run. --check now normalizes stamp lines and compares real content only;
the workflow gates on repo-map:check. Map regenerated over the bootstrap commits
(real drift: churn counters moved).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TnP82rtbQpefze9rfxihtD
Real findings: src/lib is the centre of gravity (74 commits, 24 files), zero
import cycles (clean graph), risk zones are the high fan-out src/commands (Ce=38)
and src/lib (Ce=17); commands+lib co-change in 20 commits. Engine fixes along the
way: TL;DR file-count falls back to a prefix sum when primaryModule has no exact
module entry; limitations copy genericized (no npm/Astro assumptions).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TnP82rtbQpefze9rfxihtD
Claude