test(integration): harden cross-file isolation and eliminate whole-table teardown wipes

[thewrz]

This was written agentically; verify its assertions and edit accordingly:

Why

A full pnpm test:integration run against one shared Postgres was reported to fail a rotating set of unrelated files across consecutive runs, and concurrent runs from separate worktrees tripped the API rate limiter with spurious 429s.

Half of that has since been solved: ADR-090's session advisory lock serializes whole invocations. But the lock does nothing for contamination within a single run, and ADR-090 deliberately left three collision shapes in place rather than mass-rewriting them. This PR closes that remainder at the source.

What

Root cause of the 429s. The integration Vitest project did not pin NODE_ENV, so a developer (or an agent) with NODE_ENV=development in their environment ran the suite with the production rate limiter armed. src/test-utils/integration-env-setup.ts now forces NODE_ENV=test for that project. No production rate-limiting behaviour changed (ADR-046 untouched).

Cross-file fixture ownership. The parser/sec idempotency block asserted on a 27 41 00 spec that a different file's beforeAll had loaded — a genuine cross-file dependency, and a plausible source of the rotating failures. It now owns its own fixture.

Teardown scoping. Cleanup in specs, file-loader, reclassify and editability suites now deletes rows by ids the test itself captured, rather than by name/section pattern that can also match a concurrent run's fixtures.

A ratchet so the class cannot grow back. scripts/check-integration-cleanup.ts scans every *.integration.test.ts for DELETE statements that are not id-scoped and compares the result against a checked-in baseline. A new non-id-scoped delete fails the gate; fixing one requires shrinking the baseline in the same PR. It is a pure filesystem scan — it reads no VCS state — and runs inside pnpm test, so CI already exercises it with no new invocation point. The detector tolerates reformatting (leading whitespace, lowercase SQL, DELETE and FROM split across lines), requires every OR branch to be id-scoped, and allowlists individual reviewed statements rather than whole files — three bypasses the adversarial review found and fae113a2 closed, with no change to the 115-violation verdict on the current corpus.

All whole-table wipes eliminated. Every whole-table delete the ratchet found was the same statement, DELETE FROM header_footer_configs, repeated across 9 suites. All are removed: the table's scope_xor CHECK forces exactly one of client_library_id/project_id/package_id/revision_id to be non-null, and all four FKs are ON DELETE CASCADE, so every row a suite creates is removed with the owning row its teardown already deletes. Baseline: 123 → 115 violations, 0 whole-table deletes remaining.

Design decisions

• Ratchet, not a hard zero-assert. ADR-090 already decided against mass-rewriting every pattern-based teardown in one pass. This gate does not re-litigate that; it freezes the residue and blocks growth. 115 pattern/literal-scoped deletes remain baselined and visible.
• Allowlisting is keyed to statements, not files. libraries.integration.test.ts's two pattern deletes are allowlisted rather than baselined — a reviewed, deliberate choice documented inline. The allowlist names those exact statements, so a new unrelated sweep added to the same file still fails the ratchet; a file-level exclusion would have silently accepted it.
• Per the sprint policy, no ADR was added or amended; the rationale lives here and at each enforcement site.

Verification

• pnpm lint — clean (eslint + tsc + prettier).
• pnpm test — 257 files, 3658 tests, all passing (3651 + 7 regressions added for the adversarial-review findings).
• pnpm test:integration run twice back-to-back on a warm shared Postgres — identical both times: 158 passed | 12 skipped (170 files), 1816 passed | 141 skipped (1957 tests). This is the issue's primary acceptance criterion.
• Adversarial cross-review — Codex gpt-5.6-sol, effort xhigh: 4 [P2] findings, all verified valid and all fixed in fae113a2, none declined. Full assessment in this PR comment.
• The 8 suites whose wipe was removed: 8/8 files, 108/108 tests pass, and SELECT count(*) FROM header_footer_configs afterward returns 0 — the cascade argument confirmed empirically, not only from the schema.

Caveat on evidence

Two of the isolation changes are hardening whose pre-change failure could not be reproduced on demand after ADR-090's lock landed — the lock masks the concurrent-invocation shape they guard. They are correct by construction (a test no longer depends on another file's fixture; a delete no longer matches rows it did not create) but are not backed by a red→green transcript, and I would rather say so than imply evidence that does not exist.

The gap did narrow. The adversarial review found that the #442 regression pair in specs.integration.test.ts set foreignSpecId inside the first it and read it from the second — under -t filtering or a shuffled order the second test read an undefined id and failed for the wrong reason, which is the same cross-test coupling this PR removes elsewhere. Setup moved to beforeAll, and that change does have a transcript: pre-fix, vitest -t 'the foreign row survives' fails with expected [] to have a length of 1; post-fix it passes. The caveat still stands for the remaining two changes.

Testing

• Unit tests pass
• Integration tests pass
• Manual verification: run pnpm test:integration twice back-to-back; both runs green with an identical file/test count
• CI green

🤖 Co-authored by Claude Opus 5 (1M context) and Claude Sonnet 5. Closes #442.

Summary by CodeRabbit

• Bug Fixes

  • Improved integration-test cleanup to prevent accidental deletion of data belonging to concurrent test runs.
  • Ensured fixture cleanup is scoped to the specific records created by each test.
  • Preserved unrelated records with matching titles, sections, or other attributes.

• Tests

  • Added comprehensive coverage for cleanup scanning, environment setup, concurrency safety, and regression scenarios.
  • Integration tests now consistently run with NODE_ENV=test while preserving configured database settings.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 18ebcc03-040b-4bf1-a5d3-538cd86822e4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The PR adds an integration cleanup scanner and baseline, replaces broad teardown statements with scoped cleanup, makes parser fixtures explicit, and configures integration tests to force NODE_ENV=test without changing DATABASE_URL.

Changes

Integration cleanup controls

Layer / File(s)	Summary
Cleanup scanner and baseline scripts/check-integration-cleanup.ts, scripts/check-integration-cleanup.test.ts, scripts/check-integration-cleanup.baseline.json	The scanner detects unsafe DELETE statements, filters reviewed exceptions, handles filesystem errors, and validates the baseline.
Scoped integration-test teardown src/api/*integration.test.ts, src/db/queries/*integration.test.ts, src/lib/file-loader.integration.test.ts, src/mcp/*integration.test.ts	Teardown now uses ownership, project, library, or captured-ID scopes instead of broad table or predicate deletes. Regression tests verify foreign fixtures remain intact.
Deterministic parser fixtures src/parser/sec/index.integration.test.ts	The idempotency test loads its fixture and uses the returned spec ID for all subsequent operations.
Integration environment setup src/test-utils/integration-env-setup.ts, src/test-utils/integration-env-setup.test.ts, vitest.config.ts, scripts/vitest-config.test.ts	Integration tests set NODE_ENV=test before imports while preserving DATABASE_URL. Tests cover configured and unset environment values.

Sequence Diagram(s)

sequenceDiagram
  participant Vitest
  participant IntegrationSetup
  participant IntegrationTest
  participant Database
  Vitest->>IntegrationSetup: load setupFiles
  IntegrationSetup->>IntegrationSetup: set NODE_ENV=test
  Vitest->>IntegrationTest: import test modules
  IntegrationTest->>Database: create and clean scoped fixtures
  Database-->>IntegrationTest: return fixture results

Loading

Possibly related PRs

• wrzonance/SpecR#632: Related integration-test fixture isolation and cleanup changes.
• wrzonance/SpecR#644: Related cleanup hardening in overlapping integration tests.
• wrzonance/SpecR#614: Related Vitest environment setup helpers and configuration.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 42.86% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: stronger integration-test isolation and removal of whole-table teardown deletes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[thewrz]

This was written agentically; verify its assertions and edit accordingly:

Adversarial review — Codex gpt-5.6-sol, effort xhigh (cross-harness, run once)

4 findings, all [P2], all verified against the code and all fixed in fae113a2. No declines.

#	Finding	Verdict	Fix
C1	DELETE_STATEMENT required the exact uppercase DELETE FROM immediately after the opening quote — a sweep written across lines, in lowercase, or with leading whitespace produced no match and passed CI without changing the baseline	Valid. Reformatting alone defeated the gate	Regex now allows leading whitespace, flexible internal spacing, and any casing; the reported line is the DELETE keyword's, not the quote's
C2	The allowlist excluded all of libraries.integration.test.ts before scanning, so any future unrelated pattern — or whole-table — delete in that file was silently accepted	Valid. The reviewed justification covered two specific statements, not the file	Allowlist re-keyed to the reviewed statements; every file is now scanned
C3	WHERE id = $1 OR name = $2 binds a param on both sides, so the whole-clause token search saw an id comparison and called it safe while the OR branch could still delete uncaptured rows	Valid for the OR false-negative. The mirror claim (an id-scoped predicate with a literal AND is flagged unsafe) is a false positive in the conservative direction — it over-reports, never under-reports, so it is left as is	Every OR branch must now carry its own id scope; AND untouched, it only narrows
C4	specs.integration.test.ts set foreignSpecId inside the first it and read it from the second — under -t filtering or a shuffled order the second test reads an undefined id and fails for the wrong reason	Valid, and the sharpest of the four — it is the exact cross-test coupling this PR removes elsewhere	Setup moved to beforeAll

The scan's verdict on the current corpus is unchanged

C1–C3 tighten the detector, so the risk was silently reclassifying existing statements. It did not: 115 violations before and after, byte-identical filePath/snippet/reason for every entry. Only line numbers moved, and only in specs.integration.test.ts, because C4's fix added lines above them. This is a tightening, not a re-baselining.

C4 closes part of the PR's disclosed evidence gap

The body says two isolation changes have no red→green transcript because ADR-090's advisory lock masks the shape they guard. C4's fix does have one, and it is reproducible on demand:

# pre-fix
$ vitest run --project integration src/db/queries/specs.integration.test.ts -t 'the foreign row survives'
AssertionError: expected [] to have a length of 1 but got +0
Tests  1 failed | 41 skipped (42)

# post-fix
Tests  1 passed | 41 skipped (42)

The caveat still stands for the other two changes — this narrows it, it does not erase it.

Verification

• pnpm lint — clean (eslint + tsc + prettier)
• pnpm test — 257 files, 3658 tests pass (+7 new regressions: 4 formatting-bypass shapes, 1 unscoped-OR branch, 1 every-branch-scoped negative case, 1 proving a non-allowlisted delete inside an allowlisted file is still reported)
• specs.integration.test.ts — 42/42 pass in a full-file run, and the dependent test now passes standalone under -t

Per the sprint's no-ADR rule, the rationale lives here and in comments at each enforcement site.

🤖 Co-authored by Claude Opus 5 (1M context).

[thewrz]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

🧹 Nitpick comments (5)

scripts/check-integration-cleanup.baseline.json (1)

1-7: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

line values will drift and never fail.

The ratchet test compares only filePath, snippet, and reason. The line field therefore becomes stale as soon as any unrelated edit shifts a baselined statement, and nothing detects the drift. The exclusion is intentional and documented, so this is a note rather than a defect. Consider a periodic regeneration step, or drop line and let readers search by snippet.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/check-integration-cleanup.baseline.json` around lines 1 - 7, Remove
the stale line field from the baseline entry for
src/api/clients.integration.test.ts, retaining filePath, snippet, and reason so
the intentional exclusion remains documented while avoiding undetected line
drift.

scripts/check-integration-cleanup.ts (3)

186-188: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Use String.prototype.matchAll instead of cloning the regex.

The clone exists only to avoid the shared lastIndex state of the global regex. matchAll gives the same isolation, removes the cloned RegExp, and removes the repeated regexp-non-literal static-analysis warning on this line. The warning itself is a false positive here, because the source is a module-level literal.

♻️ Proposed refactor

-  const pattern = new RegExp(DELETE_STATEMENT.source, DELETE_STATEMENT.flags);
-  let match: RegExpExecArray | null;
-  while ((match = pattern.exec(cleaned)) !== null) {
+  for (const match of cleaned.matchAll(DELETE_STATEMENT)) {
     const statement = match[2] ?? '';
     if (!isPatternDelete(statement)) continue;

matchAll requires a global regex and does not mutate lastIndex on the source object, so the rest of the loop body is unchanged.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/check-integration-cleanup.ts` around lines 186 - 188, Replace the
cloned RegExp and exec loop in the cleanup scan with String.prototype.matchAll
using DELETE_STATEMENT, ensuring the regex is global as required. Preserve the
existing match iteration and loop-body behavior while eliminating the local
pattern and its static-analysis warning.

Source: Linters/SAST tools

---

80-80: 🎯 Functional Correctness | 🔵 Trivial | 💤 Low value

\w*_?id matches columns that are not identifiers.

The \w*_?id fragment matches any word ending in id, for example uuid, valid, or grid. A statement such as DELETE FROM x WHERE uuid = $1 would count as id-scoped. Anchoring on (?:^|\W)(?:id|\w+_id) would be exact. The current corpus contains no such column, so this is a hardening suggestion only.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/check-integration-cleanup.ts` at line 80, Update ID_SCOPED_COMPARISON
so its column-name fragment matches only id or names ending in _id, using a
non-word/start boundary before the name; preserve the existing comparison forms
for ANY, parameter equality, and IN subqueries.

---

164-169: 🎯 Functional Correctness | 🔵 Trivial | 💤 Low value

Block-comment detection can consume live code.

stripCommentFromLine searches for /* anywhere in the line, including inside a string literal. A test file that contains 'a /* b' on one line, with no */ on that line, sets inBlockComment to true and blanks all following lines until the next */. Any DELETE in that range is then invisible to the ratchet. The current corpus does not hit this, so the impact today is zero, but the failure mode is a silent gate bypass rather than a false positive.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/check-integration-cleanup.ts` around lines 164 - 169, Update
stripCommentFromLine to detect /* and */ only outside quoted string literals,
preserving string contents and avoiding entering block-comment state for markers
inside strings. Keep existing block-comment stripping behavior for actual
comments, including multiline comments, so DELETE detection remains intact.

scripts/check-integration-cleanup.test.ts (1)

29-48: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Assert the exact reason, not just truthiness.

expect(violations[0]?.reason).toBeTruthy() passes for every reason string. The reason is part of the baseline identity tuple, so a reason regression changes the ratchet result without any test naming the cause. Add the expected reason to each row of the it.each table.

This also documents an easily misread case: several baseline entries whose snippet is a bare DELETE FROM <table> carry the reason LIKE pattern, not a captured id, because the statement continues on later lines and the snippet keeps only the first line.

♻️ Proposed refactor

     it.each([
-      ['a LIKE pattern', 'await pool.query(`DELETE FROM projects WHERE name LIKE $1`, [x]);'],
+      [
+        'a LIKE pattern',
+        'await pool.query(`DELETE FROM projects WHERE name LIKE $1`, [x]);',
+        'LIKE pattern, not a captured id',
+      ],
       [
         'a hardcoded literal equality',
         "await pool.query(`DELETE FROM specs WHERE section = '99 00 00'`);",
+        'hardcoded literal equality, not a captured id',
       ],
       [
         'an IS NOT NULL sweep',
         'await pool.query(`DELETE FROM editing_conventions WHERE library_id IS NOT NULL`);',
+        'IS NOT NULL sweep, not a captured id',
       ],
-      ['no WHERE clause at all', 'await pool.query(`DELETE FROM header_footer_configs`);'],
+      [
+        'no WHERE clause at all',
+        'await pool.query(`DELETE FROM header_footer_configs`);',
+        'no WHERE clause — whole-table delete',
+      ],
       [
         'a bound param on a non-id column',
         'await pool.query(`DELETE FROM libraries WHERE name = $1`, [name]);',
+        'no id-scoped comparison (id = $n / id = ANY($n))',
       ],
-    ])('%s', (_label, snippet) => {
+    ])('%s', (_label, snippet, expectedReason) => {
       const violations = scanFileForPatternDeletes('fixture.ts', snippet);
       expect(violations).toHaveLength(1);
-      expect(violations[0]?.reason).toBeTruthy();
+      expect(violations[0]?.reason).toBe(expectedReason);
     });

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/check-integration-cleanup.test.ts` around lines 29 - 48, Update the
it.each table in the scanFileForPatternDeletes test to include the expected
reason alongside each label and snippet, then assert violations[0].reason equals
that row-specific reason instead of only checking truthiness. Preserve the exact
`LIKE pattern, not a captured id` reason for bare DELETE snippets where
applicable, including statements that continue on later lines.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@scripts/check-integration-cleanup.baseline.json`:
- Around line 1-7: Remove the stale line field from the baseline entry for
src/api/clients.integration.test.ts, retaining filePath, snippet, and reason so
the intentional exclusion remains documented while avoiding undetected line
drift.

In `@scripts/check-integration-cleanup.test.ts`:
- Around line 29-48: Update the it.each table in the scanFileForPatternDeletes
test to include the expected reason alongside each label and snippet, then
assert violations[0].reason equals that row-specific reason instead of only
checking truthiness. Preserve the exact `LIKE pattern, not a captured id` reason
for bare DELETE snippets where applicable, including statements that continue on
later lines.

In `@scripts/check-integration-cleanup.ts`:
- Around line 186-188: Replace the cloned RegExp and exec loop in the cleanup
scan with String.prototype.matchAll using DELETE_STATEMENT, ensuring the regex
is global as required. Preserve the existing match iteration and loop-body
behavior while eliminating the local pattern and its static-analysis warning.
- Line 80: Update ID_SCOPED_COMPARISON so its column-name fragment matches only
id or names ending in _id, using a non-word/start boundary before the name;
preserve the existing comparison forms for ANY, parameter equality, and IN
subqueries.
- Around line 164-169: Update stripCommentFromLine to detect /* and */ only
outside quoted string literals, preserving string contents and avoiding entering
block-comment state for markers inside strings. Keep existing block-comment
stripping behavior for actual comments, including multiline comments, so DELETE
detection remains intact.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4463df71-60cb-4eb8-a41a-809b44a8217d

📥 Commits

Reviewing files that changed from the base of the PR and between 14f06e3 and 8d02900.

📒 Files selected for processing (21)

• scripts/check-integration-cleanup.baseline.json
• scripts/check-integration-cleanup.test.ts
• scripts/check-integration-cleanup.ts
• scripts/vitest-config.test.ts
• src/api/contract.integration.test.ts
• src/api/editability.integration.test.ts
• src/api/header-footer-body-limit.integration.test.ts
• src/api/header-footer-resolve.integration.test.ts
• src/api/header-footer.integration.test.ts
• src/api/router-header-footer.integration.test.ts
• src/db/queries/header-footer-context.integration.test.ts
• src/db/queries/header-footer.integration.test.ts
• src/db/queries/reclassify.integration.test.ts
• src/db/queries/specs.integration.test.ts
• src/lib/file-loader.integration.test.ts
• src/mcp/header-footer-handlers.integration.test.ts
• src/mcp/header-footer-resolve-handlers.integration.test.ts
• src/parser/sec/index.integration.test.ts
• src/test-utils/integration-env-setup.test.ts
• src/test-utils/integration-env-setup.ts
• vitest.config.ts

[thewrz]

All five nitpicks handled in e9550230 — 4 fixed, 1 declined. Body-level nitpicks, so no threads to resolve.

1. \w*_?id matches columns that are not identifiers · fixed — and this was a real hole in the gate

Marked 🔵 Trivial, but it is the gate failing at the thing it exists to do. \w* swallowed the leading characters of any word merely ending in "id", so the check waved through:

old regex:  id-scoped  <- DELETE FROM t WHERE valid = $1
            id-scoped  <- DELETE FROM t WHERE paid  = $1
            id-scoped  <- DELETE FROM t WHERE grid  = $1
            id-scoped  <- DELETE FROM t WHERE overrid = $1

WHERE valid = $1 is a boolean flag — it can match arbitrarily many rows. That is precisely the unscoped sweep #638/ADR-090 exists to prevent, approved by the checker itself.

Now (?:\w+_)?id: a bare id or a <x>_id prefix still matches, while the word boundary rejects the lookalikes (the id inside valid is not preceded by one). Verified against every existing case — all 8 id-scoped forms still pass, all 4 lookalikes now flag, and the baseline is unchanged, which confirms no real teardown was relying on the hole.

Mutation-verified:

× a bound param on a boolean column ending in "id" (valid)
× a bound param on another id-suffixed non-id column (paid)
Tests  2 failed | 25 passed (27)

2. line values will drift and never fail · fixed by dropping the field

Agreed, and removed rather than periodically regenerated. The ratchet only ever compared identity, so line went stale the moment any unrelated edit shifted a baselined statement — and a stale line number is worse than none, because a reader trusts it. snippet is the durable locator, and a failing run reports live line numbers anyway. The baseline is now typed identity-only, which also lets the test compare it directly instead of mapping both sides.

3. Block-comment detection can consume live code · fixed with a loud failure

You correctly flagged the direction that matters: silent bypass, not false positive. A /* inside a string literal opens a comment that blanks every following line — and any live DELETE with it — so the gate reports zero and passes.

Rather than write a string-aware tokenizer (over-engineering for a ~200-line hygiene gate), stripComments now throws if the fold reaches EOF still inside a block comment. Genuinely unbalanced markers cannot occur in a file that compiles, so that state means either a broken file or a mis-read string — either way the scan is untrustworthy. The residual gap (a stray /* that is later closed) is documented: for any file already baselined, the disappearing violations fail the exact-match ratchet; only a brand-new file could hide one.

4. Assert the exact reason, not just truthiness · fixed

Right — toBeTruthy() would pass even if every branch collapsed onto one generic string, hiding a misclassification behind a green diagnostic. All cases now assert the exact reason, and the two new lookalike cases assert theirs too.

5. Use matchAll instead of cloning the regex · declined

The clone exists specifically to avoid sharing lastIndex with the module-level /g regex across calls, and it is documented as such. matchAll would need the same /g flag and offers no behavioural difference — a lateral change to working, explained code with no defect behind it. Happy to take it if you prefer the idiom.

Verified: pnpm lint clean, 3661/3661 unit, 27/27 scanner tests.

One note in passing: scripts/ is outside format:check (prettier --check src/), so that path has never been prettier-formatted. I hand-fixed the one deviation my own edit introduced rather than running --write, which would have produced unrelated churn. One pre-existing deviation remains at the allowlistedHits line — left alone deliberately, as it predates this PR and CI does not check it.