Dep bump (madder/dewey/tommy/tap → 2026-06-07) breaks 5 bats tests: triage notes for a future attempt

[sfriedenberg-etsy]

What this is

A record of an aborted bulk amarbel-llc dependency bump and everything we
observed, so a future attempt starts from facts instead of re-discovering them.
The bump was not merged. Most of the attribution below is theory — we
explicitly did not isolate causes. Treat the "Facts" as load-bearing and the
"Theories" as starting hypotheses to verify.

Branch state

Work lives on smart-hazel (unmerged), two commits past c380c2df3:

• 894fe3b4f chore(deps): bump amarbel-llc flake inputs + regenerate tommy codegen
• 16f4ebe3c test(ui): migrate cli_error_tree to dewey v0.3 HTTPRender API

Both merge-this-session attempts failed the pre-merge just hook. These
commits can be cherry-picked or discarded by a future attempt; nothing here is
authoritative beyond "it compiled and got this far."

Facts (observed in tool output)

Deps that moved

just go/resync-flake-go re-pinned 5 Go modules to match the bumped flake
inputs:

Module	From	To
madder/go	v0.3.31 (00613b3, 05-31)	v0.3.35-pre (416bcbf, 06-07)
purse-first/libs/dewey	v0.2.6 (67a6f4d)	v0.3.1-pre (422cb1c, 06-07)
purse-first/libs/go-mcp	v0.2.6	v0.3.1-pre (422cb1c)
tap/go	v0.1.11 (c3a844e)	v0.1.12-pre (cc0ee92)
tommy	v0.2.9 (de8fc5d)	v0.3.3-pre (75834a1, 06-07)

Flake inputs also advanced: bats, igloo, treelint (the last migrated to
conformist upstream — the lock diff added a conformist subtree and dropped
treelint/treefmt-nix nodes).

Compile-time breaks we fixed to get the tree building

1. tommy v0.3 cst API: committed *_tommy.go already referenced
   cst.FindChildInlineTable / cst.FindChildTable (and _seen duplicate-key
   guards) that did not exist in the v0.2.9 module pin. Fixed by
   resync-flake-go + go/build-go-generate regenerating against v0.3.3.
2. dewey GetStatusCode() → HTTPStatusCode() (returns http_statuses.Code):
   internal/sierra/remote_http/request_response.go. Rewrote Response.Error()
   to extract status via dewey's HTTPStatusCarrier interface.
3. dewey HTTPStatusError.WrapIncludingHTTP(x) → .Wrap(x).HTTPRender(), and
   the wire render dropped the errors. prefix (errors.HTTP: 501 … → HTTP: 501 …):
   go/lib/alfa/ui/cli_error_tree_state_test.go. This test only compiles under
   -tags test (dewey's pkgs/ui harness is //go:build test-gated), so a bare
   go build ./... did NOT surface it — only the nix test-go-unit lane
   (go test -tags test,debug ./...) did. Lesson: verify with the lane's tags,
   not go build ./....

Runtime test failures (2nd merge attempt reached the bats lane)

test-go-unit PASSED. test-bats failed with 5 of 505 tests. Observed
outputs:

• Deprecate addTypeAndExpandedIfNecessary and design type inheritance #43 blob_store_sync_twice — path-text mismatch. Expected regex
  .../\.madder/local/share/blob_stores/test/blob_store-config; actual
  .../.xdg/data/madder/blob_stores/test/blob_store-config.
• Add dodder-level integration tests for SFTP blob stores #83 checkin_explicit_workspace_delete_files and
  #333 organize_default_tags_workspace — both fail with runtime error
  duplicate key "tags", identical stack through
  madder/go/internal/charlie/hyphence/coder_tommy.go:35 →
  coder_type_map.go:103 → dodder konfig_edit.go / organize path.
  coder_tommy.go:35 is just errors.Wrap(err) around coder.Decode(input);
  the duplicate key string is emitted by tommy-generated decode code (the
  _seen map guard).
• remote_http TCP path is broken: nonce sig generation fails purpose/format validation #165 init_with_pandoc_tools_creates_type_objects — the !md type-blob
  digest changed: expected @blake2b256-ctgjs28…, actual @blake2b256-wn23tu….
  This digest is hardcoded in current_version/format_pandoc.bats, not in
  .fixtures.env.
• #351 push_history_zettel_type_tag_yes_conflicts — output has one EXTRA
  line: the message import failed with conflicts, merging required is rendered
  twice (once as the line, once as a └── tree child).

Things that PASSED (so they're not broken by the bump)

• checkin_type_file_creates_type_object (bug(checkin): checkin_type_file_creates_type_object fails after madder v0.3.16 bump #181) — passes under new madder;
  commented there.
• All migration_* tests (502–505) — frozen previous_versions/ fixtures still
  valid against the bumped binary.
• test-go-unit (full Go unit suite) after the three compile fixes.

Fixture regen does NOT apply here

VCurrent is unchanged (V15). just test-bats-update-fixtures only regenerates
previous_versions/v*/; all 5 failures are in current_version/. Per CLAUDE.md
("update assertions, not fixtures" for output changes), regen is the wrong tool
for these.

Theories (NOT verified — isolation was aborted)

We did not bisect, so every causal claim below is a hypothesis:

• Deprecate addTypeAndExpandedIfNecessary and design type inheritance #43 path shift → theory: madder's XDG store-id scope change. madder log
  between the revs shows 7c9f04b24 fix: init resolves unprefixed store-ids in XDG scope like write (closes #227) and f071f0ae4 / a91af49c1 touching
  store-id layout. Plausible but unconfirmed.
• Add dodder-level integration tests for SFTP blob stores #83 / #333 duplicate key "tags" → theory: tommy v0.3 added strict
  duplicate-key rejection in generated decoders; dodder's konfig/organize emit
  path produces a doubled tags key that old tommy tolerated. Unknown
  whether this is (a) a dodder bug emitting a real duplicate, or (b) a
  tommy encode/decode asymmetry, or (c) intended strictness needing a dodder
  fix. This is the one most likely to be a genuine regression rather than
  drift — needs the emitted config-blob bytes inspected.
• remote_http TCP path is broken: nonce sig generation fails purpose/format validation #165 digest change → theory: tommy re-serialization changed the
  canonical type-blob bytes, OR embedded pandoc-tool content changed. Unknown
  which.
• #351 doubled error line → theory: dewey v0.3.0's documented rendering
  change (madder commit 4611ba3e3: "Error() returns the underlying user
  message instead of errors.HTTP: 400 …") altered how wrapped errors render in
  dodder's tree encoder, adding a duplicate node. This is the strongest
  fact→theory link (the rendering change is documented upstream) but still not
  isolated.

Coupling constraint (why isolating "just dewey" is hard)

Old madder v0.3.31 (00613b3) go.mod requires dewey v0.1.8 and an old
tommy pseudo (87255e8). madder v0.3.35 was built against dewey v0.3.x / tommy
v0.3.x (its own HTTP helpers and hyphence coders). So reverting madder/tommy
while advancing only dewey may not produce a buildable tree — the three move as
a set. A future isolation attempt should probably bisect by reverting tommy
alone (madder v0.3.35 + dewey v0.3.1 are a shipped-together pair, more likely
to compile) to test the duplicate key / digest hypotheses.

Suggested approach for the next attempt

1. Re-apply the bump (nix flake update + just go/resync-flake-go) and the
   three compile fixes (cherry-pick 894fe3b4f + 16f4ebe3c or redo).
2. Bisect the 5 runtime failures by reverting tommy alone first.
3. For duplicate key "tags": reproduce organize_default_tags_workspace
   locally and inspect the config-blob bytes dodder emits — bug vs. strictness.
4. Verify all test-code with the lane's tags (go test -tags test,debug ./...),
   never a bare go build ./....
5. Deprecate addTypeAndExpandedIfNecessary and design type inheritance #43 / remote_http TCP path is broken: nonce sig generation fails purpose/format validation #165 are likely assertion updates once the underlying behavior changes
   are confirmed intended.

Related

• dewey non-error status constants: dewey/http_statuses: add Code constants for common non-error statuses (200/201/204/302/404/417) purse-first#141 (filed this
  session)
• madder XDG store-id work: madder#227, Add JSON content negotiation for read-only HTTP API clients #230, Mutable-config: per-tag public exposure to scope sigMiddleware bypass #231, Workspace config: gitignore-style ignore patterns for the external-item scan #232
• bug(checkin): checkin_type_file_creates_type_object fails after madder v0.3.16 bump #181 (checkin) — now passing under the bump; commented.

🤡 Filed by Clown (0.3.10+bb6560d, built from bb6560d).

[friedenberg]

Status correction + partial progress from an adjacent session (calm-willow, working #249):

• smart-hazel is deleted — the "cherry-pick 894fe3b4f / 16f4ebe3c" option in this issue no longer exists. The cli_error_tree migration was redone by hand from the notes above.
• purse-first(dewey) was bumped ALONE on calm-willow (needed purse-first#145 for MCP server: writes fail "already locked" with stale zero-byte env lock left at $XDG_STATE_HOME/dodder/lock #249), and the tree builds with madder v0.3.31 + tommy v0.2.9 still pinned — the coupling constraint is softer than feared for the dewey leg.
• Compile fixes Claude zettel id component log #2 and Safe seq error #3 land via calm-willow's next merge: request_response.go now uses int(httpError.HTTPStatusCode()), and cli_error_tree_state_test.go is migrated to .Wrap(...).HTTPRender() with the errors. prefix dropped from expectations (ui package green under -tags test,debug).
• Isolation datapoint pending: calm-willow's pre-merge full-suite run is effectively the dewey-only bisect leg. If #351 (push_history_zettel_type_tag_yes_conflicts doubled conflict line) reproduces there, it's pinned on dewey's render change; if not, it needs the newer madder/tommy. Result will be reported here. The tommy-attributed failures (Add dodder-level integration tests for SFTP blob stores #83/#333 duplicate key "tags", remote_http TCP path is broken: nonce sig generation fails purpose/format validation #165 digest) cannot reproduce on that branch and remain open hypotheses.

madder/sunny-willow has been pinged with the same.

🤡 Clown 0.3.10+44f75d5 (44f75d5)

[friedenberg]

madder-side isolation: what madder actually changed in the bump range

Examined madder 00613b3 (old pin) → 416bcbf (v0.3.35-pre) from the madder repo directly. Facts from the diff:

• 30 files changed, four functional areas: store-id scope resolution (madder#227/Add JSON content negotiation for read-only HTTP API clients #230/Mutable-config: per-tag public exposure to scope sigMiddleware bypass #231), err-sink chatter routing (madder#228/docs/plans: scope FDR-0010 null type as notation-only #229/Workspace config: gitignore-style ignore patterns for the external-item scan #232), additive ssh-agent key discovery (madder#226), list -tree output forcing (madder#225), plus dewey pin bumps.
• go/internal/charlie/hyphence/ is byte-identical across the range — empty diff.
• The string duplicate key appears nowhere in madder's Go tree, and madder's generated *_tommy.go files (hyphence + blob_store_configs) do not reference tommy v0.3's cst.FindChildInlineTable/FindChildTable API at all — madder's codegen was never regenerated against strict tommy.
• Nothing in the range touches blob serialization or digest computation — the markl diff is purely an additive DiscoverAgent*KeysVerbose(socketEnvVar) API.

Attribution per failure

failing test	madder's fault?	evidence
#43 blob_store_sync_twice (path shift)	yes — intended behavior change	madder 7c9f04b (closes madder#227): init now resolves unprefixed store-ids in XDG scope like write, instead of landing in an ancestor .madder. The expected/actual paths in the failure are exactly the before/after of that fix. Assertion update, not a revert.
#83/#333 duplicate key "tags"	no	the strict _seen guard does not exist anywhere in madder, old or new. The stack frames through madder's coder_tommy.go:35 / coder_type_map.go:103 are generic dispatch (errors.Wrap around coder.Decode); the failing decoder is dodder's own codegen, regenerated against tommy v0.3.3 in 894fe3b4f. Still open whether dodder genuinely emits a doubled tags key or tommy v0.3 has an encode/decode asymmetry.
#165 !md type-blob digest change	no (theory)	the hardcoded digest is the symptom, but no madder change in the range can alter blob bytes (hyphence + blob_store_configs encoders unchanged). Most plausible source is tommy v0.3's regenerated encoder changing canonical serialization — again via dodder's regen, not madder. Unverified: needs the emitted type-blob bytes diffed under old vs new codegen.
#351 doubled conflict line	no (madder code)	dewey v0.3 render change remains the lead theory. calm-willow has a dewey-ONLY bump in flight (old madder/tommy pins — and it builds, so the coupling concern in this issue was overstated; MVS found a working set with madder v0.3.31 + dewey v0.3.1-pre). Its full-suite merge hook is the isolation run: #351 failing there pins it on dewey; passing means the doubling needs newer madder/tommy too.

Bottom line: of the five failures, madder owns exactly one (#43, intended XDG fix → update the assertion). The other four are tommy-v0.3-regen and dewey-v0.3-render effects. The suggested "revert tommy alone" bisect from this issue is still the right next move for #83/#333/#165 — and note smart-hazel is deleted, so the cherry-pick option in this issue's notes is gone; two of the three compile fixes have been redone on calm-willow.

🤡 Posted by Clown (0.3.10+44f75d5, built from 44f75d5).

[friedenberg]

#351 isolated to dewey (dewey-only bump reproduces it)

calm-willow's pre-merge just (full bats suite) just ran with purse-first/dewey bumped to v0.3.1, madder v0.3.31 and tommy v0.2.9 unchanged. Result: exactly one failure — not ok 357 push_history_zettel_type_tag_yes_conflicts (this issue's #351). The other four #237 failures (#43 path, #83/#333 duplicate key, #165 digest) did not reproduce, consistent with their being madder/tommy-attributed.

So #351's doubled conflict line is caused by dewey's v0.3 error-render change alone — confirmed, not just theorized.

Failure detail (from the merge hook log):

expected: ... import failed with conflicts, merging required   (once)
actual:   ... import failed with conflicts, merging required
          └── import failed with conflicts, merging required   (doubled: flat line + tree child)

This looks like a genuine rendering regression, not just a stale assertion: a user now sees the conflict message twice. The doubling is in dodder's CLI error-tree encoder (lib/alfa/ui/cli_error_tree) reacting to dewey v0.3's Error()-returns-underlying-message change — i.e. the wrapped conflict error, which previously rendered with a distinguishing prefix on the outer layer, now renders identically at both the line and the child node, so the tree encoder no longer collapses them.

Practical consequence: this now blocks the calm-willow #249 merge, because #249 requires the dewey bump (purse-first#145). So the #351 fix has to happen as part of landing #249's dewey bump, rather than waiting for the full #237 attempt. Picking it up next.

🤡 Clown 0.3.10+44f75d5 (44f75d5)

[friedenberg]

Closing — the bulk-bump framing here is superseded; the bump was completed piecemeal and the legs isolated cleanly:

• dewey leg → DONE & merged. Bumped for MCP server: writes fail "already locked" with stale zero-byte env lock left at $XDG_STATE_HOME/dodder/lock #249 (purse-first#145), compile fixes Claude zettel id component log #2 (request_response.go HTTPStatusCode) and Safe seq error #3 (cli_error_tree_state_test.go migration) applied, and the #351 doubled-conflict-line failure root-caused to dewey's v0.3 Error() render change and fixed in the cli error-tree encoder (transparent-wrapper collapse). A dewey-only pre-merge run confirmed #351 was the only dewey-attributed failure.
• madder leg → DONE & merged. Bumped v0.3.31 → v0.3.35; the sole madder-attributable failure was Deprecate addTypeAndExpandedIfNecessary and design type inheritance #43 (blob_store_sync_twice, madder#227's intended unprefixed-store-id → XDG-user resolution), assertion updated. sunny-willow's independent madder-side isolation confirmed madder owned only Deprecate addTypeAndExpandedIfNecessary and design type inheritance #43.
• tommy leg → DEFERRED to Bump tommy to v0.3 (codegen regen): resolve duplicate-key "tags" + !md digest drift #254. tommy was intentionally not bumped (madder's go.mod requires the old tommy, so neither the dewey nor madder bump dragged it). The remaining three failures — Add dodder-level integration tests for SFTP blob stores #83/#333 duplicate key "tags" and remote_http TCP path is broken: nonce sig generation fails purpose/format validation #165 !md digest — are tommy-v0.3-codegen, tracked focused in Bump tommy to v0.3 (codegen regen): resolve duplicate-key "tags" + !md digest drift #254 with the isolation notes.

Nothing actionable left under this broad issue; #254 carries the remainder.

🤡 Clown 0.3.10+44f75d5 (44f75d5)