Repair stale merge path in build-script boundary test (#815)

[leynos]

Correct the runtime-only rerun list to reference
src/cli/merge/mod.rs. Reject stale runtime-only entries whose files no
longer exist, and prove in memory that tracking the actual merge module
is rejected.

This guards unnecessary build-script reruns and does not indicate a
runtime failure. The mismatch was present at the base of PR #813, making
this follow-up separate from issue #811.

Closes #815

Summary by Sourcery

Repair build-script boundary checks for runtime-only rerun paths and prevent stale merge-module tracking.

Bug Fixes:

• Correct the runtime-only rerun path to track the actual merge module file.
• Reject stale or invalid runtime-only rerun entries before they can cause unnecessary build-script reruns.

Enhancements:

• Add in-memory coverage proving that tracking the runtime-only merge module is rejected.

Tests:

• Add validation that all configured runtime-only rerun paths exist.
• Add a mutation test covering rejection of the merge module rerun directive.

References

• Related architectural boundary work: Narrow the build script's module graph instead of module-wide dead-code expectations #513
• Session: https://lody.ai/leynos/sessions/001b7c8d-ffcf-43af-bc06-7cad71254848

[coderabbitai]

Warning

Review limit reached

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

• Ask an admin to enable usage-based reviews

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Next included review available in 28 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 96 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Team
• Run ID: 91deb62e-b6e0-4c2e-a47b-9b9d6976f89c

📥 Commits

Reviewing files that changed from the base of the PR and between b6e7cf5 and 76f5ba1.

📒 Files selected for processing (2)

• tests/build_module_slice_ui_tests.rs
• tests/support/build_module_slice_runtime_only_tests.rs

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Reviewer's Guide

Repairs the stale merge-module path in the runtime-only rerun allowlist and adds filesystem and mutation-based tests to ensure build-script rerun directives cannot track runtime-only modules.

File-Level Changes

Change	Details	Files
Correct and validate the runtime-only rerun path allowlist.	Update the merge module path to src/cli/merge/mod.rs. Add a test that fails when any allowlisted runtime-only file is missing.	tests/build_module_slice_ui_tests.rs
Strengthen the build-script boundary guard against runtime-only dependencies.	Extract runtime-only path rejection into a reusable helper invoked by the rerun-directive test. Mutate the build script in memory to add the merge module directive and verify the guard rejects it with an identifying error.	tests/build_module_slice_ui_tests.rs tests/support/build_module_slice_runtime_only_tests.rs

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#815	Correct the runtime-only rerun path list to reference the actual merge module at src/cli/merge/mod.rs.	✅
#815	Validate that every path listed as runtime-only exists, preventing future stale entries from silently weakening the boundary check.	✅
#815	Add a mutation test demonstrating that a build-script rerun directive tracking src/cli/merge/mod.rs is rejected.	✅

Possibly linked issues

• Repair stale merge path in build-script boundary test #815: The PR implements all requested fixes: corrects the path, validates existence, and adds mutation-based rejection coverage.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Sorry @leynos, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 2 days and 4 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-03T12:27:03.512409Z	76f5ba1	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-03T12:27:27.245051Z	76f5ba1	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[wafflecat-df12]

@coderabbitai review. Candidate head: 76f5ba1, based on main b6e7cf5. Please inspect the runtime-only merge-module boundary and its mutation test. Validation passed: make check-fmt, make test, make typecheck, and make lint.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
git rev-parse HEAD
git diff --stat b6e7cf502a26d16bf7319c0990441b4920271a95 76f5ba1d93b4069af7fa4310f874eeabdc4ac7f6
git diff --no-ext-diff b6e7cf502a26d16bf7319c0990441b4920271a95 76f5ba1d93b4069af7fa4310f874eeabdc4ac7f6
fd -H '^AGENTS\.md$|^\.coderabbit\.ya?ml$'

Length of output: 733

---

🏁 Script executed:

#!/bin/bash
gh api repos/leynos/netsuke/compare/b6e7cf502a26d16bf7319c0990441b4920271a95...76f5ba1d93b4069af7fa4310f874eeabdc4ac7f6 --jq '{status, files: [.files[] | {filename,status,patch}]}'
fd -H '^AGENTS\.md$|^\.coderabbit\.ya?ml$'
fd -i 'build|boundary'
rg -n -C3 'runtime.only|src/cli/merge/mod\.rs' --type rust

Length of output: 15867

---

🏁 Script executed:

#!/bin/bash
cat AGENTS.md
ast-grep outline tests/build_module_slice_ui_tests.rs --items all
ast-grep outline tests/support/build_module_slice_runtime_only_tests.rs --items all
ast-grep outline build.rs --items all
ast-grep outline src/cli/merge/mod.rs --items all
sed -n '1,120p' tests/build_module_slice_ui_tests.rs
sed -n '230,390p' tests/build_module_slice_ui_tests.rs
cat -n tests/support/build_module_slice_runtime_only_tests.rs
rg -n -C4 'rerun-if-changed|path =|mod cli|mod host' build.rs
rg -n -C3 'mod merge|cfg.*build|mod parser|mod discovery' src/cli/mod.rs
python - <<'PY'
import pathlib, re
source = pathlib.Path('tests/build_module_slice_ui_tests.rs').read_text()
block = re.search(r'const RUNTIME_ONLY_RERUN_PATHS:.*?= &\[(.*?)\];', source, re.S).group(1)
for path in re.findall(r'"([^"]+)"', block):
    print(f'{path}: is_file={pathlib.Path(path).is_file()}')
PY

Length of output: 57886

---

@wafflecat-df12 Review complete for 76f5ba1, compared with b6e7cf5. No actionable findings.

• The runtime-only list now references src/cli/merge/mod.rs. All six listed files exist.
• The new existence test rejects stale entries and reports the missing paths.
• The mutation test inserts the merge-module rerun directive in memory. It verifies that the parser detects the directive.
• The mutation test calls the runtime-only guard directly. This prevents the earlier CLI exact-match check from masking a broken guard. It also checks that the rejection identifies the merge module.

This change guards unnecessary build-script reruns. It does not change runtime behaviour.

Validation was inspected, not executed. The reported make check-fmt, make test, make typecheck, and make lint results remain user-provided.

[review]

You are interacting with an AI system.