[lucasbraum]

Fixes UPT-124.

Root cause

The fatal check is packages/core/src/fix/managers/upgrade.ts:479 on main: Requested …, but … resolved …; verification cannot use a different target. It also has a second copy after the install, assertInstalledVersions in fix/versions.ts:56.

The check was right; the pin before it failed on Yarn classic. installPinned pins Yarn through root resolutions, but Yarn classic applies resolutions to transitive dependencies only. A direct "ai": "^7.0.105" therefore resolves its newest match. I reproduced this by hand on stakwork/strut:

• with resolutions: { ai: "7.0.105" } the lockfile gets ai@7.0.105 → 7.0.105 and ai@^7.0.105 → 7.0.146;
• pinning the manifest to 7.0.105 and then restoring ^7.0.105 resolves 7.0.146 again;
• adding ai@^7.0.105 to the ai@7.0.105 entry's header holds through yarn install and yarn install --frozen-lockfile.

Berry already pins through yarn set resolution. npm and pnpm pin the manifest and then reuse the satisfying entry. The network-gated matrix in compatible-ranges.test.ts covers npm, pnpm and Berry 3/4, but had no Yarn classic case.

What changed

• Yarn classic pins the target: pinClassicPatterns moves each range's pattern (ai@^7.0.105) onto the lockfile entry at the target and drops the entry that is left empty. It runs before the reconcile, in the same place Berry runs set resolution. The manifest keeps its range (^7.0.105 stays caret). The LOCKFILE_OUT_OF_SCOPE guard still runs on the final lockfile, unchanged.
• Acceptance rule (upgradeInstall): if the lockfile still resolves another version, the run continues only if that version is in the target's major, satisfies the manifest range (npm aliases unwrapped), and is the same in every workspace. In run.ts, pack.supports(from, resolved) must also hold. Anything else stops with Requested <name>@<target>, but <workspace> resolved <version>: <reason>. The reason is one of: a different major than …, outside the manifest range …, another workspace resolved …, nothing is installed, or outside what the <pack> pack covers.
• Reported: lockfile.resolved: [{ name, requested, version }] on the install report, and resolvedVersion next to target in report.json (FixResult, typed in fix/types.ts). The PR body and the terminal summary get a Resolved version differs from the target section. Both assertInstalledVersions calls in run.ts, and the one in reverify.ts, use the resolved versions. When target and resolved already match, nothing changes: no field and no section.
• Not touched: peer-blocker handling (UPT-125), bench/, pricing.ts, release scripts, the Action pin, golden workflows.

Repro: stakwork/strut at 41fb967 (parent of PR 11's merge eda56a5), yarn 1.22.22

Command, from the read-only clone (nothing pushed, no comments on that repo):

ANTHROPIC_API_KEY=invalid-placeholder uptide fix ai --target 7.0.105 --verbose --ci --keep-temp --max-cost 0.001

The key is a placeholder and the budget is $0.001, so no billed LLM call was possible.

Before (origin/main 5ffd256), exit 2, about 30 s, fails at install:

  install · ai 7.0.105 with 1 package (4.6s)
✖ Migration of ai (check, upgrade, fixes, verification) (30s)
error: Requested ai@7.0.105, but . resolved 7.0.146; verification cannot use a different target.
exit=2

After (this branch): install and resolution pass, and the run goes on through rules, assist and verification. It costs $0.00 and makes 0 agent edits. Verification then fails on strut's own tests, as expected, because no assisted fix ran:

  install · ai 7.0.105 with 1 package (5.3s)
  …
✔ Migration of ai (check, upgrade, fixes, verification)  verification failed (40s)
uptide fix · ai 6.0.235 → 7.0.105 (requested) · verification failed · 40s
  Feedback  0/3 rounds · $0.00 of $0.00
exit=1

Lockfile on the produced branch, with the manifest range kept:

$ git show uptide/ai-7.0.105:yarn.lock | grep -A1 '^ai@'
ai@^7.0.105:
  version "7.0.105"
$ git show uptide/ai-7.0.105:package.json | grep '"ai"'
    "ai": "^7.0.105",

There is no resolvedVersion in that run's report.json, because target and resolved now match.

Tests

• fix/managers/resolved-version.test.ts (new), mocked installs for npm, pnpm and Yarn classic:
  • (a) the exact target gives no resolved note;
  • (b) a newer patch in the same major and range continues, with resolved: [{ name, requested: '1.1.0', version: '1.1.3' }];
  • (c) a different major stops with Requested target@1.1.0, but . resolved 2.0.0: a different major than 1.1.0;
  • outside the manifest range (~1.1.0 → 1.2.0) stops too.
  • It also has a unit test of pinClassicPatterns: the moved pattern, a shared header, and no entry at the target.
• compatible-ranges.test.ts (UPTIDE_NETWORK=1, real registry): new Yarn classic case (a). React ^19.0.0 is locked at 19.1.0, the upgrade goes to 19.2.0, the lockfile and node_modules end at 19.2.0, the range stays ^19.0.0, and a frozen install leaves the lockfile unchanged. With the pattern merge disabled, this case fails. The whole matrix passes: Tests 14 passed (14) (npm, pnpm, Berry 3/4, Yarn classic).
• PR body (report.test.ts) and terminal (format-fix.test.ts) each get a test for the new section.

Local, on the final commit:

pnpm test       uptide:test        Tests  538 passed (538)
                @uptide/core:test  Tests  2421 passed | 33 skipped (2454)
                Tasks: 4 successful, 4 total
pnpm typecheck  Tasks: 3 successful, 3 total
pnpm lint       Checked 942 files. No fixes applied. Found 2 warnings. Found 1 info.   (same 2 warnings + 1 info as main)
public:check    clean

Not verified / open

• Case (b) is not observed end to end: npm, pnpm and Yarn all resolve the exact target in the cases tested, so (b) and (c) are covered by mocked installs only. The pack-range refusal in run.ts (outside what the <pack> pack covers) has no test of its own.
• uptide.run/v1: "report.json" here means the fix result (FixResult), which has no JSON schema file; its schema is the TypeScript type. The Action's uptide.run/v1 report (schema/uptide.run.v1.json) is unchanged and has only to. Say if resolvedVersion belongs there too.
• Companions: they get the same major/range rule but no pack-range check (there is only one pack per run).
• Yarn classic resolutions: still written for transitive pins, as before; only the direct pattern is moved.

🤖 Generated with Claude Code

[tenki-reviewer]

Review complete. No issues found — approved ✅.

---

The change threads a resolvedVersion through the fix run, reverify, report DTO, and CLI summary, and rewrites Yarn classic lockfile patterns to pin resolved versions.

Files	Change
packages/core/src/fix/managers/upgrade.ts	Adds classic-pattern text surgery to pin lockfile entries to the resolved version
packages/core/src/fix/run.ts, packages/core/src/fix/reverify.ts	Substitutes the resolved version into installed moves and remaps old reports
packages/core/src/fix/report.ts, packages/core/src/fix/types.ts, packages/core/src/index.ts	Adds resolvedVersion to the report DTO and export surface
packages/cli/src/format-fix.ts	Renders the resolved-version wording in the fix summary
test files, .changeset/resolved-version-differs.md	Tests for the new behavior plus a changeset

Verification found no issues at or above the reporting threshold; a few medium/low-severity edge cases (fallback gating skipping the pack-coverage check, CRLF lockfiles defeating classic pinning) remain as informational observations.

_{Reviewed commit: 31d3971}