fix(release): the ubuntu smoke never hard-fails a mismatched-platform tarball, and two stale test citations

MEASURED on the real p9a/platform CI run: npm treats every explicitly-named install argument as
REQUIRED regardless of the wrapper's own optionalDependencies, so a mismatched-platform tarball
(darwin-arm64 on an ubuntu runner) refused the WHOLE offline install with EBADPLATFORM -- not just
its own package. smoke-installed.ts now excludes a bin-only package from the npm install command
line when its os/cpu does not match the current host, answering its check as a SKIP without ever
installing or spawning it.

Also: the platform tarball ships no bin/ entry at all on a host that never built the binary (an
empty directory is never packed), so the pack test's bin/-presence assertion is now host-gated; and
two WS-13 citations in packages/conformance still quoted release-pack.test.ts's/build-packages.test.ts's
pre-rename test titles.

Author: HeavenllyDemon

packages/conformance/src/conformance.test.ts

@@ -958,12 +958,12 @@ const PHASE_7A_ROWS: ConformanceRow[] = [
     bullet: "the publish pipeline packs, scans the TARBALL's contents, and imports every publishable package's every declared exports subpath from a real installed tarball",
     status: "new",
     citations: [
-      { file: `${SCRIPTS}/release-pack.test.ts`, testName: "the publishable set is exactly R-7-1's five packages -- excludes the private runtime and the unpublished (R-7-2) platform package" },
+      { file: `${SCRIPTS}/release-pack.test.ts`, testName: "the publishable set is exactly R-7-1's five JS packages PLUS the darwin-arm64 platform package (P9a-3) -- excludes only the private runtime" },
       { file: `${SCRIPTS}/release-pack.test.ts`, testName: "catches all seven categories in one pass over one fixture" },
       { file: `${SCRIPTS}/release-pack.test.ts`, testName: "P7a fix wave (item 9): NO tarball ships a test file -- verified via `tar -tzf`, independently of the scanner" },
       { file: `${SCRIPTS}/smoke-installed.test.ts`, testName: "every publishable package's OWN exports map is fully covered -- no subpath silently skipped" },
       { file: `${SCRIPTS}/smoke-installed.test.ts`, testName: "every target imports cleanly -- this is the exact check that would have caught review r1's two Criticals" },
-      { file: `${SCRIPTS}/build-packages.test.ts`, testName: "every entry emits BOTH a .js and a .d.ts, at the path its manifest condition names" },
+      { file: `${SCRIPTS}/build-packages.test.ts`, testName: "every entry emits BOTH a .js and a .d.ts, at the path its manifest condition names (bin-only packages emit none)" },
     ],
     note: "The last citation is the fix wave's item 1 (R-7a-16 reversed): every manifest now points its `default` condition at a compiled emit, so `pack-smoke-node18` is a BLOCKING gate rather than the advisory carry it shipped as. The Node leg asserts what each package DECLARES through `engines` -- `@yanlinglabs/winter-provider-conformance` is Bun-only by construction (`Bun.serve` loopback fakes) and declares `engines.bun` alone.",
   },

scripts/release-pack.test.ts

@@ -274,9 +274,16 @@ describe("releasePack: the real, hermetic, mkdtemp-destined pack (WS-02 §9 Step
       expect([p.name, paths.filter((f) => /^package\/src\//.test(f))]).toEqual([p.name, []]);
       const source = discoverPublishablePackages().find((pkg) => pkg.name === p.name)!;
       if (isBinOnly(source)) {
-        // P9a-3: the platform package ships a native BINARY, never `dist/` -- verified via `bin/`
-        // instead, and it carries a LICENSE + README exactly like every other publishable package.
-        expect([p.name, paths.some((f) => f.startsWith("package/bin/"))]).toEqual([p.name, true]);
+        // P9a-3/P9a-5 MEASURED: the platform package ships a native BINARY, never `dist/` -- but
+        // ONLY on a host that could have built it (darwin/arm64). On any other host (this repo's
+        // own ubuntu `pack-smoke` jobs, and `bun test`'s run inside ci.yml's `build` job) the binary
+        // is genuinely absent on disk, `assertDeclaredBinsExistOnMatchingHost` correctly does not
+        // demand it there, and `pnpm pack` produces a tarball with NO `bin/` entry at all -- an empty
+        // directory is never packed. Asserting presence unconditionally here is exactly the bug that
+        // failed this test for real on ubuntu the first time this ran.
+        const manifest = JSON.parse(readFileSync(source.packageJsonPath, "utf8")) as { os?: string[]; cpu?: string[] };
+        const hostMatches = (manifest.os === undefined || manifest.os.includes(process.platform)) && (manifest.cpu === undefined || manifest.cpu.includes(process.arch));
+        expect([p.name, hostMatches, paths.some((f) => f.startsWith("package/bin/"))]).toEqual([p.name, hostMatches, hostMatches]);
       } else {
         // ...and `dist/` really is there, so "no src" is not "nothing at all".
         expect([p.name, paths.some((f) => f.startsWith("package/dist/"))]).toEqual([p.name, true]);

scripts/smoke-installed.test.ts

@@ -10,8 +10,8 @@ import { describe, test, expect, beforeAll, afterAll } from "bun:test";
 import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { discoverPublishablePackages } from "./release-pack.ts";
-import { assertInstalledTreeIsDistOnly, deriveImportTargets, runBinTarget, runSmoke, runtimesFor, type BinTarget, type SmokeResult } from "./smoke-installed.ts";
+import { discoverPublishablePackages, type PackedPackage } from "./release-pack.ts";
+import { assertInstalledTreeIsDistOnly, deriveImportTargets, installableOnThisHost, runBinTarget, runSmoke, runtimesFor, type BinTarget, type SmokeResult } from "./smoke-installed.ts";
 
 // --- P7a fix wave (item 11, N-3): the pack+install legs are OPT-IN outside CI --------------------
 //
@@ -158,6 +158,39 @@ describe("runBinTarget (P9a-5)", () => {
   });
 });
 
+// P9a-5 MEASURED: the real bug this exists for. `npm install <tarball-a> <tarball-b>` refuses the
+// WHOLE command with EBADPLATFORM the instant ONE explicitly-named tarball's os/cpu mismatches --
+// reproduced for real on ubuntu's `pack-smoke`/`pack-smoke-node18` jobs before this filter existed.
+describe("installableOnThisHost (P9a-5)", () => {
+  const fake = (name: string): PackedPackage => ({ name, version: "0.0.4", tarballPath: `/tmp/${name}.tgz`, file: `${name}.tgz`, sha256: "x".repeat(64), size: 1 });
+
+  test("a bin-only package whose os/cpu MATCHES the given host is included", () => {
+    const packages = [fake("@t/js-pkg"), fake("@t/bin-pkg")];
+    const targets: BinTarget[] = [{ kind: "bin", package: "@t/bin-pkg", version: "0.0.4", bin: "/x/bin", os: ["darwin"], cpu: ["arm64"] }];
+    const result = installableOnThisHost(packages, targets, "darwin", "arm64");
+    expect(result.map((p) => p.name)).toEqual(["@t/js-pkg", "@t/bin-pkg"]);
+  });
+
+  test("a bin-only package whose os/cpu MISMATCHES the given host is EXCLUDED -- the JS packages are not", () => {
+    const packages = [fake("@t/js-pkg"), fake("@t/bin-pkg")];
+    const targets: BinTarget[] = [{ kind: "bin", package: "@t/bin-pkg", version: "0.0.4", bin: "/x/bin", os: ["darwin"], cpu: ["arm64"] }];
+    const result = installableOnThisHost(packages, targets, "linux", "x64");
+    expect(result.map((p) => p.name)).toEqual(["@t/js-pkg"]);
+  });
+
+  test("an os-only or cpu-only mismatch is excluded too -- both fields must agree, not just one", () => {
+    const packages = [fake("@t/bin-pkg")];
+    const targets: BinTarget[] = [{ kind: "bin", package: "@t/bin-pkg", version: "0.0.4", bin: "/x/bin", os: ["darwin"], cpu: ["arm64"] }];
+    expect(installableOnThisHost(packages, targets, "darwin", "x64")).toEqual([]); // cpu mismatch alone
+    expect(installableOnThisHost(packages, targets, "linux", "arm64")).toEqual([]); // os mismatch alone
+  });
+
+  test("a package with no bin target at all (every JS package) is never excluded, regardless of host", () => {
+    const packages = [fake("@t/js-pkg")];
+    expect(installableOnThisHost(packages, [], "linux", "x64")).toEqual(packages);
+  });
+});
+
 describe.skipIf(!PACK_SMOKE_ENABLED)("runSmoke: the real pack -> install -> import cycle, under Bun (BLOCKING in ci.yml/release.yml)", () => {
   let result: SmokeResult;
   beforeAll(async () => {

scripts/smoke-installed.ts

@@ -26,7 +26,7 @@
 import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { discoverPublishablePackages, releasePack, type PublishablePackage } from "./release-pack.ts";
+import { discoverPublishablePackages, releasePack, type PackedPackage, type PublishablePackage } from "./release-pack.ts";
 
 export type SmokeRuntime = "node" | "bun";
 
@@ -176,16 +176,50 @@ async function importUnder(runtime: SmokeRuntime, specifier: string, probeDir: s
   return { ok: exitCode === 0, output: (stdout + stderr).trim() };
 }
 
+/**
+ * Does `target`'s declared `os`/`cpu` match a host? Defaults to the CURRENT host; `platform`/`arch`
+ * are injectable so `installableOnThisHost`'s own test can plant a mismatch without touching
+ * `process.platform`/`process.arch` (which bun/node do not allow reassigning on some builds anyway).
+ */
+export function hostMatchesBinTarget(target: BinTarget, platform: string = process.platform, arch: string = process.arch): boolean {
+  return (target.os === undefined || target.os.includes(platform)) && (target.cpu === undefined || target.cpu.includes(arch));
+}
+
+/**
+ * P9a-5 MEASURED (not assumed): which packed packages can be handed to `npm install` DIRECTLY, on
+ * `platform`/`arch` (defaults to the current host).
+ *
+ * `bun install`'s own tolerance for a mismatched OPTIONAL dependency (M1: the package directory is
+ * still created, `bin/` is empty) does NOT extend to plain `npm install <tarball-path>` -- npm
+ * treats every EXPLICITLY-named command-line argument as a REQUIRED install target regardless of
+ * what the wrapper's own `optionalDependencies` say about it, and refuses the WHOLE install with
+ * `EBADPLATFORM` the instant one argument's `os`/`cpu` mismatches (measured on the real ubuntu
+ * `pack-smoke`/`pack-smoke-node18` jobs the first time this ran: one mismatched tarball killed the
+ * entire offline install, every OTHER package included, not just the platform one). So a mismatched
+ * bin-only package is excluded from the install command line entirely -- its own check is answered
+ * as a SKIP without ever attempting to install or spawn it, never a failed install of everything.
+ */
+export function installableOnThisHost(
+  packages: readonly PackedPackage[],
+  targets: readonly SmokeTarget[],
+  platform: string = process.platform,
+  arch: string = process.arch,
+): PackedPackage[] {
+  const binTargetsByPackage = new Map(targets.filter((t): t is BinTarget => t.kind === "bin").map((t) => [t.package, t]));
+  return packages.filter((p) => {
+    const binTarget = binTargetsByPackage.get(p.name);
+    return binTarget === undefined || hostMatchesBinTarget(binTarget, platform, arch);
+  });
+}
+
 /**
  * P9a-5: executes `<bin> --version` when the target's declared `os`/`cpu` matches the CURRENT host,
  * and asserts the printed line equals the package's own `version` exactly. On a mismatching host the
  * file cannot exist by construction (P9a-4), so this SKIPS with the exact printed reason rather than
  * attempting a spawn that could only ever fail with ENOENT for the wrong reason.
  */
 export async function runBinTarget(target: BinTarget, binPath: string = target.bin): Promise<{ ok: boolean; output: string; skipped: boolean }> {
-  const osOk = target.os === undefined || target.os.includes(process.platform);
-  const cpuOk = target.cpu === undefined || target.cpu.includes(process.arch);
-  if (!osOk || !cpuOk) {
+  if (!hostMatchesBinTarget(target)) {
     const line = `smoke-installed: SKIP ${target.package} (bin-only; os/cpu mismatch on ${process.platform}/${process.arch})`;
     console.log(line);
     return { ok: true, output: line, skipped: true };
@@ -251,11 +285,13 @@ export async function runSmoke(opts: { runtimes?: readonly SmokeRuntime[] } = {}
     }
     const targets = deriveImportTargets();
 
+    const installable = installableOnThisHost(packed.packages, targets);
+
     // Outside the monorepo on purpose: a fresh mkdtemp, no pnpm-workspace.yaml, no lockfile, no
     // committed .npmrc in scope -- the only thing that could make this succeed is the packed
     // tarballs themselves resolving each other correctly.
     writeFileSync(join(probeDir, "package.json"), JSON.stringify({ name: "winter-smoke-probe", private: true, version: "0.0.0" }, null, 2) + "\n");
-    const install = Bun.spawnSync(["npm", "install", "--offline", ...packed.packages.map((p) => p.tarballPath)], { cwd: probeDir, stdout: "pipe", stderr: "pipe" });
+    const install = Bun.spawnSync(["npm", "install", "--offline", ...installable.map((p) => p.tarballPath)], { cwd: probeDir, stdout: "pipe", stderr: "pipe" });
     if (install.exitCode !== 0) {
       throw new Error(`npm install --offline failed (exit ${install.exitCode}):\n${decode(install.stdout)}${decode(install.stderr)}`);
     }
@@ -266,7 +302,7 @@ export async function runSmoke(opts: { runtimes?: readonly SmokeRuntime[] } = {}
     // condition surviving here would send Bun to a `src/` path that is not on disk, which is the one
     // failure the source-condition design makes possible and the one no import test would attribute
     // correctly (it looks like a missing module, not a manifest that lies).
-    const distOnly = assertInstalledTreeIsDistOnly(probeDir, packed.packages.map((p) => p.name));
+    const distOnly = assertInstalledTreeIsDistOnly(probeDir, installable.map((p) => p.name));
     if (distOnly.length > 0) throw new Error(`the installed tree is not dist-only:\n${distOnly.join("\n")}`);
 
     // P9a-5: bin targets run ONCE per `runSmoke()` call, independent of which `runtimes` were
@@ -276,6 +312,14 @@ export async function runSmoke(opts: { runtimes?: readonly SmokeRuntime[] } = {}
     // a non-matching host, and a real execution on a matching one (the new macOS job).
     for (const target of targets) {
       if (target.kind !== "bin") continue;
+      if (!hostMatchesBinTarget(target)) {
+        // Never installed above -- resolving its path or spawning it would fail for the WRONG
+        // reason (a missing node_modules entry, not a deliberate platform mismatch).
+        const line = `smoke-installed: SKIP ${target.package} (bin-only; os/cpu mismatch on ${process.platform}/${process.arch})`;
+        console.log(line);
+        results.push({ kind: "bin", package: target.package, ok: true, output: line, skipped: true });
+        continue;
+      }
       const binPath = resolveBinTargetPath(target, probeDir);
       const result = await runBinTarget(target, binPath);
       results.push({ kind: "bin", package: target.package, ok: result.ok, output: result.output, skipped: result.skipped });