Currency check cannot detect a generator that has stopped emitting a file #35

Activity

1. thedavidmeister

   added

   auditFinding from an audit or mutation-test scanFinding from an audit or mutation-test scan

   adversarialFound by the adversarial half of a mutation-test scanFound by the adversarial half of a mutation-test scan

   on Sep 20, 2026
2. thedavidmeister

   added a commit that references this issue on Sep 20, 2026

   audit: record the adversarial mutation-test scan of 5c165a8

   ...

   0164435
3. thedavidmeister commented on Sep 21, 2026

   

   thedavidmeister

   on Sep 21, 2026

   ContributorAuthor

   More actions

   Correction on the fix direction

   The three directions this issue originally listed all treat the gap as something
   to detect from outside the generator. That framing is wrong, and the PR written
   against it (rainlanguage/rainix#392) inherits the error: it leaves the currency
   check defective and adds a SECOND check beside it, paid for by a hand-written
   script/codegen-manifest.txt in every affected repo.

   Two problems with that shape.

   The defective check stays defective. The job of rainix-copy-artifacts is to
   answer "are the committed generated files current". It answers with
   regenerate-and-diff, which cannot see a file the generator no longer writes. A
   separate witness compensating for that leaves the currency check wrong and adds a
   thing that has to be kept in step with it.

   A hand-written manifest is the same class of bug it is trying to catch. A
   declaration maintained by hand in 15 repos goes stale. A stale manifest that
   stops naming a file the generator still writes is silently inert — which is
   exactly the dead-emitter failure, one level up.

   What the check actually lacks

   Not a manifest. It lacks the ability to tell these apart:

   • a committed generated file that was not rewritten because the generator is dead
   • a committed file under src/generated/<tag>/ that was not rewritten because it
     is a FROZEN release snapshot and is never meant to be

   That is why a blanket "delete generated files, regenerate, diff" false-reds every
   deploy repo, and it is the one fact neither the diff nor the filesystem has.

   Where that fact already lives

   In the generator. script/Build.sol calls writeSnapshot, writeAliasLib,
   writeReleasedSuitesLib and writeReleasedSuitesAggregate — it knows precisely
   which paths it owns, and LibRainDeploySnapshot already computes them. The
   frozen record is excluded there by construction, because cutRelease() is the
   only thing that writes it.

   So the generator can emit what it intended to write, and the check compares that
   against what appeared. Intended-but-absent is the dead emitter. No repo declares
   anything, nothing drifts, and the currency check becomes correct rather than
   being worked around.

   Consequences, relative to the manifest approach:

   • no script/codegen-manifest.txt in any repo, so the 15 adoption issues
     (Adoption: 15 consumer repos need script/codegen-manifest.txt before #392 merges rainix#394 and children) fall away
   • no repo goes red on merge — the rollout stops being a coordinated migration
   • one check rather than two, with nothing to keep in step

   Status

   rainlanguage/rainix#392 implements the manifest approach and is open, not merged.
   This supersedes the directions listed above; the PR should be reworked rather
   than merged as it stands.