CI: scan hosted tests assert codes, not sentences (#1089)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Refs #1089 (child 5, scan_hosted slice). covgap_commands_scan_mod.rs remains for a later slice.

What changes

• tests/covgap_commands_scan_hosted.rs (2,884 lines, 36 tests, its own test binary) moves into the scan suite binary as three modules:
  • scan/hosted_failure_paths.rs (26 tests) checks exit code, status, error.code, hosted skipped events and their errorCodes, warnings[] codes and disk state. Messages are read only for what they must name (a purl, a path, a remedy). It has 0 .contains("…") asserts of 4+ words; the old file had 20.
  • scan/hosted_render.rs (14 tests) is the human output, one check per message family (9 sentence asserts). Four of its tests are the human halves of mixed tests (takeover refusal, lock held, lock I/O, supersedes warning). They were split out so the --json file reads no stderr sentences, and each one keeps its disk-state checks.
  • scan/hosted_fixture.rs holds the shared mocks, project writers and runners. hosted_pinned is replaced by the existing common::envelope::hosted_pins.
• The ledger-save failure now asserts error.code == "lockfile_write_failed" (the code json_error_envelope emits for a failed commit_hosted_writes) instead of the phrase "nothing was changed".
• The lock_held test no longer compares the contention sentence. That wording is pinned by lock_cli.rs's unit tests (format_lock_error_matches_acquire_or_emit, human_error_is_capitalized_without_forced_period).
• Fixed a stale doc on the lock_io test: it claimed the envelope keeps a redirect payload, but the test asserts there is none.
• scripts/ci-test-durations.json folds the old target's 1.46 s into scan. Two doc pointers to the old path are updated (cli/telemetry_e2e.rs, docs/testing/bun-compatibility.md).
• No production change.

CI cost

No workflow change. A lean PR run stays at about 28 Linux jobs, ~8 min (~110 job-min) before and after. The test shards link one fewer integration-test binary (scan absorbs it), so per-shard link time drops slightly.

Test evidence

• cargo fmt --all -- --check: clean.
• cargo clippy --locked --workspace --all-features -- -D warnings (the CI command): clean. cargo clippy -p socket-patch-cli --all-features --test scan -- -D warnings reports nothing in the three new files. The remaining hits in that target (prebuilt_common, hosted_yarn_classic_sha1.rs, module-loaded-twice) are already on main.
• cargo test -p socket-patch-cli --all-features --test scan: 181 passed. The 40 hosted tests (36 moved + 4 render twins) also pass as a non-root user, so the root-skipping permission tests ran for real: ledger_save_failure_after_successful_revert_fails_closed, unreadable_bun_lockb_is_preserved_and_reports_the_io_error and unreadable_pnpm_workspace_gets_warning_only_guidance_in_a_live_run.
• python3 -m pytest scripts/tests -q: 342 passed, 6 skipped.
• The moved code includes cfg(unix) tests, so one full-scope ci.yml run was dispatched on c69692a to cover the Windows/macOS builds.

/code-review high

Findings fixed in 3998ee0 (and 279bf6a, which repoints the two get-suite doc comments that named the old file once #1553 had merged): the FIFO test again requires the "regular file" refusal, lock_held requires a non-empty message, the shrinkwrap needle is back to "no package-lock.json", the dry-run render checks pin the package count, the human twins check disk state, and hosted_pinned was deduplicated.
Not fixed, and why:

• Folding scan/hosted_symlinked_files.rs (its own mkfifo/scan_hosted copies) onto hosted_fixture would widen this PR beyond its file. It belongs in a later Tracking: assert stable codes instead of human sentences in CLI tests, and fold the covgap suites #1089 cleanup.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FFRqDFywToxBViqhDGXs6d

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit c69692a. Configure here.}