test(spec): harden the build-schemas check-mode fixture repos against the merge-queue lifetime race

[os-zhuang]

Fixes#9068

Test-harness hardening only. No *.zod.ts, no strictness-ledger file, no behaviour
change to build-schemas.ts, and all 60 assertions in the file are preserved verbatim —
what changes is how the fixture repositories are built and insulated, never what is
asserted.

What the harness actually looked like (measured, not assumed)

Three of the card's premises were checked against origin/main before anything was edited:

• Tmpdir collision between concurrent test files — falsified. All four fixture repos in
  this file already use fs.mkdtempSync (build-schemas-check-, and three box prefixes),
  packages/spec has exactly one vitest project, and vitest isolates test files into
  separate processes. No concurrently running file can name one of these directories.
• "The git helper shells out per fixture" — confirmed, and that was the hole. It passed
  cwd and two -c user.* args and inherited everything else: the ambient global and
  system git config, init.templateDir, and every GIT_* environment variable. So did the
  generator runs, and build-schemas.ts shells out to git itself (merge-base, cat-file,
  a --depth=1 fetch).
• Serializing the three git-topology blocks (the card's fallback ③) is a no-op. They are
  already serial: vitest runs one test at a time within a file. Not implemented, and the
  reason is recorded in the file.

The mechanism, reproduced

Three describe blocks (#5370, #5847, #6452 — exactly the three that failed) deliberately
write .git/shallow into the shared sandbox, because that is the environment they
model: CI checks out --depth=1. Inside that window every commit behind the graft point is
unreachable by definition, so a git gc arriving there prunes the fixture's own history
and leaves the refs pointing at objects that are gone. On a five-commit fixture in exactly
that state:

$ git gc --quiet # ambient [gc] pruneExpire/reflogExpire = now
$ git merge-base HEAD 538d7ec0… # a commit made moments earlier
fatal: Not a valid commit name 538d7ec0ac80c958841f3606d567dee02bdbc1b1

That is the reported signature. The control — same commits, same gc, no.git/shallow
— keeps every object.

The fix

Two layers, because they fail differently:

1. HERMETIC_ENV on every git this file runs and on the generator spawns, so ambient
   config and leaked GIT_* pointers (GIT_DIR, GIT_INDEX_FILE, GIT_OBJECT_DIRECTORY,
   GIT_ALTERNATE_OBJECT_DIRECTORIES, …) cannot reach a fixture or its children.
2. initFixtureRepo writes gc.auto=0, gc.autoDetach=false, maintenance.auto=false,
   gc.pruneExpire=never, gc.reflogExpire*=never, core.logAllRefUpdates=true into each
   repo's own config. This is the layer that survives a gc this file never launched:
   local config outranks global. Measured A/B — identical outside git gc with a hostile
   global config, in the shallow window: unhardened repo loses the commit, hardened repo
   keeps it.

Plus the card's preferred ①, applied where it is load-bearing: the three git-topology blocks
each take their own fixture repo (createSandbox / mountSandbox / releaseSandbox).
They fork branches, reset them every beforeEach, leave merges uncommitted and truncate
history; sharing one repo is why a single lost object read as ten failures spread over three
blocks, with the block that caused it invisible. A scripts/ copy is 1.8 MB and the
generation cost is per run, not per sandbox.

Finally, a fixture git failure now names the repo and its state (HEAD, main,
origin/main, shallow, and whether main's object still exists) instead of a bare sha —
the whole first triage lap on this card went into establishing that the sha belonged to no
tree of this repository.

Verification — every run below at c0740f996, the head of this branch

Stability, since a hardening PR should demonstrate it rather than assert it:

run	scope	result	duration
1	whole file	60 passed (60)	278.7 s
2	whole file	60 passed (60)	274.7 s
3a / 3b	the three git-topology blocks, two instances concurrently	13 passed each	60.3 s / 60.6 s

Run 3 is the parallel-pressure reading: two processes driving the same fixture-building code
at the same moment, which is the shape the merge queue applies.

Reverse verification, direction predicted (red) before it was run. Same subset
(-t 'a shallow checkout re-anchors', 5 tests), same hostile environment — GIT_DIR aimed at
a decoy repository plus a global config carrying gc.pruneExpire/reflogExpire = now:

• origin/main's harness → 5 failed / 5
• this branch's harness → 5 passed / 5

Gates. Re-derived from the actual changed path with node scripts/pm/dispatch-gates.mjs;
it named exactly the dispatched set, nothing beyond. Green here: check:merge-driver,
check:type-source-resolution, check:query-options-erasure, check:type-check-coverage,
check:engine-double-contract, check:where-matcher, check:nul-bytes, and
check:scripts-typecheck (the zero-error-budget program this file belongs to).

Two are not measured locally, deliberately: check:type-check-debt and
check-dev-prereqs.mjs both refuse on a worktree with no built closure — the ratchet says so
itself ("measuring now would not fail, it would silently measure a DIFFERENT WORLD"). Their
population is src/**/*.test.ts and workspace dist/, neither of which this diff touches, so
a full 55-package build here buys no information the CI job will not produce. CI is the
authority on both.

skip-changeset: tests-only, nothing published.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

No hand-written docs reference the 0 changed package(s). ✅