test(cli): cover PlatformBinaryResolution.source and asMatchMode's refusal

[thecodedrift]

Stack (root → tip):

• ➡️ test(cli): cover PlatformBinaryResolution.source and asMatchMode's refusal #304 (you are here)
  • test(cli): fingerprint the reference shape, cover the wizard's reload banner #305
    • test(cli): cover restore.ts HTTP branches and the repair-path purge notice #306
      • test(cli): cover the tested/failed/refused split on a mixed verify/test run #307

What

Two coverage gaps from #284:

1. PlatformBinaryResolution.source (packages/cli/src/rules/platform-binary.ts) was documented as load-bearing — only "platform-package" entitles a caller to treat the binary as pinned — but no test in platform-binary.test.ts ever read .source. Added .source assertions to the two existing PATH-tier tests, plus a new test for the node_modules/.bin tier. (platform-package and undefined were already covered separately in engine-version-consistency.test.ts, confirmed by grep before adding anything.)
2. asMatchMode (packages/cli/src/rules/runtime/discover.ts) refuses an unimplemented match: value rather than coercing it to anchor — its central claim, per its own doc comment. engine-dispatch.test.ts's REFUSALS table exercised every other refusal reason but had no case for this one. Added it.

No production code changed.

Mutation-check table

Test	Mutation applied	Result
platform-binary.test.ts — "tries the alternative name before the canonical one on PATH" (source assertion)	resolvePlatformBinary always returns source: "platform-package"	FAILED before revert (expected 'platform-package' to be 'PATH'); PASSED after revert
platform-binary.test.ts — "still resolves the canonical name when it is the only one" (source assertion)	same mutation	FAILED before revert; PASSED after revert
platform-binary.test.ts — "reports node_modules/.bin as the source when that tier answers" (new test)	same mutation	FAILED before revert; PASSED after revert
engine-dispatch.test.ts — new REFUSALS case "unimplemented match mode"	asMatchMode coerces an unrecognized string to "anchor" instead of returning undefined	FAILED before revert (capture no longer refused, verify reported ok: true); PASSED after revert

Each mutation was applied to source, confirmed the corresponding test (and, in the asMatchMode case, several pre-existing tests) failed, then reverted and confirmed green.

Verification

• NODE_OPTIONS= pnpm test — 82 files / 1327 tests passing (baseline for these two files was 54 tests; now 56)
• NODE_OPTIONS= pnpm typecheck — clean
• NODE_OPTIONS= pnpm lint — clean (eslint + built-CLI house-style check)

Notes on the issue text

The issue said "no assertions" read .source in platform-binary.test.ts, which is true, but engine-version-consistency.test.ts already covers the "platform-package" and undefined cases directly against resolvePlatformBinary. The genuinely uncovered values were "node_modules/.bin" and "PATH", both closed in this PR.

No defects found in production code; nothing here changes behavior.

Refs #284

[thecodedrift]

@claude /review

[claude]

Claude finished @thecodedrift's task in 4m 25s —— View job

---

Review complete

Review mode: incremental — read 0 prior review thread(s) before reviewing. .prior-review.json contains no reviewThreads, reviews, or top-level comments beyond the triggering @claude /review itself, so this is the first review of this PR; nothing was treated as already addressed.

• Read .prior-review.json
• Fetch PR diff and metadata (gh pr diff 304)
• Read changed test files in full (platform-binary.test.ts, engine-dispatch.test.ts)
• Read production code under test (platform-binary.ts, runtime/discover.ts)
• Assess correctness, coverage adequacy, clarity
• Post inline findings + final summary

Assessment: sound, no defects found. This is a test-only PR (no production code touched), and it does what it claims.

Verified against source:

• platform-binary.ts: PlatformBinaryResolution.source is a genuine closed-set discriminator ("platform-package" | "node_modules/.bin" | "PATH" | undefined) returned per-tier from resolvePlatformBinary's candidates array (lines 225-244). The new .source assertions on the two PATH-tier tests, plus the new node_modules/.bin test, each pin a value that only that tier can produce, and the new test correctly isolates the tier by zeroing PATH and computing localBin the same way resolvePlatformBinary computes it internally (relative to the module's own import.meta.url) — under vitest both resolve to packages/cli/src/node_modules/.bin, so it's exercising the real tier, not a stand-in. Cleanup via workspaces.push(...) + afterEach's rmSync is registered before the try block, so it runs even if an assertion throws.
• runtime/discover.ts: asMatchMode (lines 140-146) returns undefined for any string not in MATCH_MODES, and assessCaptureRule (lines 213-221) turns that into the exact message the new REFUSALS regex expects: declares match: "whole-repo", which this build does not implement (valid: anchor, broad). The new case correctly exercises asMatchMode's refusal path through the shared REFUSALS harness, which is the one case that table was missing.
• The PR's mutation-check table matches what the code actually requires (confirmed by reading the assertions against the implementation directly, not just trusting the table).

Two minor, non-blocking nits posted as inline comments (both [New], neither a defect):

1. platform-binary.test.ts — the new test's fake-binary setup duplicates plantOnPath's "write an executable script" logic instead of sharing a small helper.
2. engine-dispatch.test.ts — the new REFUSALS case overlaps in coverage with two existing tests just above it in the same file (not wrong, just close by).

No correctness, security, or test-adequacy issues found. Nothing here needs to change before merge as far as this review is concerned.

[thecodedrift]

All four checks pass and the two inline notes are answered. The REFUSALS overlap is deliberate and the thread explains why; the plantExecutable extraction is with the author as a low-priority call.

Thanks specifically for tracing the node_modules/.bin path math against resolvePlatformBinary's own import.meta.url rather than trusting the fixture. That tier is the one where a fixture can silently stand in for the thing instead of exercising it.

— AI Coding Agent