fix(windows): slash-form logical paths and unix-scoped ownership tests - #548

… proves it

The Windows legs of this PR failed every knowledge-indexer test. The cause is
older than the PR, and this is its fourth appearance in seventeen days -- #395,
#548, #600, and now.

The provider speaks two path dialects. file.join, file.glob, file.resolve and
file.walk_tree build paths FOR USE, so they return OS-native strings. file.name
and file.parent answer questions ABOUT a path, so they are slash-form. On Windows
that means Name is handed a backslash path, slashpath.Base finds no separator in
it, and the whole path comes back as the "last element":

    file.name(file.join("knowledge", "packages", "slots"))
      darwin   -> "slots"
      windows  -> "knowledge\packages\slots"

The knowledge indexer therefore saw every asset directory on Windows as an
unrecognized type. The previous indexer made the same call and had the same bug;
it simply never ran there, because devlore-registry's workflow is ubuntu-only.

Name and Parent now convert with filepath.ToSlash before Base and Dir: native
input, slash-form output, which is what their documentation already claimed.
ToSlash rather than a blind ReplaceAll, and the distinction matters -- a
backslash is a legal character in a Unix filename, so it must not be read as a
separator off Windows.

WHY THIS KEEPS HAPPENING, and what stops it

Every existing assertion writes its input in the dialect of the function under
test. test_imm_file.star checks file.name against the literal "/some/dir/file.txt";
provider_test.go checks it against "/a/b/c.txt". Those are already slash-form, so
they behave identically on every platform and the mismatch between the dialects is
never exercised. Running the matrix on Windows buys nothing when the inputs cannot
vary by platform.

test_imm_file.star declines multi-part join explicitly: "it builds a path FOR USE,
so its result is OS-native and a fixture cannot assert it without encoding a
platform". True of join's RESULT -- but not of the composition. A fixture can
assert that taking the last element of a joined path returns the last element,
which names no separator and no platform, holds everywhere, and is false on
Windows whenever the seam is broken.

test_imm_file_path_seam.star does exactly that, over file.name(file.join(...)),
file.parent(file.join(...)), and file.name(<glob match>) -- the last being the
composition the indexer performs on every directory entry.

PROVEN ON THE HARDWARE, NOT ARGUED

Built for windows/arm64 and run on danoble-wd11-3. Without the fix:

    FAIL: equal("knowledge\packages\slots", "slots")
    FAIL: equal("a\b", "b")
    FAIL: equal(".", "knowledge/packages")
    FAIL: equal(["C:\...\seam_dir\slots"], ["slots"])

With it: PASS. The parent case is a second breakage nobody had noticed, for the
same reason -- nothing composed those two either.

scripts/Invoke-WindowsDevloreTest.sh is that loop, packaged: cross-compile here
(the box carries Go 1.26.7 against a go.mod needing 1.27), ship the binary and
data/, run over SSH. About a minute, against real Windows, instead of a fortnight
of waiting for a CI leg to notice.

One change was needed to make the binary portable: testdataDir resolved the
fixture directory through runtime.Caller, which bakes in the BUILD host's source
path. DEVLORE_TESTDATA overrides it.

* fix(star): the knowledge indexer preserves what it did not write

star devlore knowledge index rebuilt each domain's index.yaml from a directory
listing and wrote {name: filename} per entry, discarding everything else. That
was invisible while devlore-registry's update-indexes workflow was failing. Its
first successful run after the unfreeze deleted the concepts section from two
domains, providers from a third, and every slot's package/description/platforms/
install_types -- an entire ollama slot with them.

It now UPDATES. Each existing entry is kept whole when its file is present; a new
file gets {name}. Entry metadata is hand-written, and tracking which files exist
is the only job this command has.

The rule the rest follows from: anything the indexer cannot classify is an ERROR,
not an omission. Its silence used to be indistinguishable from success -- the
output still parsed, so validate-yaml-schemas stayed green while content was
deleted. Five refusals now:

  - a directory that is not a known asset type
  - a file loose in a domain root, under no asset type
  - a section naming an unknown type
  - a section whose directory is gone
  - an indexed entry whose file is absent

The last is not pedantry. signatures/dotfile-systems.yaml is indexed while the
file sits at the domain root: it moved rather than vanished, and an indexer that
merely drops entries without files would have deleted it silently.

ASSET_TYPES grows from six to nine. concepts (migration, packages) and providers
(shared) are sections in use that the indexer did not recognize; bindings
(package-authoring) is a directory with three files that appears in no index at
all. cmd/devlore-index, the uninvoked Go tool that looked like the fix, carries
the same six in its struct and would have destroyed concepts and providers too.

Two things surfaced while building this, both the same shape as the bug:

yaml.parse returns a yaml.Resource whose only attributes are equal, resource_base
and validate -- the document's data is unreachable through it. The first version
of load_existing used it, silently received nothing, and looked like it worked
while treating every index as empty. yaml.decode returns a dict.

The audit's findings went to note() on stdout but never into the error, so a
caller seeing the failure without stdout was told something was wrong but not
what. They are in the error now.

Nine integration tests cover both halves: metadata survives, a new file is added
without disturbing its neighbours, a second run is byte-identical, and each of
the five refusals fires for its own reason. The refusal tests assert the reason
rather than merely that an error occurred -- asserting only err != nil passed on
an unrelated failure, which is the same indistinguishable-from-success problem
these tests exist to prevent.

Also: the package indexer stamped its output "generated: star devlore knowledge
index packages". It is the package indexer. Fixed.

Phase 2 of docs/plans/knowledge-index-preserves-metadata.md. The registry side --
the schema, resolving the five real problems, and re-enabling the workflow -- is
phase 3 and lands separately.

* fix(file): name and parent accept OS-native paths, and a fixture that proves it

The Windows legs of this PR failed every knowledge-indexer test. The cause is
older than the PR, and this is its fourth appearance in seventeen days -- #395,
#548, #600, and now.

The provider speaks two path dialects. file.join, file.glob, file.resolve and
file.walk_tree build paths FOR USE, so they return OS-native strings. file.name
and file.parent answer questions ABOUT a path, so they are slash-form. On Windows
that means Name is handed a backslash path, slashpath.Base finds no separator in
it, and the whole path comes back as the "last element":

    file.name(file.join("knowledge", "packages", "slots"))
      darwin   -> "slots"
      windows  -> "knowledge\packages\slots"

The knowledge indexer therefore saw every asset directory on Windows as an
unrecognized type. The previous indexer made the same call and had the same bug;
it simply never ran there, because devlore-registry's workflow is ubuntu-only.

Name and Parent now convert with filepath.ToSlash before Base and Dir: native
input, slash-form output, which is what their documentation already claimed.
ToSlash rather than a blind ReplaceAll, and the distinction matters -- a
backslash is a legal character in a Unix filename, so it must not be read as a
separator off Windows.

WHY THIS KEEPS HAPPENING, and what stops it

Every existing assertion writes its input in the dialect of the function under
test. test_imm_file.star checks file.name against the literal "/some/dir/file.txt";
provider_test.go checks it against "/a/b/c.txt". Those are already slash-form, so
they behave identically on every platform and the mismatch between the dialects is
never exercised. Running the matrix on Windows buys nothing when the inputs cannot
vary by platform.

test_imm_file.star declines multi-part join explicitly: "it builds a path FOR USE,
so its result is OS-native and a fixture cannot assert it without encoding a
platform". True of join's RESULT -- but not of the composition. A fixture can
assert that taking the last element of a joined path returns the last element,
which names no separator and no platform, holds everywhere, and is false on
Windows whenever the seam is broken.

test_imm_file_path_seam.star does exactly that, over file.name(file.join(...)),
file.parent(file.join(...)), and file.name(<glob match>) -- the last being the
composition the indexer performs on every directory entry.

PROVEN ON THE HARDWARE, NOT ARGUED

Built for windows/arm64 and run on danoble-wd11-3. Without the fix:

    FAIL: equal("knowledge\packages\slots", "slots")
    FAIL: equal("a\b", "b")
    FAIL: equal(".", "knowledge/packages")
    FAIL: equal(["C:\...\seam_dir\slots"], ["slots"])

With it: PASS. The parent case is a second breakage nobody had noticed, for the
same reason -- nothing composed those two either.

scripts/Invoke-WindowsDevloreTest.sh is that loop, packaged: cross-compile here
(the box carries Go 1.26.7 against a go.mod needing 1.27), ship the binary and
data/, run over SSH. About a minute, against real Windows, instead of a fortnight
of waiting for a CI leg to notice.

One change was needed to make the binary portable: testdataDir resolved the
fixture directory through runtime.Caller, which bakes in the BUILD host's source
path. DEVLORE_TESTDATA overrides it.

* test(file): state the parent assertion plainly, and drive Windows through bash

Three small corrections to the seam work.

The `and` in the file.parent case was a no-op. The expression evaluated to the
string literal whatever the left side returned, so it read as though it compared
two producer outputs while comparing nothing. Split into two direct assertions,
which also adds a second parent case. Both fail on unfixed Windows with got "."
-- slash-form Dir finds no separator in a backslash path and reports the current
directory -- for seven failures without the fix and PASS with it, verified on
danoble-wd11-3.

Invoke-WindowsDevloreTest.sh is formatted to shfmt -i 4 -ci, which is what
lint.shell runs. That was quality-gate's only complaint on the previous push;
every test leg passed, both Windows legs included.

The runner now drives the far side through Git Bash rather than PowerShell.
sshd's DefaultShell on that host is pwsh, so a bare ssh command lands there --
but ci.yaml sets `shell: bash` for the test job, and a local loop that uses a
different shell from CI reproduces the platform without reproducing the
environment. The defect this exists to catch is in Go path handling, where the
shell is irrelevant; anything quoting- or PATH-sensitive would have diverged, and
a green here would not have meant a green there.

It also drops two pwsh irritations: it splits `-test.run` at the dot unless every
argument is quoted, and it prints profile-not-found noise on each invocation.

---------

Co-authored-by: David Noble <[email protected]>