fix(engine): correct Cartfile.resolved regex and cover it with parity checks

[JSONbored]

Summary

• Fixes Fix engine-parity diffFilePriority typo; make drift-check recursive/function-aware #4605 (part 1, must-have): packages/gittensory-engine/src/review/diff-file-priority.ts's diffFilePriority matched cartfile\.lock — not a real Carthage filename — instead of cartfile\.resolved. The two host copies (src/review/review-diff.ts, src/review/review-grounding.ts) already matched the correct filename, so the engine package's predicted-gate collision check silently disagreed with the host for Carthage/iOS repos.
• Fixes Fix engine-parity diffFilePriority typo; make drift-check recursive/function-aware #4605 (part 2): scripts/check-engine-parity.ts's directory scan only pairs identical top-level filenames within src/{review,settings,signals}, so it can't see a duplicate that's nested one directory deeper or duplicated by function rather than by file. Generalized the existing GATE_DECISION_TWIN_PAIR escape hatch (fix(engine): require a gittensory-engine version bump on gate-decision logic changes and extend the parity scan to advisory.ts/gate-advisory.ts #4518) into a reusable NAMED_TWIN_PAIRS list and added named pairs for:
  • safe-url.ts (host copy lives under src/review/content-lane/, engine copy is flat under packages/gittensory-engine/src/review/ — different depths, so the scan never lists both under the same relative path).
  • diffFilePriority (host: review-diff.ts; engine: diff-file-priority.ts — different filenames, so no scan match exists at all). Its marker set includes the literal cartfile\.resolved regex fragment so this exact regression is caught if it ever recurs.
  • sharesMeaningfulFile (host: src/signals/engine.ts; engine: packages/gittensory-engine/src/signals/predicted-gate-engine.ts), which both gate collision-detection on diffFilePriority's threshold.
• engine-parity:drift-check now reports 21 checked pairs (17 directory-discovered + 4 named), up from 18 (17 + 1) before this PR.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (e.g. Closes #123) — a linked open issue is required for every contributor PR.

Closes #4605

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

Ran the full npm run test:ci gate locally (this touches shared parity-checking infrastructure used by CI itself, so it warranted the fuller local pass rather than just the touched-file scope) — all green, including test:engine-parity, engine-parity:drift-check, and the engine package's own npm run test --workspace @jsonbored/gittensory-engine. Added a direct regression test in packages/gittensory-engine/test/diff-file-priority.test.ts that reproduces the original bug (asserts diffFilePriority("Cartfile.resolved") and sharesMeaningfulFile's Cartfile.resolved collision case) — verified this test fails without the regex fix and passes with it. Also added a named twin-pair coverage (#4605) test block to test/unit/check-engine-parity-script.test.ts covering the new pairs, including a synthetic case proving the missing-marker detection actually fires. Neither scripts/** nor packages/gittensory-engine/src/** is in Codecov's patch coverage scope, so this PR owes no codecov/patch obligation, but both new test suites are exercised by npm run test:ci regardless.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (N/A — no auth/session surface touched.)
• API/OpenAPI/MCP behavior is updated and tested where needed. (N/A — no API/OpenAPI/MCP surface touched.)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (N/A — no UI changes.)
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. (N/A — no visible UI changes.)
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs. (N/A.)

UI Evidence

N/A — no UI/frontend/docs changes in this PR.

Notes

• Deferred per Fix engine-parity diffFilePriority typo; make drift-check recursive/function-aware #4605's explicit allowance: making discoverEngineParityPairs's listDir recursive. Named-pair coverage for the two known-missing pairs is must-have and included; full recursion is left as a follow-up so it can be verified against the whole directory tree without risking an unintended behavior change in this focused fix. Note also that recursion alone would not have discovered safe-url.ts's pairing anyway, since the host and engine copies sit at different relative depths (content-lane/safe-url.ts vs safe-url.ts) — a name-only recursive match wouldn't line them up without also relaxing the match key, which is a larger design decision better suited to its own PR.
• Out of scope, noted for visibility: src/review/review-diff.ts and src/review/review-grounding.ts both define byte-identical copies of diffFilePriority on the host side. That's an intra-host duplication, not a host/engine drift, so it's outside check-engine-parity.ts's purpose (which only tripwires host vs. published-engine-package drift) — flagging it here rather than folding an unrelated dedup into this fix.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	110895a	Commit Preview URL Branch Preview URL	Jul 10 2026, 08:42 AM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.11%. Comparing base (2234cb7) to head (110895a).
⚠️ Report is 12 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4638   +/-   ##
=======================================
  Coverage   94.11%   94.11%           
=======================================
  Files         432      432           
  Lines       38370    38370           
  Branches    13989    13989           
=======================================
  Hits        36113    36113           
  Misses       1600     1600           
  Partials      657      657           

Files with missing lines	Coverage Δ
...gittensory-engine/src/review/diff-file-priority.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.