tools/sync-vendor.mjs: patched: true is documentation only; nothing checks that a patch is still applied #176

Severity: low

Where: tools/sync-vendor.mjs (the warning comment and the entries), pnpm-workspace.yaml (patchedDependencies), tests/unit/checkPatchedUpdates.test.mjs (cross-checks dependabot.yml against pnpm-workspace.yaml only)

What happens

The comment says "Any entry marked true must have a corresponding patchedDependencies line in pnpm-workspace.yaml, or the copied file silently loses FastStream's changes", and nothing enforces it. A patchedDependencies line removed by a bad merge, or a revert of a library bump after recut-patch's "every change landed" path, leaves patched: true entries copying the stock library; the build is green and playback breaks the way the comment describes. The e2e suites would likely catch hls.js/dash.js, but not gif.js/Coloris/sweetalert2.

Suggested fix

In sync-vendor.mjs, read patchedDependencies(yaml) (already exported by check-patched-updates.mjs) and fail when a patched: true library has no entry, and when an entry's version differs from node_modules/<lib>/package.json.

Confidence: high.

From a line-by-line code review of the tree at 41363fd (2026-10-02). Each claim above was checked against the source before filing; the reproduction steps and line references are as of that commit.

Generated by Claude Code