Structure-review batch: sweep fixes, module taxonomy, npm-family dedup, coverage gaps, CI honesty

.github/workflows/ci.yml

@@ -17,9 +17,17 @@ on:
 permissions:
   contents: read
 
+# Supersede stale runs on force-push / rapid PR updates. The `main` guard is
+# load-bearing: main runs are the ONLY rust-cache writers (save-if), so they
+# must never be cancelled mid-save.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
 jobs:
   clippy:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -47,6 +55,24 @@ jobs:
 
       - name: Run clippy
         run: cargo clippy --workspace --all-features -- -D warnings
+      # Moved-module aliases (patch::vendor → vendor, patch::go_mod_edit →
+      # vendor::go_mod_edit, patch::go_redirect → patch::redirect::golang_local)
+      # exist only for external consumers of the published core crate.
+      # #[deprecated] on a `pub use` re-export emits no warnings
+      # (rust-lang/rust#30827), so the compiler cannot pressure internal code
+      # off the old paths — this grep is the guard instead.
+      - name: Reject internal uses of moved-module alias paths
+        run: |
+          if grep -rn --include='*.rs' \
+              -e 'patch::vendor' -e 'patch::go_mod_edit' \
+              -e 'patch::go_redirect' -e 'patch::bun_lock_text' \
+              -e 'utils::telemetry' -e 'utils::cleanup_blobs' \
+              -e 'utils::date' -e 'utils::fuzzy_match' \
+              -e 'gem_setup::' -e 'composer_setup::' -e 'pth_hook::' \
+              crates; then
+            echo '::error::use the canonical module paths (crate::vendor, patch::redirect::golang_local, crate::telemetry, manifest::cleanup_blobs, api::date, crawlers::fuzzy_match); the old-path aliases exist only for external consumers'
+            exit 1
+          fi
 
   # Lint the out-of-workspace packaging artifacts for the ecosystems whose setup
   # / CLI-distribution we added: the RubyGems CLI launcher gem + the Bundler
@@ -56,6 +82,7 @@ jobs:
   # ubuntu-latest runner.
   lint-ecosystems:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -67,8 +94,8 @@ jobs:
           ( cd gem/socket-patch && ruby -c lib/socket_patch/launcher.rb && ruby -c exe/socket-patch && gem build socket-patch.gemspec )
           ( cd gem/socket-patch-bundler && ruby -c plugins.rb && gem build socket-patch-bundler.gemspec )
           # The generated-plugin templates are pure Ruby — keep them parseable.
-          ruby -c crates/socket-patch-core/src/gem_setup/templates/plugins.rb.tmpl
-          ruby -c crates/socket-patch-core/src/gem_setup/templates/gemspec.tmpl
+          ruby -c crates/socket-patch-core/src/setup/gem/templates/plugins.rb.tmpl
+          ruby -c crates/socket-patch-core/src/setup/gem/templates/gemspec.tmpl
 
       - name: PHP — lint the Composer launcher + validate composer.json
         # composer.json lives at the repo root (Packagist requires the
@@ -140,6 +167,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 35
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -194,10 +222,22 @@ jobs:
           echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
 
       - name: Run tests
-        run: cargo test --workspace --all-features
+        # `--all-features` would also RUN the docker-e2e / setup-e2e suites,
+        # which soft-skip as "ok" in this job (no images are built here, and
+        # macOS/Windows have no Docker at all) — dozens of fake greens per OS
+        # that would hide a broken skip-guard behind a passing checkmark.
+        # Build them with --all-features (compile rot is real coverage), but
+        # run only the default-feature suites; the dedicated e2e-docker and
+        # setup-matrix jobs run the gated suites for real.
+        shell: bash
+        run: |
+          set -euo pipefail
+          cargo test --workspace --all-features --no-run
+          cargo test --workspace
 
   test-release:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -224,7 +264,16 @@ jobs:
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Run tests (release)
-        run: cargo test --workspace --all-features --release
+        # `ci-release` = [profile.release] minus the full-LTO link (see the
+        # profile's comment in Cargo.toml). Same opt-level/debug-assertion
+        # semantics this job exists to validate; ~23m of LTO relinking gone.
+        # Build/run split for the same reason as the `test` job: the gated
+        # docker-e2e / setup-e2e suites only soft-skip here — compile them,
+        # don't count their skips as passes.
+        run: |
+          set -euo pipefail
+          cargo test --workspace --all-features --profile ci-release --no-run
+          cargo test --workspace --profile ci-release
 
   coverage:
     # Code coverage via cargo-llvm-cov (LLVM source-based instrumentation).
@@ -233,6 +282,7 @@ jobs:
     # report-only so contributors get visibility without flaky CI when
     # coverage shifts naturally with test edits.
     runs-on: ubuntu-latest
+    timeout-minutes: 35
     permissions:
       contents: read
     steps:
@@ -328,6 +378,7 @@ jobs:
     # container ships fails to load. ubuntu-22.04's older glibc is
     # the highest base that's forward-compatible with debian:12.
     runs-on: ubuntu-22.04
+    timeout-minutes: 30
     permissions:
       contents: read
     strategy:
@@ -442,6 +493,7 @@ jobs:
     # summed line-by-line so a line covered by ANY test counts.
     needs: [coverage, coverage-docker]
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: read
     steps:
@@ -495,6 +547,7 @@ jobs:
 
   dispatch-tests:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -589,7 +642,28 @@ jobs:
           # `windows-sys`).
           - os: windows-latest
             suite: e2e_safety_pnpm
+          # Wall-bound real-package-manager redirect capstones (~150s and
+          # ~70s of network installs + bootstrap resolutions — profile-
+          # insensitive, measured identical in debug and release). They ran
+          # inside the serial `test` job on every OS; #[ignore]-gated out of
+          # it and relocated here so they still run on every PR and every
+          # OS, but in parallel off the critical path. They use the runner's
+          # default node/corepack, exactly as they did inside `test` — no
+          # setup-node step, no version change.
+          - os: ubuntu-latest
+            suite: e2e_redirect_npm_build
+          - os: macos-latest
+            suite: e2e_redirect_npm_build
+          - os: windows-latest
+            suite: e2e_redirect_npm_build
+          - os: ubuntu-latest
+            suite: e2e_redirect_rush_sim
+          - os: macos-latest
+            suite: e2e_redirect_rush_sim
+          - os: windows-latest
+            suite: e2e_redirect_rush_sim
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 25
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -684,6 +758,7 @@ jobs:
   # ----------------------------------------------------------------------
   e2e-docker:
     runs-on: ubuntu-latest
+    timeout-minutes: 35
     permissions:
       contents: read
     strategy:
@@ -754,6 +829,7 @@ jobs:
   # ----------------------------------------------------------------------
   setup-matrix:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     continue-on-error: true
     permissions:
       contents: read

.github/workflows/release.yml

@@ -639,7 +639,7 @@ jobs:
       # Phase 2 scaffolding (CLI_CONTRACT "gem" support matrix): publish the
       # `socket-patch-bundler` gem — the published form of the Bundler plugin
       # that `socket-patch setup` currently wires via an in-tree `git:`
-      # reference. This gem is NOT yet the active mechanism (gem_setup still
+      # reference. This gem is NOT yet the active mechanism (setup::gem still
       # emits the in-tree plugin), so the push is **non-blocking**
       # (`continue-on-error`). A follow-up switches the generated Gemfile
       # directive to `plugin "socket-patch-bundler"` and drops