GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Refs #905 (step 3, slice 1). The issue stays open for the inline sites in files that open PRs change.

Summary

This PR moves ten production sites that each spelled out "drop one leading UTF-8 BOM" onto formats::text. It adds a guard test that fails when a new production file spells out its own BOM handling.

Why

• #905 step 3, register row E64 (living document Part 4, "CRLF/BOM/indent policy"). #909 added formats::text::{split_bom, strip_bom}, but about 50 inline strips remained, some with drifted counts (trim_start_matches strips any number of BOMs). #1057 added two more while this PR was open, which the guard caught.
• Leverage: B 0, U 0, D ≈ 10 (inline copies collapsed, plus a guard against new ones), S 0, R L. It is the top-scoring candidate that lies entirely in files no open PR changes.

What changed

• formats::text:
  • New strip_bom_bytes, for the byte decoders.
  • split_bom now returns its BOM half as &'static str. It is always "" or U+FEFF, so callers can store it.
• Re-pointed to the helpers:
  • patch/redirect/requirements.rs: 4 sites.
  • utils/requirements.rs: 2 sites.
  • manifest/operations.rs
  • hosted/npm_manifest.rs
  • gradle/dsl.rs: decode and the lexer's start offset.
  • policy/socket_yml.rs: decode.
  • formats/yarn/blocks.rs and formats/yarn/stanzas.rs (both from Move all yarn.lock parsing into formats/yarn and stop pinning non-registry copies #1057).
  • The CLI's scan/hosted/python.rs: Pipfile.lock for the stale-install remedy.
• production_bom_handling_goes_through_the_helpers guard:
  • It scans production code (test modules and test-support files are exempt).
  • PENDING_INLINE_BOMS lists the 26 files still changed by open PRs.
  • OWN_BOM_RULE lists 2 deliberate exceptions, each with a reason: sbt_version skips a BOM on any properties line, which its test pins, and the vlt sniff refuses a BOM lock because vlt can't read one.
  • The guard is one-sided: a pending file that loses its last inline BOM doesn't fail it.
• Ported from #1118: the ci.yml setup-php pin comment # v2 → # 2.37.2. The Audit GitHub Actions check (zizmor ref-version-mismatch) fails without it, and it no-ops once Label the setup-php pin in ci.yml with its real tag #1118 lands.
• Merged main (b96a785).

What was deleted

• Production: about +25 / −40, net ≈ −15. The removals are inline strip_prefix('\u{feff}')/starts_with copies and the hand-built bom selectors in the hosted requirements rewriter and the yarn stanza splitter.
• Tests: about +147: the guard, the strip_bom_bytes cases, and one-vs-two-BOM coverage for the hosted npm manifest decoder.

Behavior

None for zero or one leading BOM. The one exact change: the hosted Pipenv stale-install remedy read a Pipfile.lock with two leading BOMs as JSON, because it used trim_start_matches. It now treats the second BOM as content, as every other reader does and as #905 requires.

Test evidence

• CI on f810607: all checks green (192 passed, 8 skipped).
  • test-release first failed in api_retry_e2e::a_refused_connection_is_not_retried, a port-reuse race in that test that this PR doesn't touch. It passed on its one re-run. See the PR comments.
• cargo clippy --workspace --all-features -- -D warnings: clean, after the merge.
• cargo test -p socket-patch-core --lib: 5742 passed, 4 failed. The failures are the known root-only tests that also fail on main in this sandbox: copy_tree::relax_loop_must_not_traverse_symlinked_root, vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry, pypi_poetry::wire_write_failure_maps_error_and_leaves_lock_untouched and pypi_requirements::wire_failure_rolls_back_already_written_files.
• cargo test -p socket-patch-cli --all-features --lib: 875 passed.
• --test in_process_redirect_pipenv, policy_pypi_names, scan_requirements_lock_only, scan_vendor_requirements_unwired and e2e_socket_yml_policy: all pass.
• The guard works in CI. On the merge with main it caught formats/yarn/{blocks,stanzas}.rs, which are now migrated. Locally, removing a pending entry fails it as expected.
• Every former caller keeps its existing BOM test: the requirements lexers, gradle::dsl::bom_is_skipped, the manifest reader's BOM and double-BOM tests, the socket.yml BOM bytes test, and the yarn BOM round-trips. The new reads_past_one_bom_only covers the hosted npm decoder.

Risk

Low. The change is mechanical, apart from the double-BOM Pipfile.lock case above.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PQTx5YVAZtPf1S2S5HYdQs

Generated by Claude Code