Why
Debugging a vendored-mode install of an old strapi monorepo (yarn v1 lockfile) surfaced a class of yarn-1 flows our existing capstone doesn't cover. The install failures themselves turned out to be a yarn 2.4.3 bug on Node ≥23 (util.isDate removed; berry's builtin patch: compat fetcher for fsevents/resolve crashes — unrelated to our wiring), but the incident showed yarn 1 is the right installer for classic-lockfile projects — and we only e2e-proved the --frozen-lockfile --offline fresh-checkout path (e2e_vendor_yarn_classic_build.rs).
Manually verified during the incident, now pinned as e2e: yarn 1.22.22 consumes vendored file: wiring correctly in the everyday developer flows, where a regression would silently drop patches.
What the new capstone proves (e2e_vendor_yarn_classic_dev_flow.rs)
- Plain
yarn install (no --frozen-lockfile, no --offline) on a fresh checkout delivers the patched bytes and keeps the vendored block intact.
yarn add re-serialization round-trip: yarn add rewrites the entire lockfile from yarn's in-memory model (asserted via Saved lockfile. so the check can't go vacuous). The vendored resolved "file:./.socket/vendor/…#sha1" + recomputed integrity block must survive byte-intact.- Unpatched-neighbor coexistence:
[email protected] (the package at the center of the strapi incident — berry builtin-patches it) rides along unvendored; its lock block stays byte-identical through vendor + installs and it installs pristine registry bytes.
- No
patch: protocol leakage: the wired/re-saved lockfile never contains a patch: resolution, so a berry migration of a classic lockfile can never inherit one from us.
- Frozen re-entry:
--frozen-lockfile passes on the re-saved lockfile — dev installs don't wedge CI installs downstream.
- Lockfile fixpoint: repeated plain installs leave
yarn.lock byte-identical.
Conventions
Same harness shape as the existing capstone: self-contained helpers, corepack [email protected] pinned, SOCKET_* env scrubbed, private YARN_CACHE_FOLDER per phase, local-only skip gates (corepack/registry unavailable → println + return), hard assertions after the gate.
Test run
VENDOR OK
DEV INSTALL OK
YARN ADD RE-SERIALIZATION OK
FIXPOINT OK
FROZEN RE-ENTRY OK
test yarn_classic_vendored_lock_survives_dev_install_resave ... ok
🤖 Generated with Claude Code