GeezerVison

STACKED on PR #175 (fix/gem-bundler-audit) — base branch is fix/gem-bundler-audit at 10c0079, not main.

Two verified findings in apply/rollback variant handling, each RED-pinned against the base commit.

P1 — the variant gate blocked the documented mismatch policy (apply.rs)

For release-variant ecosystems (gem/pypi/maven), the variant loop verified each variant's representative file and — without --force — skipped any variant in HashMismatch/NotFound state. For a singleton base (the overwhelmingly common bare pkg:gem/name@ver manifest record) a locally-modified file therefore failed the run with no matching variant found and left the file untouched, while the documented default policy (npm precedent from PR #115: warn content_mismatch_overwritten + apply the full verified patched content, --strict opts out) was unreachable.

Fix: the installed-distribution gate now applies to multi-variant bases only. A singleton has no sibling to make a mismatch mean "different distribution", so it falls through to apply_package_patch, whose existing MismatchPolicy (Warn/Strict/Force) handles it exactly like the npm branch — same warning wording, same JSON envelope events, same --strict refusal. mismatch_blob_gaps mirrors the singleton exemption so the Warn fall-through's afterHash blobs are prefetched under --download-mode diff.

Multi-variant behavior is unchanged (sibling mismatch = skip, never overwrite; no variant matching = fail closed) and pinned by two guards.

P2 — the rollback/remove before-blob gate was variant-blind (rollback.rs)

rollback_patches_inner gated the whole run on get_missing_before_blobs over the ecosystem-scoped manifest before find_packages_for_rollback + select_installed_variants narrowed a broad multi-platform gem manifest to the installed platform. An unfetchable, uninstalled sibling ?platform= variant's before-blob aborted the entire rollback (--offline: wholesale; online: any download failure), and remove — which delegates here — then refused with rollback_failed.

Fix: discovery + variant narrowing run first; the gate then covers only the (purl, path) pairs that will actually be attempted, plus in-scope purls the crawler could not resolve at all — undiscovered purls deliberately keep the pre-existing fail-closed gate (that behavior is pinned by rollback_invariants.rs, cli_rollback_silent.rs, and remove_network.rs, which are outside this PR's scope). Local-redirect (local-go) purls stay excluded as before, and the manifest-key lookups keep using find_packages_for_rollback (qualified-purl invariant).

Which test pins which change (all RED on 10c0079)

Green-on-base guards (must NOT change): singleton_mismatch_force_still_applies, multi_variant_mismatched_sibling_is_skipped_not_overwritten, multi_variant_none_matching_still_fails_closed; the pre-existing mismatch_blob_gaps_skips_non_installed_variant_unless_forced was refitted with a genuine multi-variant group (its old singleton fixture's premise is what P1 changes) while keeping its assertions.

Verification

• RED runs against 10c0079 (sources reverted, tests kept): 2/5 new policy tests fail, 3/3 new multi-platform tests fail, unit test fails with the old gate condition; all guards stay green.
• Green: core 2460/0 (full), cli --lib 351/0, in_process_gem_apply 7/0, in_process_gem_multi_platform 7/0, in_process_get_manifest_path 5/0, in_process_get_update_count 3/0, in_process_scan 24/0, e2e_gem 8/0 (3 ignored live), docker_e2e_gem 2/2 (default non-forced apply path), plus shared-code sweep: apply_network 9/0, apply_invariants 6/0, rollback_invariants 14/0, cli_rollback_silent 5/0, cli_apply_silent 4/0, remove_network 2/2, remove_invariants 26/0, remove_rollback_api_overrides 2/0, in_process_rollback_all_ecosystems 8/0, in_process_pypi_multi_release 4/0, in_process_variant_apply_failure 2/0, in_process_edge_cases 9/0, in_process_remove_repair_lifecycle 14/0, output_modes_e2e 37/0, cli_dry_run_paths_e2e 8/0, cli_remove_silent 10/0, get_nested_apply_api_flags_e2e 16/0, scan_invariants 18/0, scan_sync_e2e 4/0, in_process_cargo_apply 3/0, in_process_pypi_apply 4/0, in_process_alternate_installers 12/0, in_process_remote_ecosystems_apply 12/0, in_process_vendor 27/0, in_process_get 21/0, get_invariants 22/0. cargo fmt + clippy --all-targets clean.
• Empirical: platform-gem layout re-validated against real RubyGems (host ruby 3.4.10): gem install of nokogiri-1.18.10-x86_64-linux-gnu.gem lands in gems/<name>-<version>-<platform> — the exact leaf the fixtures synthesize.

Reviewer notes / deliberate scope choices

• Qualified singletons fall through too. A narrow scan of a platform gem stores a single ?platform= record; after this PR a mismatch there warn-overwrites (npm parity) instead of erroring. If the user switched install platforms without rescanning, the default policy would write the recorded variant's verified bytes over the other platform's file — same trade-off npm already accepts for locally-replaced packages; --strict opts out. Called out in case a qualifier-aware carve-out is preferred.
• Undiscovered purls still gate blobs. The mission's strictest reading ("gate only what will be attempted") would also skip gating manifest entries with no installed package — but that exact fail-closed behavior is pinned by rollback_invariants.rs, cli_rollback_silent.rs (tests 3–4) and remove_network.rs (both tests), which are outside this PR's owned files. The narrower fix keeps those suites green; relaxing the not-installed case would need fixture updates there first.
• A NotFound representative on a singleton now surfaces the engine's per-file "File not found" error (Warn/Strict are hard errors on missing pre-existing files, --force skips) instead of the generic no matching variant found; exit codes are unchanged.

🤖 Generated with Claude Code