diff --git a/packages/mosaic/framework/guides/CODE-REVIEW.md b/packages/mosaic/framework/guides/CODE-REVIEW.md index c4ea6b3c..75db13c5 100755 --- a/packages/mosaic/framework/guides/CODE-REVIEW.md +++ b/packages/mosaic/framework/guides/CODE-REVIEW.md @@ -65,12 +65,15 @@ Each of these produced a wrong conclusion before it was written down. conclusion drawn from it describes the wrong tree. Confirm `git rev-parse --show-toplevel` is the tree you think it is before trusting any git output. -13. **Run the repository's PINNED tool version, not `npx --yes `.** `npx --yes` ignores the - lockfile and fetches the latest release, so it answers about a version the project does not - use. Measured on mosaicstack#1313: the lockfile pins prettier 3.8.1, under which three guides - pass; `npx --yes prettier` fetched 3.9.6, under which the same three fail; and 3.0.0, the floor - of the declared `^3.0.0` range, fails a different one. Three versions, three verdicts, same - bytes. Use `node_modules/.bin/`, or name the version the lockfile pins. +13. **Run the repository's PINNED tool version.** `npx ` resolves a local `node_modules` + install when one is present and fetches the latest release when one is not, so the same + command answers differently depending on where it ran. A reviewer measuring in a fresh clone + or a detached worktree — which is exactly where reviewers measure — has no `node_modules` and + silently gets the latest release instead of the pinned one. Measured on mosaicstack#1313: the + lockfile pins prettier 3.8.1, under which three guides pass; a version-less `npx` in a + worktree resolved 3.9.6, under which the same three fail; and 3.0.0, the floor of the declared + `^3.0.0` range, fails a different one. Three versions, three verdicts, identical bytes. Use + `node_modules/.bin/`, or name the version the lockfile pins. 14. **A formatter or linter declared as a range is a dated verdict, not a fact.** If a lockfile pins it, the gate is reproducible today and will disagree with itself the day the pin moves. Report a formatting failure with the version that produced it, always.