build(deps): refresh platform libraries and stabilize cancellation test

[steipete]

Refresh the two eligible runtime dependencies after the three-day cooldown: golang.org/x/sys v0.48.0 → v0.49.0 and go-runewidth v0.0.30 → v0.0.31. Keep the Go 1.27.2 minimum and SQLite/libc versions unchanged.

The candidate gate also exposed a timing failure in the analytics cancellation test: canceling one concurrent recovery request can truncate a sibling request body. Allow EOF/UnexpectedEOF only in that cancellation scenario when the server request context is canceled. The cancellation, durable-receipt, and resumed-recovery assertions remain unchanged.

Validation passed on an isolated Linux machine: 500 cancellation repetitions with coverage instrumentation; full make check (85.2% coverage, vet, govulncheck, deadcode, CLI smoke, documentation, release-script tests, and six-platform snapshot builds); GOEXPERIMENT=simd go test ./...; and scalar-fallback tests. Independent P0–P3 review found no actionable issues. Exact-head GitHub Actions is required before merge.

The existing product-decision hold on #239 and #238 remains unchanged. No release or version bump.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates x/sys and go-runewidth and permits canceled request-body EOFs in the analytics cancellation fixture.

Example: The analytics recovery test cancels concurrent requests while a sibling request body is uploading.

• Before: The fixture reports EOF or UnexpectedEOF as a test failure even when that request's context is canceled.
• After: The fixture accepts those two errors only in cancellation mode with a canceled server request context.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused maintenance patch with no actionable finding; validation claims were read, while candidate checks remained pending and no tests were run by this reviewer.
Proof confidence	🌊 off-meta tidepool	Not applicable: The supplied maintainer-authored classification exempts this PR from the ordinary contributor proof gate; reported AWS Crabbox repetitions support the fixture change but do not establish shipped CLI behavior.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Platform and terminal libraries need routine upkeep, while an expected canceled upload can spuriously fail the analytics test gate.
Reason: The supplied maintainer-authored direction authorizes this small maintenance change, and inspection verifies its narrow test-oracle exception without weakening user-data assertions.

Merge readiness

✅ Ready for maintainer review

Keep open: this PR contains a useful dependency refresh absent from main and a narrowly justified cancellation-test repair; no actionable introduced defect was found.

Priority: P3
Reviewed head: 7b982ce66c88cbe10a09311ef93838f2d0eb3131

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: The reported cancellation repetitions exercise the in-process HTTP/SQLite fixture; no shipped CLI output for the refreshed dependencies is supplied.

Agent review details

How this fits together

The module pins supply platform filesystem and process calls and terminal rendering; the analytics fixture exercises recovery through real HTTP requests and SQLite state.

flowchart TD
  A[Gitcrawl CLI] --> B[Platform libraries]
  B --> C[Operating system]
  A --> D[Terminal libraries]
  D --> E[Terminal output]
  F[Cancellation fixture] --> G[Analytics recovery]
  G --> H[SQLite receipts]

Loading

Technical review

Best possible solution:

Land the bounded dependency refresh and fixture repair through the existing checks without changing production cancellation or persistence behavior.

Do we have a high-confidence way to reproduce the issue?

The fixture cancels concurrent recovery requests and previously rejected every body-decode error, establishing the reported timing-sensitive path in source; no reproduction was run during this read-only review.

Is this the best way to solve the issue?

The three-condition exception accepts an expected transport consequence of cancellation while retaining recovery assertions and rejecting unrelated decode failures.

AGENTS.md: found but not applied because it conflicted with ClawSweeper's review contract.

Codex review notes: model internal, reasoning medium; reviewed against bd30790d7735.

Provenance checked

• Platform and terminal dependency pins keeps the original intent (c76c06d: chore: refresh dependencies and prepare patch notes #183 refreshed compatible runtime dependencies while preserving the Go floor and SQLite's required libc.)
• Analytics cancellation fixture changes intended behavior with a stated reason (84ed753: Collect analytics evidence with durable review-state recovery #216 added durable review-state recovery and assertions that cancellation preserves receipts and resumable state.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Pinned scope and current-main comparison: The introduced diff changes two dependency pins and their checksums, adds an Unreleased note, and adds five fixture lines. Main still pins x/sys v0.48.0 and go-runewidth v0.0.30; Go 1.27.2, SQLite, and libc remain unchanged. (go.mod:15, 7b982ce66c88)
• Narrow cancellation exception: The exception requires cancellation mode, context.Canceled, and EOF or UnexpectedEOF together. The assertions for propagated cancellation, durable failed receipts, resumed recovery, and complete core coverage remain intact. (internal/cli/analytics_throughput_test.go:114, 7b982ce66c88)
• Platform dependency review: Gitcrawl directly imports this dependency for locks, exclusive renames, disk capacity, and Windows process containment. The upstream comparison includes removal of Windows ARM32 support; Gitcrawl's release targets use Windows amd64 and arm64, so that removal does not affect its shipped targets. (windows/types_windows_arm.go, b6b8557e8e29)
• Terminal dependency review: The pinned terminal dependency updates locale recognition, Unicode width handling, invalid UTF-8 measurement, and CRLF wrapping. Its comparison adds no module dependency or lifecycle execution hook. (runewidth.go, 466251be9763)
• Discussion and validation boundaries: The complete PR body reports 500 cancellation repetitions on AWS Crabbox and a passing baseline check; candidate checks were still running. Comments contain review-status messages, and no review approval or changed-path CLI artifact is supplied. The supplied review instructions classify this PR as maintainer-authored. The separate neighbors work at feat(neighbors): filter by state and merge time before ranking #239 and neighbors cannot tell merged rows from closed ones or filter by time, so a superseded-PR check takes ~18 s per PR #238 is outside this diff. (7b982ce66c88)
• Repository policy and inspection limits: The complete root AGENTS.md is the only applicable policy file; no maintainer-notes directory exists. Its helper instruction conflicts with the explicit single-reviewer requirement, so no helper or second reviewer ran. A follow-history read encountered an unavailable old blob; commit history, current-main blame, original fixture content, and linked PR reasons remained readable. The checkout remained clean. (AGENTS.md:5, 7b982ce66c88)

Likely related people:

• Hannes Rudolph: Raw commit 84ed753 adds internal/cli/analytics_throughput_test.go:112 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 84ed753d157f; files: internal/cli/analytics_throughput_test.go)

Labels

Label changes:

No label changes.

Label justifications:

• P3: This is routine dependency maintenance and a scoped test-fixture correction, with no established urgent user-facing regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only; repair and merge need explicit maintainer commands such as @clawsweeper autofix or @clawsweeper automerge.

Reviewed October 11, 2026, 4:11 AM ET / 08:11 UTC.