From 6a0ccac19b98ffe323ec610e59b17632df08db7e Mon Sep 17 00:00:00 2001
From: Ray Walker <ray@27b.io>
Date: Mon, 9 Nov 2026 19:56:31 +1100
Subject: [PATCH 1/4] ci(perf): self-test that a core release's base carries
 the head's dependenciesMeta

The base check had no scenario where only dependenciesMeta changed since the
core's tag, so dropping it from perf-ir.sh's copy list left every check green.
Add one, assert the base's package.json carries the head's dependenciesMeta and
that the dependency warning fires, and reflow the perf-ir.sh header comment.
---
 .github/scripts/perf-ir-hash-selftest.sh | 9 ++++++++-
 .github/scripts/perf-ir.sh               | 7 +++----
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/.github/scripts/perf-ir-hash-selftest.sh b/.github/scripts/perf-ir-hash-selftest.sh
index d515fbe2..8b74ee5c 100755
--- a/.github/scripts/perf-ir-hash-selftest.sh
+++ b/.github/scripts/perf-ir-hash-selftest.sh
@@ -144,6 +144,9 @@ core_api() {
   set_json "$1/$wasm/package.json" '.devDependencies = {"x": "^2.0.0"}'
   echo "WORKLOADS['added-since-tag'] = WORKLOADS.keygen;" >> "$1/packages/cachekit/bench/ir-workload.mjs"
 }
+# A core change since its tag to dependenciesMeta alone, which the head's
+# lockfile records like the dependency fields.
+core_meta() { set_json "$1/$wasm/package.json" '.dependenciesMeta = {"x": {"injected": true}}'; }
 out() { sed -n "s/^$2=//p" "$work/$1-out/base"; }
 assert() { # assert <label> <command>...: passes when the command succeeds
   if "${@:2}"; then echo "ok: $1"; else
@@ -161,7 +164,7 @@ from_tag() { [[ $(cat "$work/$1-ir/base/$3") == "$(g "$origin" show "$2:$3")" ]]
 absent() { [[ ! -e $work/$1-ir/base/$2 ]]; }
 # The base's core package.json: the head's dependency fields, the rest the tag's.
 manifest_mix() {
-  local fields='["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"]'
+  local fields='["dependencies", "devDependencies", "optionalDependencies", "peerDependencies", "dependenciesMeta"]'
   local deps="with_entries(select(.key | IN(${fields}[])))" rest="with_entries(select(.key | IN(${fields}[]) | not))"
   local base=$work/$1-ir/base/$wasm/package.json head=$work/$1-ir/head/$wasm/package.json
   [[ $(jq -c "$deps" "$base") == "$(jq -c "$deps" "$head")" &&
@@ -184,6 +187,10 @@ assert "core release PR: the base's core package.json is the tag's with the head
 assert 'core release PR: a dependency change since the tag is warned about' warned core-drift
 assert 'core release PR: a workload added since the tag reads new' new_on_base core-drift added-since-tag
 
+DRIFT=core_meta pick core-meta "${rp}cachekit-core-wasm" - "$sdk"
+assert "core release PR: the base's core package.json carries the head's dependenciesMeta" manifest_mix core-meta
+assert 'core release PR: a dependenciesMeta change since the tag is warned about' warned core-meta
+
 pick sdk-change "${rp}cachekit-core-wasm" "$sdk" "$sdk"
 assert "a core release branch's PR that changes the SDK: the base is the whole core tag tree" \
   whole_tag sdk-change "$wasm_tag" "$sdk"
diff --git a/.github/scripts/perf-ir.sh b/.github/scripts/perf-ir.sh
index 907fe3f4..d9f7f1df 100644
--- a/.github/scripts/perf-ir.sh
+++ b/.github/scripts/perf-ir.sh
@@ -18,10 +18,9 @@
 # the head with only that package checked out at BASE_SHA, its files the
 # release lacks removed. Its package.json keeps the head's dependency fields
 # and dependenciesMeta, which the head's pnpm-lock.yaml records and the frozen
-# install checks, so a bump since the tag does not
-# fail the base's frozen install; both trees then build the core with the
-# same dependencies, so that drift goes unmeasured here (the PR that bumped it
-# was measured). The base's workload list still comes from BASE_SHA's bench
+# install checks, so a bump since the tag does not fail the base's frozen
+# install; both trees then build the core with the same dependencies, so that
+# drift goes unmeasured here (the PR that bumped it was measured). The base's workload list still comes from BASE_SHA's bench
 # file, so a workload added since the tag reads `new` where the tagged core
 # cannot run it. If the head's SDK imports a core export by name that the tag
 # lacks, the base's build fails and every workload reads INCOMPLETE: the SDK

From cacfa575a436e894188deb7df0cb153f020f622d Mon Sep 17 00:00:00 2001
From: Ray Walker <ray@27b.io>
Date: Mon, 9 Nov 2026 09:57:55 +0000
Subject: [PATCH 2/4] ci(perf): self-test a dropped dependenciesMeta and the
 base's lockfile

The core's tag now carries a dependenciesMeta, so a new core-meta-dropped
scenario can drop it on the head and assert the base's core package.json
drops it too: a copy that merged the head's dependency fields over the tag's
instead of replacing them passed every check. The core-meta scenario's head
lockfile now differs from the tag's, and the base must carry the head's: a
base that took the tag's lockfile passed too.

Reflow the perf-ir.sh header comment and say why the PR that bumped a core
dependency was measured: the gate runs on every PR to main.
---
 .github/scripts/perf-ir-hash-selftest.sh | 21 ++++++++++++++++-----
 .github/scripts/perf-ir.sh               | 11 ++++++-----
 2 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/.github/scripts/perf-ir-hash-selftest.sh b/.github/scripts/perf-ir-hash-selftest.sh
index 8b74ee5c..e4c94d09 100755
--- a/.github/scripts/perf-ir-hash-selftest.sh
+++ b/.github/scripts/perf-ir-hash-selftest.sh
@@ -89,8 +89,11 @@ fi
 
 g() { git -C "$1" -c user.name=selftest -c user.email=selftest@example.invalid -c commit.gpgsign=false \
   -c core.hooksPath=/dev/null "${@:2}"; }
+# set_json <file> <jq filter>
+set_json() { jq "$2" "$1" > "$1.new" && mv "$1.new" "$1"; }
 # The released repo: core-wasm's release, then a later SDK release that also
-# changed the core, so each tag names a tree of its own.
+# changed the core, so each tag names a tree of its own. The core's tag carries
+# a dependenciesMeta, so a scenario can change or drop it.
 origin=$work/origin
 tree "$origin"
 cp "$scripts/../../release-please-config.json" "$scripts/../../.release-please-manifest.json" "$origin/"
@@ -98,6 +101,7 @@ sdk_tag=cachekit-v$(jq -r '.["packages/cachekit"]' "$origin/.release-please-mani
 wasm_tag=cachekit-core-wasm-v$(jq -r '.["packages/cachekit-core-wasm"]' "$origin/.release-please-manifest.json")
 sdk=packages/cachekit/dist/index.js glue=packages/cachekit-core-wasm/pkg/glue.js
 added=packages/cachekit-core-wasm/pkg/added.js wasm=packages/cachekit-core-wasm
+set_json "$origin/$wasm/package.json" '.dependenciesMeta = {"y": {"injected": true}}'
 g "$origin" init -q -b main
 g "$origin" add -A
 g "$origin" commit -q -m 'core-wasm release'
@@ -106,8 +110,6 @@ echo '// SDK release' | tee -a "$origin/$sdk" >> "$origin/$glue"
 g "$origin" commit -q -am 'SDK release'
 g "$origin" tag "$sdk_tag"
 
-# set_json <file> <jq filter>
-set_json() { jq "$2" "$1" > "$1.new" && mv "$1.new" "$1"; }
 # pick <scenario> <PR head branch> <PR file|-> <file>...: append to each <file>
 # on main after the releases (and run $DRIFT on the repo, if set), then open
 # the PR. A release PR edits what release-please edits: the package's version,
@@ -145,8 +147,12 @@ core_api() {
   echo "WORKLOADS['added-since-tag'] = WORKLOADS.keygen;" >> "$1/packages/cachekit/bench/ir-workload.mjs"
 }
 # A core change since its tag to dependenciesMeta alone, which the head's
-# lockfile records like the dependency fields.
-core_meta() { set_json "$1/$wasm/package.json" '.dependenciesMeta = {"x": {"injected": true}}'; }
+# lockfile records like the dependency fields: changed, or dropped.
+core_meta() {
+  set_json "$1/$wasm/package.json" '.dependenciesMeta = {"x": {"injected": true}}'
+  echo '# dependenciesMeta' >> "$1/pnpm-lock.yaml"
+}
+core_meta_dropped() { set_json "$1/$wasm/package.json" 'del(.dependenciesMeta)'; }
 out() { sed -n "s/^$2=//p" "$work/$1-out/base"; }
 assert() { # assert <label> <command>...: passes when the command succeeds
   if "${@:2}"; then echo "ok: $1"; else
@@ -190,6 +196,11 @@ assert 'core release PR: a workload added since the tag reads new' new_on_base c
 DRIFT=core_meta pick core-meta "${rp}cachekit-core-wasm" - "$sdk"
 assert "core release PR: the base's core package.json carries the head's dependenciesMeta" manifest_mix core-meta
 assert 'core release PR: a dependenciesMeta change since the tag is warned about' warned core-meta
+assert "core release PR: the base's lockfile is the head's, which records that change" head_outside_core core-meta
+
+DRIFT=core_meta_dropped pick core-meta-dropped "${rp}cachekit-core-wasm" - "$sdk"
+assert "core release PR: the base's core package.json drops the dependenciesMeta the head dropped" \
+  manifest_mix core-meta-dropped
 
 pick sdk-change "${rp}cachekit-core-wasm" "$sdk" "$sdk"
 assert "a core release branch's PR that changes the SDK: the base is the whole core tag tree" \
diff --git a/.github/scripts/perf-ir.sh b/.github/scripts/perf-ir.sh
index d9f7f1df..af384c82 100644
--- a/.github/scripts/perf-ir.sh
+++ b/.github/scripts/perf-ir.sh
@@ -20,11 +20,12 @@
 # and dependenciesMeta, which the head's pnpm-lock.yaml records and the frozen
 # install checks, so a bump since the tag does not fail the base's frozen
 # install; both trees then build the core with the same dependencies, so that
-# drift goes unmeasured here (the PR that bumped it was measured). The base's workload list still comes from BASE_SHA's bench
-# file, so a workload added since the tag reads `new` where the tagged core
-# cannot run it. If the head's SDK imports a core export by name that the tag
-# lacks, the base's build fails and every workload reads INCOMPLETE: the SDK
-# reads a new core export off the module namespace instead.
+# drift goes unmeasured here; the PR that bumped it was measured, as every PR
+# to main is. The base's workload list still comes from BASE_SHA's bench file,
+# so a workload added since the tag reads `new` where the tagged core cannot
+# run it. If the head's SDK imports a core export by name that the tag lacks,
+# the base's build fails and every workload reads INCOMPLETE: the SDK reads a
+# new core export off the module namespace instead.
 #
 # IR_ARGS goes to both ir.mjs runs after --jobs 4, word-split: --shard, or
 # --only, --repeats and a larger --jobs for a quick local try.

From b837c4ea07da61f24b9320669f6f2f47337628d0 Mon Sep 17 00:00:00 2001
From: Ray Walker <ray@27b.io>
Date: Mon, 9 Nov 2026 10:12:04 +0000
Subject: [PATCH 3/4] ci(perf): warn on a dropped dependenciesMeta; say why a
 release PR's bump is measured

The core-meta-dropped scenario now also asserts the warning fires. The perf-ir.sh header says why the PR that bumped a core dependency was measured even when it is a release PR: the bump must change pnpm-lock.yaml, a file outside the core, so perf-ir-base.sh gives that PR the whole tagged tree.
---
 .github/scripts/perf-ir-hash-selftest.sh |  1 +
 .github/scripts/perf-ir.sh               | 14 ++++++++------
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/.github/scripts/perf-ir-hash-selftest.sh b/.github/scripts/perf-ir-hash-selftest.sh
index e4c94d09..494edeac 100755
--- a/.github/scripts/perf-ir-hash-selftest.sh
+++ b/.github/scripts/perf-ir-hash-selftest.sh
@@ -201,6 +201,7 @@ assert "core release PR: the base's lockfile is the head's, which records that c
 DRIFT=core_meta_dropped pick core-meta-dropped "${rp}cachekit-core-wasm" - "$sdk"
 assert "core release PR: the base's core package.json drops the dependenciesMeta the head dropped" \
   manifest_mix core-meta-dropped
+assert 'core release PR: a dependenciesMeta removal since the tag is warned about' warned core-meta-dropped
 
 pick sdk-change "${rp}cachekit-core-wasm" "$sdk" "$sdk"
 assert "a core release branch's PR that changes the SDK: the base is the whole core tag tree" \
diff --git a/.github/scripts/perf-ir.sh b/.github/scripts/perf-ir.sh
index af384c82..df7a4651 100644
--- a/.github/scripts/perf-ir.sh
+++ b/.github/scripts/perf-ir.sh
@@ -20,12 +20,14 @@
 # and dependenciesMeta, which the head's pnpm-lock.yaml records and the frozen
 # install checks, so a bump since the tag does not fail the base's frozen
 # install; both trees then build the core with the same dependencies, so that
-# drift goes unmeasured here; the PR that bumped it was measured, as every PR
-# to main is. The base's workload list still comes from BASE_SHA's bench file,
-# so a workload added since the tag reads `new` where the tagged core cannot
-# run it. If the head's SDK imports a core export by name that the tag lacks,
-# the base's build fails and every workload reads INCOMPLETE: the SDK reads a
-# new core export off the module namespace instead.
+# drift goes unmeasured here. The PR that bumped it was measured, as every PR
+# to main is; a release PR that bumps it also changes pnpm-lock.yaml, so
+# perf-ir-base.sh measures it against the whole tagged tree. The base's
+# workload list still comes from BASE_SHA's bench file, so a workload added
+# since the tag reads `new` where the tagged core cannot run it. If the
+# head's SDK imports a core export by name that the tag lacks, the base's
+# build fails and every workload reads INCOMPLETE: the SDK reads a new core
+# export off the module namespace instead.
 #
 # IR_ARGS goes to both ir.mjs runs after --jobs 4, word-split: --shard, or
 # --only, --repeats and a larger --jobs for a quick local try.

From 8e50080448450c1d82cff7fe2b9405135808b448 Mon Sep 17 00:00:00 2001
From: Ray Walker <ray@27b.io>
Date: Mon, 9 Nov 2026 11:09:44 +0000
Subject: [PATCH 4/4] ci(perf): say which dependency changes a release PR's
 lockfile records

A peer range the core also takes as a devDependency is not in pnpm-lock.yaml, so a release PR can change it without leaving the core-only base. The frozen install then installs the same tree on both sides, so nothing goes unmeasured; the header comment now says so instead of claiming every bump changes the lockfile.
---
 .github/scripts/perf-ir.sh | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/scripts/perf-ir.sh b/.github/scripts/perf-ir.sh
index df7a4651..9c2fa732 100644
--- a/.github/scripts/perf-ir.sh
+++ b/.github/scripts/perf-ir.sh
@@ -21,10 +21,12 @@
 # install checks, so a bump since the tag does not fail the base's frozen
 # install; both trees then build the core with the same dependencies, so that
 # drift goes unmeasured here. The PR that bumped it was measured, as every PR
-# to main is; a release PR that bumps it also changes pnpm-lock.yaml, so
-# perf-ir-base.sh measures it against the whole tagged tree. The base's
-# workload list still comes from BASE_SHA's bench file, so a workload added
-# since the tag reads `new` where the tagged core cannot run it. If the
+# to main is. A release PR that changes what the core installs also changes
+# pnpm-lock.yaml, so perf-ir-base.sh measures it against the whole tagged
+# tree; a change the lockfile does not record, such as a peer range the core
+# also takes as a devDependency, installs the same tree on both sides. The
+# base's workload list still comes from BASE_SHA's bench file, so a workload
+# added since the tag reads `new` where the tagged core cannot run it. If the
 # head's SDK imports a core export by name that the tag lacks, the base's
 # build fails and every workload reads INCOMPLETE: the SDK reads a new core
 # export off the module namespace instead.