Found by the serve epic re-review (N-2), reproduced identically on the CLI and serve — a core defect, pre-existing (not a serve regression): verify --fix's missing-file repair correctly refuses to move a LOCKED mod's version record, but then still redownloads and writes the source's current content into the recorded (locked) version's cache slot — the same shape as the C1 slot-mismatch fixed for unlocked mods on the serve branch, surviving for the locked case.
Expected: a locked ref's missing-file repair either (a) fetches the recorded version's file specifically (if the source can serve it) or (b) refuses with the unlock-only wording, leaving the slot untouched. Writing vN+1's bytes into the vN slot silently poisons the cache for a mod whose whole point is version pinning.
Fix in core (verify_repair.go), pinned by a test with a locked ref + a source whose current version differs from the recorded one.
Found by the serve epic re-review (N-2), reproduced identically on the CLI and serve — a core defect, pre-existing (not a serve regression):
verify --fix's missing-file repair correctly refuses to move a LOCKED mod's version record, but then still redownloads and writes the source's current content into the recorded (locked) version's cache slot — the same shape as the C1 slot-mismatch fixed for unlocked mods on the serve branch, surviving for the locked case.Expected: a locked ref's missing-file repair either (a) fetches the recorded version's file specifically (if the source can serve it) or (b) refuses with the unlock-only wording, leaving the slot untouched. Writing vN+1's bytes into the vN slot silently poisons the cache for a mod whose whole point is version pinning.
Fix in core (
verify_repair.go), pinned by a test with a locked ref + a source whose current version differs from the recorded one.