pstack statechart: output replacement deletes foreign nested files #773

Summary

The new pstack statechart tool can silently delete unrelated nested files when replacing an existing output folder. foreign() checks only immediate entry names, while publish() recursively removes the previous output directory. An allowed name can therefore hide foreign descendants or even be a directory where a generated file is expected.

This contradicts the preservation contract described in #741: a run should refuse files it did not write rather than overwrite/delete them.

Affected source

Verified at commit eb4db2b55b2b7dec3d9282754cddf0a56bf4ff10:

• foreign() / OWN, lines 537–549
• publish(), lines 604–639

Also rechecked against the current main source returned by GitHub at reporting time, blob 6e2ebfccdafff7900016b5cf2ed5384c84181545: the same isolated reproduction below confirms all three cases.

Observed behavior

For newly created disposable output fixtures:

• tlc/notes.md: foreign(output) returns []; publication deletes the sentinel.
• chart.mmd/notes.md: a directory named like an expected generated file is accepted; publication deletes its sentinel.
• .DS_Store/notes.md: the same type-confusion case is accepted and deleted.

This does not require overlapping runs. It affects the output-replacement path, including an explicitly supplied --out directory. A root-level foreign notes.md is correctly refused by the existing check; nested/type-confusion cases are missed.

A separate symlink probe removed an accepted tlc symlink but preserved its target contents. This report does not claim recursive deletion through symlinks into their targets.

Minimal isolated reproduction (no TLC required)

Save this as repro.cjs in a checkout, then run:

node repro.cjs pstack/skills/statechart/scripts/statechart.mjs

The probe extracts and executes the unchanged actual ownership/publication function bodies in a Node VM. It creates only fresh temporary fixtures; it does not run a full TLC invocation or touch an existing output directory. No user data is needed. The fixture tree is left in the temporary directory for inspection.

// Isolated reproduction: only newly created disposable fixtures are touched.
const fs = require('node:fs');
const path = require('node:path');
const os = require('node:os');
const vm = require('node:vm');
const assert = require('node:assert/strict');
const source = fs.readFileSync(process.argv[2] || 'pstack/skills/statechart/scripts/statechart.mjs', 'utf8');
const start = source.indexOf('const OWN =');
const end = source.indexOf('function secondModel(', start);
assert(start >= 0 && end > start, 'Unexpected upstream source layout');
const context = { fs, path, rel: String };
vm.createContext(context);
vm.runInContext('class CannotFinish extends Error {}\n' + source.slice(start, end) + '\nglobalThis.probe = { foreign, publish };', context);
const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'statechart-ownership-repro-'));
for (const [name, relative] of [['nested-tlc', 'tlc/notes.md'], ['wrong-type-chart', 'chart.mmd/notes.md'], ['wrong-type-dsstore', '.DS_Store/notes.md']]) {
  const output = path.join(scratch, name, 'output');
  const work = path.join(scratch, name, 'work');
  const sentinel = path.join(output, relative);
  fs.mkdirSync(path.dirname(sentinel), { recursive: true });
  fs.mkdirSync(work, { recursive: true });
  fs.writeFileSync(sentinel, 'disposable sentinel');
  fs.writeFileSync(path.join(work, 'chart.mmd'), 'replacement');
  const foreign = Array.from(context.probe.foreign(output));
  context.probe.publish(work, output, new Map());
  const preserved = fs.existsSync(sentinel);
  console.log(JSON.stringify({ case: name, foreign, sentinelPreserved: preserved }));
  assert.equal(foreign.length, 0);
  assert.equal(preserved, false);
}

Observed output:

{"case":"nested-tlc","foreign":[],"sentinelPreserved":false}
{"case":"wrong-type-chart","foreign":[],"sentinelPreserved":false}
{"case":"wrong-type-dsstore","foreign":[],"sentinelPreserved":false}

Expected: reject the foreign nested content/wrong entry type, identify the offending path, and preserve the existing directory contents.

Suggested regression coverage / correction

• Type-check reserved generated leaves; a directory named chart.mmd or .DS_Store must not imply ownership of all its descendants.
• Validate the permitted tlc subtree rather than accepting everything beneath its top-level name; reject unexpected descendants, symlinks and special/unreadable entries without following them.
• Apply preservation checks at the existing initial-selection and publication/moved-aside boundaries, including foreign content appearing during a run.
• Keep safe rerun behavior for valid generated outputs, and ensure a failed replacement restores or retains the original contents with their location reported.
• Treat concurrent mutation separately: a recursive scan alone does not establish that a subsequent recursive deletion cannot race a writer.

Verification and limits

• Environment: Node v22.22.2, Linux aarch64.
• Existing statechart test suite: 27 passed, 31 skipped, 0 failed; TLC is unavailable here. Existing root-foreign-file cases do not exercise the nested/type cases above.
• The isolated ownership/publication reproduction above was executed successfully. It is not a claim of a full Java/TLC or PNG end-to-end run.