fix(merge): don't render copy-origin files in three-way merge (#132)

[breferrari]

Closes #132. Root cause reported via #129 — thanks @e3322-pcsk9 for surfacing a real crash.

Summary

shardmind update crashed when a modified copy-origin file (any non-.njk file — scripts, .test.ts, JSON) contained a literal {{ that isn't a valid Nunjucks expression. The three-way merge (computeMergeAction, source/core/differ.ts) rendered both sides of every modified file through Nunjucks — but in v6 only .njk files are templates; everything else is copied verbatim (modules.ts). Rendering a copy file (a) crashed on a literal {{ and (b) silently substituted any real {{ expr }} it legitimately contained.

Fix

computeMergeAction takes a literal flag; update-planner sets it for copy-origin files (those already carrying copyFromSourcePath). When set, the merge runs on the raw bytes (base = oldTemplate, ours = newTemplate, no render). The renderer itself stays strict, so genuine .njk template syntax errors keep failing loudly with RENDER_TEMPLATE_ERROR.

// differ.ts
const sideContent = (template, values) =>
  input.literal ? template : renderString(template, { ...renderContext, values }, path);
// update-planner.ts
literal: target.copyFromSourcePath !== undefined,

Why not the renderer-level approach (re: #129)

#129 fixed the symptom by catching the parse error inside renderTemplate and returning the raw source when a regex decided the content "isn't a template". Verified empirically that approach is unsound:

Input	raw renderString	renderer-catch (#129)	this PR
const x="garbage{{" (copy)	throws → crash	swallowed → raw ✓	merged raw ✓
copy file w/ {{ user_name }}	renders → "Alice" (corruption)	still substituted ✗	preserved ✓
.njk typo {{ user_name }	throws (a real authoring error)	swallowed → emits broken literal ✗	still throws ✓

The renderer-level catch is wrong-altitude (weakens every render path for a merge-specific problem), incomplete (copy-file substitution untouched), and masks genuine .njk authoring errors. Fixing it at the merge — where the copy/render distinction is already known — addresses all three.

Quality gate

• npm run typecheck clean.
• npm test — 1125 passed | 30 skipped (was 1117).
• npm run build clean.
• New behavior has new tests (fixtures-first — see below).
• Adversarial cases enumerated + covered (audit below).
• Copilot review requested + addressed (pending).
• Docs updated.

Acceptance (#132)

• A modified copy-origin file with a literal {{ updates without crashing; literal preserved.
• A copy-origin file containing {{ expr }} is not substituted during merge.
• A genuine .njk template syntax error still throws RENDER_TEMPLATE_ERROR (no masking).
• Regression fixture + integration test.

Harden Audit

Reference bar: #11 (merge engine — fixtures-first).

Rounds

• Fixtures-first: merge fixture 21 (tests/fixtures/merge/21-copy-origin-literal-braces/) authored and confirmed RED (RENDER_TEMPLATE_ERROR on garbage{{) before the fix; GREEN after.
• /simplify: collapsed the two literal ? tpl : renderString(...) branches into one local helper; agents confirmed the seam, the copyFromSourcePath signal, and the status.ts deferral are the right altitude.
• /harden (focused adversarial): verified copyFromSourcePath is set only on copy[], never render[] (so a .njk file is never wrongly skipped); add/restore/overwrite byte-copy copy files (never rendered); .njk errors still throw; line-ending handling holds on raw bytes. Added CRLF + no-trailing-newline literal tests it flagged.

Tests added

• Merge fixture 21 (copy-origin literal {{ + {{ user_name }} → auto-merge, both literals survive).
• Unit (computeMergeAction): literal raw-merge + no-substitution, literal conflict, CRLF preservation, no-trailing-newline, and a .njk-still-throws regression guard.
• Integration: end-to-end update pipeline with a modified copy file containing garbage{{.
• Tests-before → after: 1117 → 1125.

Deferrals (tracked on #132)

• status.ts (verbose drift base) renders copy templates too — same root cause, but try/catch-guarded so it never crashes (display-only inaccuracy). Follow-up; needs a small separate change to thread copy-origin into DriftEntry.
• Binary copy files through the utf-8 merge — pre-existing, tracked by Binary files should bypass three-way merge entirely #63.

[Copilot]

Pull request overview

Fixes a crash and data-corruption risk in shardmind update by ensuring the three-way merge does not Nunjucks-render copy-origin (non-.njk) files, preserving literal {{ content and preventing unintended substitutions.

Changes:

• Add an opt-in literal mode to computeMergeAction() to merge copy-origin files as raw content (no render).
• Thread the copy-origin signal (copyFromSourcePath) from the update planner into the merge decision (literal: true).
• Add fixture, unit, and integration coverage; update docs + changelog to reflect the corrected merge behavior.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
source/core/differ.ts	Adds literal?: boolean to skip rendering old/new templates and merge raw strings for copy-origin files.
source/core/update-planner.ts	Sets literal for modified files when the target is copy-origin (copyFromSourcePath present).
tests/unit/three-way-merge.test.ts	Adds unit tests validating literal raw-merge behavior, CRLF preservation, and .njk syntax errors still throwing.
tests/unit/drift.test.ts	Extends fixture runner to pass literal based on new copy_origin scenario flag; bumps fixture count.
tests/integration/update.test.ts	Adds end-to-end regression test ensuring modified copy-origin files with literal {{ update without rendering/crashing.
tests/fixtures/merge/21-copy-origin-literal-braces/*	New fixture scenario validating raw merge for copy-origin content containing {{.
docs/SHARD-LAYOUT.md	Documents that update merge honors the .njk render vs copy-origin split (raw merge for non-.njk).
docs/IMPLEMENTATION.md	Updates merge spec to describe literal behavior for copy-origin files.
CHANGELOG.md	Adds an Unreleased fix entry describing the behavior change and test coverage.

[breferrari]

Fixed in fac9522. You're right — ownership: 'modified' never hits the managed overwrite branch, so the result is always auto_merge (user unchanged, shard diverged → clean resolve to ours). Tightened the assertion to auto_merge and kept the no-trailing-newline check.