Summary
Three small Pro-npm residuals from the parser/loadable-stats fix wave (#4401/#4447) and the multipart consolidation (#4435).
Findings
1. ENOENT loadable-stats misconfig is permanently silent
warnIfUnexpectedLoadableStatsFailure (packages/react-on-rails-pro/src/injectRSCPayload.ts:163-164) returns early on ENOENT, so a setup that copies loadable-stats.json to the wrong directory never logs anything, ever — the exact misconfiguration issue #4371's impact section wanted a single log line to surface. #4401/#4447 fixed the retry and rate-limited non-ENOENT warnings, but ENOENT gets zero notes. Fix: one info/debug-level note per process on the first ENOENT (path included), silent thereafter, preserving the opportunistic no-stats fallback.
2. Missing success-cache regression test
tests/loadClientChunkStylesheetHrefs.test.ts covers fail→retry→success but never renders again after success to assert readFileSync is not called a third time. The success-permanent-cache behavior (injectRSCPayload.ts:266-268, 319-322) is the no-per-request-re-read guarantee from #4371; a one-assertion extension of the existing monotonic-clock test locks it in against future refactors of the load-state machine.
3. worker.test.ts bypasses the formAutoContent shim
PR #4285 added a direct import FormData from 'form-data' + manual form.append(...)/getBuffer()/getHeaders() block to packages/react-on-rails-pro-node-renderer/tests/worker.test.ts:17, 135-168 (unsafe-filename rejection test), while the same file imports the ./formAutoContent shim that #4435 (issue #4407) standardized the inject-transport tests on. The shim already supports {value, options} pass-through incl. filepath/contentType. Migrate the new test to the shim (or extend the shim's return with the raw form for buffer access) so worker.test.ts uses one multipart pattern again. Test-only, cosmetic.
Acceptance criteria
Audit ledger: #4010 (comment)
Post-merge audit follow-up (fix-wave a6c5867..ed5049f). Filed by Claude Code on behalf of Justin Gordon.
Summary
Three small Pro-npm residuals from the parser/loadable-stats fix wave (#4401/#4447) and the multipart consolidation (#4435).
Findings
1. ENOENT loadable-stats misconfig is permanently silent
warnIfUnexpectedLoadableStatsFailure(packages/react-on-rails-pro/src/injectRSCPayload.ts:163-164) returns early on ENOENT, so a setup that copiesloadable-stats.jsonto the wrong directory never logs anything, ever — the exact misconfiguration issue #4371's impact section wanted a single log line to surface. #4401/#4447 fixed the retry and rate-limited non-ENOENT warnings, but ENOENT gets zero notes. Fix: one info/debug-level note per process on the first ENOENT (path included), silent thereafter, preserving the opportunistic no-stats fallback.2. Missing success-cache regression test
tests/loadClientChunkStylesheetHrefs.test.tscovers fail→retry→success but never renders again after success to assertreadFileSyncis not called a third time. The success-permanent-cache behavior (injectRSCPayload.ts:266-268, 319-322) is the no-per-request-re-read guarantee from #4371; a one-assertion extension of the existing monotonic-clock test locks it in against future refactors of the load-state machine.3. worker.test.ts bypasses the formAutoContent shim
PR #4285 added a direct
import FormData from 'form-data'+ manualform.append(...)/getBuffer()/getHeaders()block topackages/react-on-rails-pro-node-renderer/tests/worker.test.ts:17, 135-168(unsafe-filename rejection test), while the same file imports the./formAutoContentshim that #4435 (issue #4407) standardized the inject-transport tests on. The shim already supports{value, options}pass-through incl.filepath/contentType. Migrate the new test to the shim (or extend the shim's return with the raw form for buffer access) soworker.test.tsuses one multipart pattern again. Test-only, cosmetic.Acceptance criteria
worker.test.tsuses theformAutoContentshim (no directform-dataimport).Audit ledger: #4010 (comment)
Post-merge audit follow-up (fix-wave a6c5867..ed5049f). Filed by Claude Code on behalf of Justin Gordon.