fix(drift): the drift pipeline stops failing on faults that are not drift

[jpr5]

The Fix Drift cron and its PR checks fail on faults that are not drift. Four defects, one surface: what a live provider's silence means, what a server-initiated close means, whether the sync's own gate can judge the edit in front of it, and whether a printed critical diff survives being parsed.

1. A printed critical diff could vanish, leaving the run "clean"

Mock:\s*(.+) — where \s matches newlines — combined with compareShapes setting mock: "" on 100% of its diffs, meant an entry with an empty mock value consumed its successor.

Measured across every permutation: the trigger is one empty-mock entry that has a successor, and the successor dies regardless of its own value. It does not need consecutive empties — a block whose only empty value sits in the middle loses its third entry. Two live surfaces emit these blocks, fal-queue.drift.ts and video.drift.ts, losing floor(N/2) entries silently.

Red on the unfixed collector with real emitter output: 2 entries, critical second → parsed 1 of 2, "No critical diffs found.", exit 0, conclusion: "clean". Green: Critical diffs: 1, exit 2, conclusion: "critical".

A ^ line anchor closes a second defect in the same pass: without it, a numbered line in prose followed by Path:/SDK:/Real:/Mock: was read as a real entry.

2. A silent provider was an unactionable manual-triage stop

Every drift run since 2026-08-11 failed — the scheduled main job as well as PR jobs, all three provider keys confirmed present by the job's own preflight, so neither credential-gating nor PR-specific. The Gemini Live leg times out having collected nothing, and the collector could not classify its own most common failure, so it quarantined with exit 5 — manual triage required.

Four lanes now, split on what the close frame actually says:

• Refusal — 1002/1003/1007/1008/1009/1010 and 4000-4999. The frame names something we sent. Attributed critical drift, exit 2, code and reason preserved.
• Hang-up — 1000/1001/1011/1012/1013. The peer left for its own reasons. exit 6: visible and alerted, not a drift finding — calling a provider hiccup "drift" pages the team and feeds the auto-fixer a phantom.
• Silence — exit 6 / live-timeout. Deliberately not exit 0: those legs graded nothing, so the run must never be adopted as a reusable clean baseline.
• Garbage — exit 5, unchanged.

Measured end to end: 2, 6, 6, 5. The refusal codes are a set, not a range — a first attempt used 1002..1010 and the negative controls caught it, since 1004 is reserved and 1005/1006 are never sent on the wire. Boundaries pinned: 3999 and 5000 are not refusals.

Handshake attribution also stopped being hardcoded to openai-realtime; it follows the probe frame through a closed table, and an unregistered probe still quarantines, because a confidently wrong owner fails open.

3. A refused WS session looked exactly like silence

The drift probe's TLS client discarded the server's CLOSE frame with a bare socket.end(). That is why the 08-11 and 08-12 failures could not be explained — the one signal naming the cause was thrown away.

Before, the two cases are the same string:

CASE A (CLOSE 1008 + reason): Error: waitUntil timeout after 1500ms. Collected 0 messages: [] bodies=[]
CASE B (silent):              Error: waitUntil timeout after 1500ms. Collected 0 messages: [] bodies=[]
INDISTINGUISHABLE: true

After, A names code=1008 and its reason, and B is byte-identical before and after, compared with Buffer.compare rather than by eye. A clean close, a client-initiated close, and answer-then-close (buffered and same-segment) all stay byte-identical to baseline. socket.end() is untouched; lifecycle is unchanged. The serving mock (src/ws-framing.ts) already handled close codes correctly and is not in this diff.

4. The sync's gate vetoed an edit it cannot judge

gate-3 re-collects the live suite and refuses on its global critical count. But no *.drift.ts reads deprecatedFamilies — the deprecation direction is offline-only. So for a run whose whole changeset is recorded deprecations, gate-3 can neither confirm nor refute the edit; it can only veto it on unrelated drift.

That is what reddened 2026-08-11: run 31465219443, changeset 74f6efa43753f7d0, reason=gate-failed. The identical edit passed the next morning and became #370.

Gate-3 is now skipped for deprecation-only runs with the reason recorded; runs that add a family still run it. A fail-open is closed alongside — reportTrustNote no longer reports a quarantined, AG-UI-skipped, or conclusion-less report as a "clean re-collect", a state both failing mornings passed through.

Because this is a non-determinism fix, a single green run proves nothing. Stability is the evidence: 25 separate processes → 1 distinct outcome, and the probe is proven able to detect divergence — against the unfixed code it yields 2 outcomes, the 08-11 revert and the 08-12 pass.

Verification standard

Red-green throughout is against real code and real payloads, not reconstructions. The gate reconstruction's own computeChangesetKey reproduces 74f6efa43753f7d0 byte-identically. The collector and WS halves were verified against each other by merging both and driving the real client against a local TLS server sending a real CLOSE frame, then feeding the resulting error's own stack through the real collector.

Every guard was mutation-tested. Several rounds found guards that could not fail and they were fixed or deleted rather than kept: an "undecodable reason" test whose input never reached the decoder, a double-count that needed a mixed run, one genuinely unreachable branch deleted, and one comment that sold an inert ordering as active protection — rewritten to record that the ordering is inert while the close check itself is load-bearing, so a later reader does not delete it.

Correction to an earlier claim in this workstream

A refusal was not previously being tolerated as a benign infra flake. That indicator is anchored ^\s*(?:HTTP\s+)?waitUntil timeout\b and vitest always prefixes Error: , so it can never fire — the old message matched nothing either. The old behaviour was exit 5, a hard stop. The dead anchor is itself a guard that cannot fire.

Unproven

Why Gemini Live went silent. This makes the next occurrence explain itself; it does not explain that one. Whether Gemini Live sends a CLOSE frame at all in that scenario is unverified — a clean FIN without one remains indistinguishable from silence.

How much drift was historically lost to the parser swallow cannot be bounded: the loss happened before the report was written, and raw vitest output is not retained. Carried as unknown, not zero.

drift-live-pr on this PR runs the collector from origin/main by design (git worktree add ../base-main origin/main), so it cannot pass until this lands. The falsifiable test is that #372's identical failure clears once it does.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@copilotkit/aimock@371

commit: 4464c9b

[jpr5]

Merging with drift-live-pr red. That job establishes its baseline by running the collector from main — git worktree add ../base-main origin/main — so it executes the unfixed code by design and cannot pass until this lands. It fails on the exact fault this PR fixes.

Every other check is green (26), local suite 5251 passing, version-neutral.

The falsifiable test: #370 fails the same job for the same reason. If it does not clear once this is on main, the fix is wrong.