Recent server-function fixes landed without tests that pin what they established

[frenzzy]

Describe the problem

Several recent server-function fixes landed without a test that pins the property they established, so the next change can undo them and the suite stays green. This is not a complaint about any one commit — it is a pattern worth naming, because every instance below was found by deliberately breaking the runtime and watching nothing fail.

Guarded by #3111 (four of them, with the mutation that proves each):

invariant	what silently undoes it
Sec-Fetch-Site is authoritative when present — same-site and none never reach the origin matcher	letting same-site fall through, the natural repair for a broken subdomain deployment
Origin/Referer matchers refuse what they do not match	a matcher that answers true — the function and array forms had no test at all
the redirect mask covers exactly the statuses fetch follows	narrowing the set; only 302 was exercised, so 301/303/307/308 were free
the error header's bound is applied to the source, not the encoding	slicing the encoded form — it still passes a length assertion, which is all the existing tests check

Guarded by #3121: server-function ids are keyed on identity rather than position (7c551ae, #3109). Every fixture in packages/compiler/__tests__/directives/ is a single fixed source with frozen expected output, which pins the id format for that source but cannot express a differential property — no fixture has a second version. The pre-fix positional scheme passed an identically shaped suite; the fix regenerated 134 fixture and harness files. So reintroducing position goes green after exactly the fixture regeneration a developer performs reflexively when snapshots fail, and the failure mode is the silent one: an old client's call reaching a different function.

What it needs is two compilations of the same file — append a function, delete the first, reorder, edit a body — asserting every surviving name keeps its id. Also worth pinning: the ordinal suffix for a repeated name (<name>-<hash>-<n>) has no fixture at all, and it is the one place position still decides.

Weak rather than missing, for the record: nothing decoded a sanitized error through the client — response-invariants.spec.tsx asserts the header and never the body — which is how a broken first attempt at #3116's fix passed the whole suite while breaking every sanitized error end to end. #3113 adds that round trip.

Why it keeps happening

The specs here are excellent at pinning outputs — the frozen fixtures, the wire-shape assertions. The gaps are all relationships: same input, two builds; same call, two callers; the same value read twice. Those need a test that does the thing twice and compares, and that shape is rare in this suite.

What would help

1. Take test(web): pin three server-function invariants that nothing guards #3111 — it closes the four runtime invariants above.
2. Take test(compiler): pin that a file edit moves no server-function id #3121 — the differential test for the compiler ids. Reverting create_id to the positional scheme fails 4 of its 7 cases; the other three pass under both, which is exactly why the bug survived so long.
3. A note in the fixtures README that regenerating is not a decision about the format alone — the ids are a wire contract, and a diff in them is a compatibility change. The README already says regeneration is deliberate; it does not say what the deliberation is about.

[ryansolid]

All three test-coverage points are now addressed, alongside the invariant work from your other issues:

• Invariants pinned (test(web): pin three server-function invariants that nothing guards #3111, merged): the origin gate's full decision matrix, every masked redirect status, error-header decodability under the bound.
• Open gaps marked (test(web): mark three open server-function gaps as expected failures #3112, merged): test.fails markers, two of which have since flipped to ordinary guards as A result the codec cannot encode reaches the caller as undefined #3117 and The decode depth cap is opt-out: the caller picks the format that skips it #3119 closed.
• ID scheme (d6a4a52): directives-id-scheme.test.js now guards the derivation differentially — expected ids are computed by an independent implementation (the xxhash32 the retired Babel pass used, plus the documented <name>-<hash>[-<ordinal>] format) and compared against what transformDirectives reports, so a hash, relative-path, or format change turns it red even if the frozen fixtures were regenerated wholesale. A repeated-names fixture pins the ordinal suffix byte-for-byte — including the non-obvious part your report circled: assignment follows post-bubble program order (top-level declarations hoist in reverse source order, inherited from the frozen Babel reference), so the second source-order function takes the bare id. That was previously unfixtured and one traversal refactor away from silently re-pointing deployed addresses. And the fixtures README now states outright that ids are a wire contract: a regeneration that changes any id is a protocol change to be reviewed as one.

On the one design note: the ordinal's residual positionality (among same-name functions only) is a known, now-pinned trade — the identity key is file + name, and we judged content-hashing the function body worse (every edit re-points the id, breaking deployed tabs on every deploy). Closing, since all the report's items have landed; thanks for the unusually precise archaeology on what the original commits did and didn't guard.