fix(parity): the golden fixture dedups units, so read DUPLICATES too

[defangdevs]

Refs #394. A blind spot in the check merged in #396, found by a question I could not answer from the check's own output: "is earlyoom in the NixOS backend?"

The bug

The check read tests/golden/web/units/ and nothing else. But the golden fixture deduplicates: a file whose bytes already appear in the snapshot is recorded as a line in DUPLICATES rather than written twice (issue #312). So the web config's earlyoom.service physically lives under vm/units/, and reading web/units/ alone under-reported what the module ships.

Two units were invisible, and both are real divergences the check was calling clean:

Unit	Reality
earlyoom.service	The module runs earlyoom as its OOM backstop. The native profile ships the earlyoom binary and never configures or starts it — so protectMemory natively is OOMScoreAdjust alone, with no earlyoom, no zram, no swappiness. (#394 gap 9)
agent-box-defang-cli.service	The module installs the Defang CLI in the background (#373). The native runtime profile has no defang at all — the same reason its settings page offers no defang sign-in card.

Worth noting what the failure looked like: not a wrong answer, but a confidently empty one. The check said every divergence was declared, and the thing it could not see was a unit that has been module-only all along.

The fix

module_unit_names() reconstructs the web config's real unit set from web/units/ plus the left-hand side of every web/units/... -> line in DUPLICATES. DUPLICATES joins the preflight existence check, so a fixture layout change can't make this pass vacuously either.

Both newly-visible units are declared in UNITS_KNOWN_GAPS with their issue — and the staleness check means closing either gap forces deleting its line.

Checks run

• nix build .#checks.aarch64-linux.backend-parity — passes, with earlyoom and defang-cli now listed as known gaps
• Confirmed it fails before declaring them: FAIL: 2 undeclared unit divergence(s)

Note on the stack

#398 and #399 branch off the pre-fix parity script. #399 edits the same region (it deletes fail2ban from UNITS_KNOWN_GAPS and adds UNIT_ALIASES), so whichever merges second wants a trivial rebase — I own both and will do it.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 990ef79e-1af5-423e-96fc-fc2851e9743a

📥 Commits

Reviewing files that changed from the base of the PR and between 8066b1f and 870f0ae.

📒 Files selected for processing (1)

• scripts/check_backend_parity.py

Included review availability: Your plan provides up to 10 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

The backend parity checker now includes deduplicated unit snapshots, validates the duplicates directory, recognizes two known unit divergences, and compares native units with a reconstructed module unit set.

Changes

Backend parity validation

Layer / File(s)	Summary
Parity inputs and known divergences scripts/check_backend_parity.py	The checker includes the DUPLICATES directory, requires it to exist, and records divergences for earlyoom.service and agent-box-defang-cli.service.
Module unit reconstruction and comparison scripts/check_backend_parity.py	module_unit_names() combines direct and deduplicated unit snapshots. unit_families() accepts path objects and string names. Parity comparison uses the reconstructed unit set.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 870f0

This change makes the parity check account for deduplicated units and records the newly visible known gaps; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: lionello

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the primary change: reading the DUPLICATES fixture to account for deduplicated units in parity checks.
Description check	✅ Passed	The description directly explains the deduplication bug, the reconstructed unit set, the two newly detected gaps, and the validation performed.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/394-parity-dedup-blindspot

---

_{Comment @coderabbitai help to get the list of available commands.}