#4262 update-system.mjs apply reports success while leaving the install unrunnable (1.10.0 to 1.33.0): installs scripts whose imports it never fetches

Summary

node update-system.mjs apply from v1.10.0 to v1.33.0 reported success while leaving the installation unable to run a single command. It installed scripts that import modules it never fetched.

What it printed

Backup branch created: backup-pre-update-1.10.0-<ts>
Fetching latest from upstream...
Updating system files...
error: pathspec 'test-salary-filter.mjs' did not match any file(s) known to git
error: pathspec '.gemini/commands/' did not match any file(s) known to git

Update complete: v1.10.0 → v1.33.0
Updated 103 system paths.

Two error: lines, then "Update complete". Exit status was success.

What actually happened

Every core command died, one missing module at a time:

node doctor.mjs --json
Error [ERR_MODULE_NOT_FOUND]: Cannot find module '.../plugins/_engine.mjs'
  imported from .../doctor.mjs

Restoring plugins/ surfaced the next one, path-resolver.mjs. Restoring that surfaced tracker-aliases.json, via a thrown error in tracker-parse.mjs. doctor.mjs, verify-pipeline.mjs, merge-tracker.mjs and analyze-patterns.mjs were all unusable.

update-system.mjs had installed the v1.33.0 versions of those scripts without the modules they import.

Repair

node update-system.mjs apply a second time does not help, since the path list is what is incomplete. What worked was restoring from the already-fetched tree, excluding the user layer:

git ls-tree -r --name-only FETCH_HEAD > /tmp/upstream.txt
# restore every upstream file missing locally, skipping
# data/ reports/ output/ interview-prep/ jds/ cv.md cv-fr.md
# article-digest.md portals.yml config/profile.yml modes/_profile.md

That restored 933 files. Everything passed afterwards.

The repo already knows

node validate-system-paths-coverage.mjs fails on exactly this class of gap:

Coverage gap — tracked files not in SYSTEM_PATHS or USER_PATHS:
  test-salary-filter.mjs

and test-all.mjs reports two more paths missing from the manifest:

❌ offer-prep missing from data contract / gitignore / SYSTEM_PATHS
❌ intake missing from data contract / gitignore / update-system paths / AGENTS.md

So the manifest is known to be incomplete, but nothing gates a release on it and nothing verifies the result of an apply.

Suggestions

Make validate-system-paths-coverage.mjs blocking in CI. It already detects the root cause.
Fail the apply on a non-zero git checkout. Right now two error: pathspec lines still produce "Update complete" and a success exit code.
Verify after applying, for example resolve the relative imports of every installed .mjs and report any that do not exist, before declaring success.
Consider syncing the whole tracked tree minus USER_PATHS, rather than an allowlist that has to be maintained by hand for every new module.

Note for anyone hitting this

The rollback branch the updater creates does work: node update-system.mjs rollback. User data was untouched throughout, and the layer separation held up correctly.