docs(testing): record the two real-AWS verify.sh traps as repo rules, not memory

[go-to-k]

Summary

Two real-AWS traps surfaced while integ-verifying #1383 and #1384. I initially
recorded them only as machine-local memory files, which was the wrong call —
~/.claude/projects/.../memory/ does not follow the user to another terminal
and is invisible to every other contributor, so a fixture-authoring rule
belongs in a git-tracked artifact. This moves them to
.claude/rules/testing.md (the mandatory-conventions section, alongside the
signal-trap / gone-probe / CLI-flag / version-literal rules) with the
user-facing writeups in docs/testing.md. The two memory files are reduced to
pointers.

The two traps

1. AWS-CLI-CUSTOMIZED commands hang non-interactively. Some aws
subcommands are interactive wrappers rather than API pass-throughs. In a
non-interactive shell — which is every verify.sh run — they print
Warning: Input is not a terminal (fd=0). then die with
aws: [ERROR]: [Errno 22] Invalid argument, and without a </dev/null they
HANG. Verified on aws emr list-instance-groups; --no-paginate --no-cli-pager </dev/null does not help. The rule gives the probe procedure
(bogus id + hard timeout) and the node --input-type=module -e SDK
replacement, including the two load-bearing details a naive copy would drop:
|| return 1 so an SDK failure reaches the caller's set -e instead of an
empty result silently satisfying a // empty-defaulted jq assertion, and a
pagination loop matching whatever the provider under test does.

2. List readbacks must be order-insensitive. AWS does not preserve the
submitted order of list-valued members, so an assertion that string-compares a
joined list against the submitted order is flaky — and because it fails on a
correct implementation, its message accuses the fix. The first live run of
the #1384 fixture reported "issue #1384 NOT closed" while the fix was working
perfectly. Sort both sides; the caveat about genuinely order-significant lists
mirrors the existing getDriftUnorderedPaths judgment call.

Test plan

Docs-only (.claude/rules/** + docs/**), no src/ or tests/ change, so
there is nothing to unit-test or live-test. What I did instead was verify every
factual claim against the merged code rather than against my own recollection:

• the reference helper in the rule is the one actually merged in
  tests/integration/emr-cluster/verify.sh (pagination loop + || return 1
  both present)
• sort(...) is present in the merged
  tests/integration/lambda-esm-self-managed-kafka/verify.sh query
• src/analyzer/drift-normalize.ts really does canonicalize on both comparison
  sides, so the "integ-side twin" framing is accurate
• the Errno 22 behavior was reproduced live in this session, including with
  --no-paginate --no-cli-pager </dev/null

One claim did not survive that check and was corrected before pushing: I had
written export AWS_PAGER="" as if it were a tree-wide invariant, but only
emr-instance-configs sets it. It is now stated as a recommendation for new
and affected fixtures, so the rule does not describe a violation that most of
the tree would immediately be in.

vp run check clean, vp run format:check clean.

Deferred

Trap 1 is arguably mechanically detectable — a lint could ban the known
CLI-customized verbs in tests/integration/*/verify.sh, which would put it on
the strongest rung of the durable-rules ladder rather than the second. I did
not build it here: the repo's checker rules require a real-code fail probe plus
per-shape coverage floors, and the calibration set today is a single command
family (aws emr). Filed as (#1402) so the option stays visible instead of
being silently dropped.

[github-actions]

🎉 This PR is included in version 0.278.6 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀