SEP-1934: Tolerate concurrent scaffold churn in the import-boundary walk

[marcuscruz-percona]

Summary

• Make the import-boundary guards tolerate the scaffold tests' concurrent churn: every disk walk now goes through one parse helper that catches FileNotFoundError only, so a path that vanished between listing and reading is treated as "not a module to check" instead of failing the run with an error that says nothing about a real boundary violation. A decode or parse failure still raises, so the guard cannot silently narrow to whatever happens to read cleanly. No name-based skip: scaffold package names are not uniformly underscore-prefixed, the same prefix would also match app/sep/apps/__init__.py, and a name skip would leave a real module unchecked.
• Close two racy sites the ticket did not name. The orchestrator scan had its own rglob + read_text inline in the test body, now extracted into a collector on the same helper; the apps-tree coverage assert compared a fresh walk against a stale module-scoped fixture, and is now ordering-safe (narrow walk sampled first, wider walk second, non-existent paths dropped), so neither half of a scaffold test's churn can fail it.
• Give the import-time collector the same injectable-modules seam the deferred collector already had. That removes a duplicated read-and-parse loop and lets test_no_module_imports_another_app_package's rule be driven over a synthetic violating tree — previously it could only ever be asserted against a green one, so it passed vacuously.
• Tolerate the walk too, not only the read. The read-level fix alone closes the race on 3.13, where the glob machinery happens to swallow OSError while recursing, but CI runs 3.11.9 and _RecursiveWildcardSelector._iterate_directories there guards its scandir with except PermissionError alone — so a package removed after it was listed aborts the walk before any read happens. Every walk now goes through one os.walk-based collector whose onerror handler skips a directory that is gone and re-raises anything else; a directory we may not read still fails loudly. Symlinked directories stay unwalked, matching the previous behaviour.
• Test-only; the scaffolder and test_scaffold.py are unchanged, and no scheduler setting moved.

Tested

Baseline first, on the unfixed file: 10 rounds of the two racing files (5 loadscope + 5 loadfile) produced 22 FileNotFoundErrors across 9 failing rounds, hitting all four sites — including the orchestrator scan and the coverage assert.

The 3.11 window is reproduced directly: running that interpreter's algorithm verbatim under a scandir wrapper that removes the doomed directory right after the parent is listed raises FileNotFoundError: [Errno 2] No such file or directory: .../doomed, while the replacement walker completes.

Negative control: strip the tolerant read and keep the new tests, and 6 of them fail with exactly the reported FileNotFoundError; restore it and they pass. They are guarding something.

• make test (worksteal, the adopted scheduler): 11361 passed, 434 skipped, 0 FileNotFoundError
• 20 high-pressure rounds of test_import_boundary.py + apps/framework/test_scaffold.py (10 loadscope, 10 loadfile): 20/20 exit 0, 0 FileNotFoundError
• Full tests/app/sep under loadscope and again under loadfile: 6924 passed, 387 skipped each, 0 FileNotFoundError
• Focused tests/app/sep/test_import_boundary.py: 85 passed
• make lint: clean

Repeated green runs are evidence, not proof — this race is latent under worksteal rather than closed by it, which is why the fix targets the observer instead of the scheduler. The remaining consecutive-run evidence is cheap to add if a reviewer wants it.

Checklist

• New/modified functions have type hints and rST docstrings
• New tests added for new features or bug fixes
• All tests pass locally (make test)
• Pre-commit hooks pass (make run-pre-commit)
• Database migrations generated if models changed (make makemigrations) — N/A, no model change
• User-facing changes documented (README, inline help, UI text) — N/A, test-only
• Configuration changes documented with examples — N/A
• Changelog fragment added under changelog.d/ if the change is user-facing (make changelog-add), or confirmed N/A (internal-only change) — N/A, test-only

[Copilot]

🟡 Changes recommended

The rglob() traversal can still raise when a scaffold directory disappears before parsing begins.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Hardens import-boundary tests against concurrent scaffold creation and removal.

Changes:

• Centralizes tolerant module parsing.
• Adds synthetic violation and race regression tests.
• Makes coverage and orchestrator scans ordering-safe.

File summaries

File	Description
tests/app/sep/test_import_boundary.py	Adds race-tolerant collectors and regression coverage.

Review details

Suppressed comments (3)

tests/app/sep/test_import_boundary.py:504

• Use em dashes in this rendered prose instead of the two literal -- sequences.

    collector, so the rule the live-tree case asserts vacuously -- a green tree yields
    an empty list either way -- is pinned against a tree that does violate it. The

tests/app/sep/test_import_boundary.py:754

• Use an em dash here; -- is rendered as two literal hyphens in the docstring.

    real module behind it -- which is what the concurrent-scaffold failure looked like.

tests/app/sep/test_import_boundary.py:376

• Use an em dash here; -- remains two literal hyphens in rendered documentation.

        gone -- a permission failure, say.

• Files reviewed: 1/1 changed files
• Comments generated: 3
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.