[abrichr]

Summary

This is PR 1 of the decomposition plan (packages/flow/docs/design/DECOMPOSITION.md, section 4.3). It adds the safety net that every later move is checked against. It changes no production code.

• Size ratchet. scripts/check_file_size_ratchet.py runs in Python CI through tests/test_file_size_ratchet.py. It fails when a listed file grows past its budget in the plan's table. A PR that adds net lines raises the budget in its own diff, with a one-line reason. The table and section 6 came from docs(flow): decomposition plan for the largest files #1497. This PR adds the script and the test; there is only one ratchet.
• Moved-code verifier. scripts/verify_moved_code.py checks that a move commit only relocates code. Every function, method and statement in the base must exist with an identical AST in the head. New code may only be imports, re-exports and protocol stubs. It also lists test patches that a move would make stale.
• Import surface. packages/flow/tests/test_import_surface.py pins the names that replayer, __main__, qualification and ir provide. It also pins the 276 methods of Replayer.
• Golden runs. packages/flow/tests/golden_runs/ runs nine scenarios with the real Replayer and PlaywrightBackend against MockMed. Each run's normalized report, file hashes, backend action trace and live app state must match the baseline.
• Coverage. The non-gating flow-coverage job combines the unit shards' coverage data and reports safety-path coverage in the job summary.

This round

• Merged with main. The one conflict was in packages.yml. Main's xdist shards, fast lane and single critical e2e run are kept. The golden-runs step and the coverage job are added on top.
• Linux baselines regenerated. The old baselines dated from October 24, so they were deleted. A temporary commit turned on write mode. A workflow_dispatch Packages run (41704998213) then recompiled the MockMed bundle and wrote all nine baselines on Linux with Playwright 1.61.0. Write mode runs each scenario twice and refuses results that differ; all nine matched. The baselines were copied unchanged from the flow-golden-runs artifact, and the temporary commit was reverted. Two later runs in compare mode reproduced all nine: 41715793206 and 41733145873, the second at the current head. No baseline was edited by hand.
• Budgets at main's sizes. The table now holds each file's line count on current main. replayer.py is at 19,303 lines. Main keeps changing these files, so re-run python scripts/check_file_size_ratchet.py just before merging and update any number it reports.
• Import pins. The snapshot was regenerated. It now pins 276 Replayer methods, up from 260. No name was removed.
• Coverage on nightly and dispatch runs only. Collecting coverage slows the unit suite by about a third. With coverage in every shard, a full-lane shard hit its 40-minute limit at 99%. Pull requests and main's post-merge runs now collect no coverage, so they take no longer than before. Scheduled and dispatched runs collect it, with a 60-minute limit. In run 41733145873 the shards took 45 and 44 minutes.
• Safety-path coverage is 86.11% (run 41733145873). The job still does not gate.
• Hashed coverage install. flow-coverage installs coverage 7.15.1 from a new coverage group in .github/ci-tools/uv.lock, with hashes. That is the version packages/flow/uv.lock pins. The earlier unhashed pip install failed tests/test_ci_locked_installs.py.
• Public artifact inventory. packages/flow/public-artifacts.json now lists the baseline files.

Merge with main, round 2 (head 5daa5b9)

• Merged main again (13 commits). The only conflict was in packages.yml, in the flow-unit job. Main now picks shard files with scripts/ci/flow_shards.py and runs -n logical. The merge keeps both, plus this PR's golden-runs exclusion from the shard list, the COVERAGE_* env, the upload step and the flow-coverage job. actionlint passes.
• Budgets raised to main's sizes. Three files grew on main after the last round: replayer.py by 5 lines (to 19,529), __main__.py by 320 (to 13,235) and playwright_backend.py by 83 (to 5,282). This PR leaves all three unchanged from main. The other seven budgets already matched.
• Import pins regenerated with OPENADAPT_WRITE_IMPORT_SURFACE=1. _refuse_rollback_durable is dropped from the __main__ pins because Rollback on durable runs, and after a crash (#1699) #1772 removed it on main and nothing references it any more. The five names Rollback on durable runs, and after a crash (#1699) #1772 added are now pinned.
• Golden baselines not regenerated. Nothing in this merge changes the MockMed bundle or replay output on purpose, and the scenarios skip on macOS because the baselines were recorded on Linux. The golden-runs step at this head will show whether they still match. If they don't, they need the write-mode cycle, not hand edits.
• Desktop failure. At the previous head, src/screens/Stops.test.tsx failed in the Desktop frontend job ("answers the current stop with one key"). This PR doesn't touch packages/desktop. The same timing flake is what desktop: prepare review card input before paint #1825 fixes.

Tested at this head: python scripts/check_file_size_ratchet.py passes; root pytest tests gives 805 passed, 14 skipped; flow tests/test_import_surface.py gives 6 passed and tests/golden_runs gives 5 passed, 9 skipped (the Linux-only scenarios); ruff passes on the golden-runs tests.

Notes for review

• generate/verify_contract.py (4,157 lines) is now larger than terminal_verification_v2.py (3,663), which is in the table. The table keeps the ten files from docs(flow): decomposition plan for the largest files #1497. Swapping one in is a separate choice.
• In run 41733145873, src/screens/NeedsYou.test.tsx failed in the Desktop frontend job. This PR does not touch packages/desktop, so the failure is outside it.

Test plan

• pytest tests/test_file_size_ratchet.py tests/test_verify_moved_code.py (13 passed)
• Workflow tests: test_ci_locked_installs, test_ci_required_check, test_nightly, test_packages_concurrency, test_newest_green (52 passed)
• CI wrote the Linux baselines in write mode, each scenario twice with identical results (run 41704998213)
• CI reproduced them in compare mode (runs 41715793206 and 41733145873)
• Flow lint, both unit shards, critical and agent frameworks passed (run 41733145873)
• Python CI passed (run 41733150538)