Reproduce the real build
Two incidents, one shape: the environment that proved the change was not the environment
that ships it. A test using ESM-only syntax passed under the test runner and failed the
CommonJS production tsc, blocking the deploy. A build-toolchain upgrade left the lockfile
behind and kept working for two months only because both machines' node_modules had
drifted ahead of it — the first clean reinstall broke everything.
The rules
- Run the exact production build command locally before pushing anything the pipeline compiles — not just the test suite. The test runner tolerates what the release build rejects.
- Prove toolchain fixes from the tracked manifests alone:
npm ciinto a clean directory (nevernpm install, which mutates the lockfile and hides drift). A fix proven only on the machine that produced it has not been proven — that machine'snode_modulesis part of the experiment. - The lockfile describes what ships. If the build only works because installed
dependencies drifted ahead of it, the lockfile is silently wrong and the next
npm ciis the outage.
Why
Build environments drift invisibly toward working, and the drift is per-machine; only a manifest-only reconstruction tests what CI and the next machine will actually see. Evidence: ASH CLAUDE.md Railway/Docker tsc lesson (2026-05-20); ASH LESSONS_LEARNED 2026-07-19.