buildcheck: check every patch hunk's header against its body; share the java-tdd-guide pointer file (4-repo sync)

[bernardladenthin]

Two commits, bundled on the one branch to save a CI run.

Summary

1. check-patches.py: every hunk's header against its body, as text (this repository only)

• The guard URGENT: fix the hunk line count that truncated prefetch.h — main is red in 23 jobs #492 asked for. git apply --check validates that a hunk applies, not that its header counts match its body: it reads the declared number of lines and skips whatever follows as the start of the next header. A new-file hunk with more + lines than its header says therefore applies "cleanly" and writes a truncated file -- which is exactly what Follow-up to #488: allow any UCRT forwarder by prefix, name the two CRT exceptions #489 shipped (two comment lines added inside 0017's prefetch.h without recounting; prefetch.h cut off inside its one function; run 37922404867 red in 24 jobs; corrected by URGENT: fix the hunk line count that truncated prefetch.h — main is red in 23 jobs #492). Checking that a patch applies is not checking that it applies correctly.
• buildcheck/patches.py + check-patches.py audit every hunk of llama/patches/*.patch as text and report two shapes, each naming the patch, the line and the target file: a body that ends before the header's counts are satisfied (a header claiming too much, or a cut patch -- git apply rejects this one as corrupt, so it is caught earlier), and lines left over after a satisfied hunk (the Follow-up to #488: allow any UCRT forwarder by prefix, name the two CRT exceptions #489 shape, which git apply accepts and truncates). The no newline marker, the next file's header, the format-patch trailer and the prose this project puts before the first diff --git are all handled. An empty patch directory is a failure, never a pass.
• Wired into the code-style job right after the natives check: milliseconds, no llama.cpp source, first minutes of every run. Documented in the CLAUDE.md build-checks table and in the patches section; one CHANGELOG line under Changed.
• This repository's own module, not a shared file, and that is a decision, not an omission: none of BitcoinAddressFinder, srcmorph or streambuffer carries a patches/ directory, so sharing it would add a manifest line to three repositories for a check with nothing to check.

2. .claude/skills/java-tdd-guide/SKILL.pointer.md, shared across the four repositories

• The cross-repo audit done alongside (every same-path file and every publish.yml job of the four main branches, compared byte for byte and up to the repository name) found no identical file or job that is not already in .github/shared-files.sha256 -- the remaining same-path files (SECURITY.md, CONTRIBUTING.md, .gitignore, docs/RELEASE.md, release-gate-exemptions.txt) differ in substance, not just in the repository name -- but one inconsistency: workspace/CLAUDE.md says every sibling repository carries the TDD-skill pointer file, and only BitcoinAddressFinder and streambuffer had it, in two slightly different copies.
• Now one byte-identical file in all four repositories (streambuffer's content, which names no repository), listed in every manifest so the shared-files job keeps it equal (hash b191c691…). Here the file is new and its path is added to REUSE.toml's markdown list; the siblings cover it through **.md. BitcoinAddressFinder loses the one paragraph that cross-referenced its own tdd skill, whose description already says the same.
• Sibling PRs: bernardladenthin/BitcoinAddressFinder#382, bernardladenthin/srcmorph#219, bernardladenthin/streambuffer#175. Until all four are merged, the shared-files job may warn about a sibling's default branch; that is the documented four-step sync, not a failure.

Test plan

• test_patches.py (9 tests): both shapes with literal patches, the modify-hunk forms, the trailer, the prose, and the exact historic text of 0017 at bc2c8af as the negative case (one problem: 2 line(s) after the hunk for ggml/src/ggml-cpu/arch/x86/prefetch.h ... (-0,+25)); buildcheck suite 112/112, the manifest test included.
• python3 .github/check-patches.py on main: 11 patches, 98 hunks, 0 problems; against a temp root holding the broken historic patch: exit 1 with the line-78 finding.
• check-run-scripts.py (151 scripts, the new step included), check-release-gate.py, check-natives.py, check-shared-files.py (54 entries, nothing changed here alone) report nothing; the four pointer copies are byte-identical.
• CI: the code-style job runs the new step; REUSE covers the new file through the list entry.

Related issues / PRs

Follow-up to #492 (its "Follow-up worth considering"); the incident is #489 → #492. Sibling PRs for the pointer file: BitcoinAddressFinder #382, srcmorph #219, streambuffer #175.

Checklist

• I have read CONTRIBUTING.md and CODE_OF_CONDUCT.md
• My commits follow Conventional Commits. They use the repository's usual imperative style instead.
• No security-sensitive changes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AytmJF9faEiQEVt6eetQS2

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud