fix(update-system): keep an upstream negation ahead of newly appended rules

tests/gitignore-reconcile.test.mjs

@@ -131,6 +131,45 @@ const ok = (cond, msg) => (cond ? pass(msg) : fail(msg));
   eq(reconcileGitignore(text, 'cv.md\n').added.length, 0, 'and is idempotent from there');
 }
 
+// ── An upstream negation keeps the precedence upstream gave it ──────────────
+// Upstream orders its own negations deliberately: `!test-fixtures/**` sits AFTER
+// `applications.md` so it wins. An install that already had the negation but not the
+// newer pattern skipped the negation as present and got the pattern appended after it,
+// which inverted upstream's intent and re-ignored files upstream's own suite requires to
+// be committed (#4127). The user's line is still never touched; the negation is repeated,
+// which git treats as a no-op.
+{
+  const local = ['node_modules/', '!test-fixtures/**', '*.log'].join('\n') + '\n';
+  const upstream = ['node_modules/', 'applications.md', 'follow-ups.md', '!test-fixtures/**'].join('\n') + '\n';
+  const { text, added } = reconcileGitignore(local, upstream);
+  const lines = text.split('\n').map((l) => l.trim());
+
+  eq(added.join(','), 'applications.md,follow-ups.md', 'the two newer rules are appended');
+  const lastNegation = lines.lastIndexOf('!test-fixtures/**');
+  ok(lastNegation > lines.lastIndexOf('applications.md'), 'the negation ends up after applications.md');
+  ok(lastNegation > lines.lastIndexOf('follow-ups.md'), 'and after follow-ups.md');
+  // The promise this function makes is that it never rewrites a local line.
+  ok(text.startsWith(local), "the user's own file is still a verbatim prefix of the result");
+  eq(lines.indexOf('!test-fixtures/**'), 1, 'and their copy of the negation stays where they put it');
+
+  const second = reconcileGitignore(text, upstream);
+  eq(second.added.length, 0, 'reconciling again adds nothing');
+  eq(second.text, text, 'and is byte-identical, so an update does not rewrite the file forever');
+}
+
+// ── A negation upstream puts BEFORE the new rules is not re-appended ─────────
+// Precedence cuts both ways: repeating a negation upstream deliberately placed first
+// would hand it a win upstream never gave it.
+{
+  const local = ['!keep/**', 'node_modules/'].join('\n') + '\n';
+  const upstream = ['!keep/**', 'node_modules/', 'keep/secret.md'].join('\n') + '\n';
+  const { text, added } = reconcileGitignore(local, upstream);
+  const lines = text.split('\n').map((l) => l.trim());
+
+  eq(added.join(','), 'keep/secret.md', 'the new rule is appended');
+  eq(lines.filter((l) => l === '!keep/**').length, 1, 'the earlier negation is not repeated');
+}
+
 // ── The shipped .gitignore is self-consistent ────────────────────────────────
 // Reconciling the real file against itself must be a no-op. If it is not, the
 // reconciler would rewrite .gitignore on every single update forever.

update-system.mjs

@@ -2007,12 +2007,18 @@ export function reconcileGitignore(localText, upstreamText) {
   // pattern (only comments start with '#'), so membership answers both "does
   // this install already have this rule?" and "has this rationale block already
   // been copied by an earlier update?" with no second structure to keep in sync.
-  const seen = new Set(localText.split(/\r?\n/).map((l) => l.trim()).filter((l) => l !== ''));
+  const localLines = new Set(localText.split(/\r?\n/).map((l) => l.trim()).filter((l) => l !== ''));
+  const seen = new Set(localLines);
 
+  const upstreamLines = upstreamText.split(/\r?\n/);
   const block = [];
   const added = [];
+  // Where the FIRST newly appended pattern sits in upstream's own file. Upstream orders
+  // its negations against its patterns deliberately, and only a negation it places after
+  // one of these needs its position restored below.
+  let firstAddedIndex = -1;
   let pendingComments = [];
-  for (const raw of upstreamText.split(/\r?\n/)) {
+  for (const [index, raw] of upstreamLines.entries()) {
     const line = raw.trim();
     if (line === '') { pendingComments = []; continue; }
     if (line.startsWith('#')) { pendingComments.push([raw, line]); continue; }
@@ -2030,12 +2036,30 @@ export function reconcileGitignore(localText, upstreamText) {
     // corrupted by writing back the trimmed form used for matching.
     block.push(raw);
     added.push(line);
+    if (firstAddedIndex === -1) firstAddedIndex = index;
     // Guard against an upstream file that lists the same pattern twice.
     seen.add(line);
   }
 
   if (added.length === 0) return { text: localText, added };
 
+  // Restore the precedence upstream gave its own negations. `!test-fixtures/**` sits
+  // AFTER `applications.md` in upstream's .gitignore so that it wins; an install that
+  // already had the negation but not the newer pattern skipped the negation as present
+  // and got the pattern appended after it, which inverted that and re-ignored files
+  // upstream's own suite requires to be committed (#4127).
+  //
+  // Only a negation the local file ALREADY has needs this: one it lacks was appended by
+  // the loop above, in upstream's own order. Repeating a line is not the same as
+  // rewriting one, so the promise never to modify a local line still holds, and a
+  // duplicate negation is a no-op to git.
+  for (const [index, raw] of upstreamLines.entries()) {
+    if (index <= firstAddedIndex) continue;
+    const line = raw.trim();
+    if (!line.startsWith('!') || !localLines.has(line)) continue;
+    block.push(raw);
+  }
+
   // Match the local file's dominant line ending. A checkout on Windows under
   // `core.autocrlf=true` leaves CRLF on disk, and appending LF-only lines to it
   // makes `git diff` show the whole file as changed.