diff-build: read the impacted set from a file, and fail when the query does

[aaylward]

With a few hundred impacted targets the inlined set(...) exceeded the per-argument limit, bazel query died with "Argument list too long", and the || true meant for an empty grep swallowed it — the job ran zero tests and exited 0 (#1550's build-and-test did exactly this at 533 targets). The two queries now go through --query_file and the build/test invocations through --target_pattern_file; a query bazel refuses fails the job. Covered in scripts/test-diff-build with a fake bazel and 600 long labels.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	1d4-web	88a32d6	Commit Preview URL Branch Preview URL	Sep 14 2026, 05:31 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	iili	88a32d6	Commit Preview URL Branch Preview URL	Sep 14 2026, 05:31 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	ast-lol	88a32d6	Commit Preview URL Branch Preview URL	Sep 14 2026, 05:32 PM

[cursor]

Review panel

Four read-only agents, four lenses (correctness/control flow; shell/resource safety; tests/docs/CI; altitude). Each hunted then tried to refute. Aggregation re-checked survivors against HEAD 88a32d62. CI on that commit: required checks green except sanitize (asan) still pending; test-deploy ran scripts/test-diff-build to all diff-build checks passed (including “the builds query over this set exceeds the per-argument limit”); build-and-test took the new path at N=7 and ran its one impacted test.

Headline: land as-is. This is the right altitude for the #1550 false-green — file-fed query/build/test and fail-loud — and the harness actually kills both halves of that bug. No surviving findings.

Verified clean

• Fail-loud. run_impact_query returns bazel’s status before the grep … || true; under set -e a refused query stops build_and_test_impacted with nothing else on PATH. Pinned: “a query bazel refused is a failure, not an empty set” / “a refused query stops the run” / “and nothing runs after it”.
• File feed. Queries via --query_file, build/test via --target_pattern_file; fake bazel asserts no //domains on argv. Builds query over the 600-label fixture is >131072 bytes (Linux MAX_ARG_STRLEN); the property under test is expression size, not label count — same ceiling CI hit at 533.
• Templates preserved. IMPACT_TESTS_QUERY / IMPACT_BUILDS_QUERY match the old inline kind/except/manual/__internal__ shape (3× / 4× set(); empty set() stays a valid empty set, so “no first-party labels” still exits 0 without build/test.
• --config=ci pin moved with the code. deploy_config_test now substring-checks the lib; full-build path in diff-build still pinned. Without the lib pin, impacted postgres suites could lose --config=ci while the test stayed green on the //... line.
• CI gate. test-diff-build runs in the test-deploy job (WA row matches); local and CI both green on the new cases.
• Altitude. Fail-loud alone would make Refuse a blank owner, and assemble the claim where the owner lives #1550 honest-red, not runnable; shrinking fan-out alone would not close “query failure → green”. Extracting build_and_test_impacted earns its keep so the harness drives what CI runs. WA rename is one accurate row.

Soft notes (not blockers; fold or ignore)

1. Thin wrapper unpinned. The harness sources the lib and calls build_and_test_impacted; it never runs scripts/diff-build’s impacted path. Restoring the old inlined set($TARGET_SET) + grep … || true body in diff-build alone would leave the suite green. Acceptable today — the wrapper is two lines and almost all logic lives in the lib — but “wiring” in the commit/WA is slightly overclaimed. A one-shot that asserts diff-build sources the lib / calls the function would close it.
2. scripts/impacted-services still inlines set($TARGET_SET) (and set($IMAGES) for cquery). Same ARG_MAX class, out of this PR’s surface; at Refuse a blank owner, and assemble the claim where the owner lives #1550’s 533×80B it stays under 128KiB and already fails closed (unknown), not silent-green. Follow-up if impact sets keep growing.
3. Why Refuse a blank owner, and assemble the claim where the owner lives #1550 fan-out was 533 for a narrow diff is unexplained. Orthogonal; this PR correctly hardens the pipe rather than chasing the graph. Worth a separate look sometime — after this lands, a rebase of that shape will actually build/test the set.

No inline comments. Approve from here once asan finishes (or retries past rust-redist, same class as #1550).

---

Review panel via Cursor

[cursor]

CI update on 88a32d62: all 24 checks green, including asan. Nothing further from the panel.