docs(testing): the yarn install row is held by the age gate, not a missing time

Suleimi Ahmedrequested to merge
sahmed/e2e-yarn-age-gate-fix into sahmed/e2e-caproni-authz

The install-yarn limitation and the row's own cell both said the rendered packument carries no time, and named that as what yarn quarantines on. The registry serves it.

versionTimes.fullTail (internal/format/npm/packument_time.go) renders the time object, and documentStream.terminate (internal/format/npm/packument_render.go) appends it to the full document. It landed in cba72ed18, "fix(npm): serve packument publish timestamps so yarn can install", which is on main and an ancestor of this branch.

Why the check missed it

The claim was checked against packumentHeaders and the fullVersionFields allow-list. Both are innocent, because time is a document-level key rather than a per-version field:

full packument
├─ head      _id, name, dist-tags, _rev   ← packumentHeaders      checked, correctly finds no time
├─ versions
│   └─ per-version fields                 ← fullVersionFields     checked, correctly finds no time
└─ tail      "time": {created, modified,  ← packument_time.go     never opened
              <version>: <stamp>, …}

A per-version allow-list is the wrong place to look for it, so finding it absent there proved nothing. The tail is a third site, and documentStream.terminate's own comment names it six lines from where the check looked.

What this MR changes

  • Retitles the entry. The old heading asserted the false part, so it could not survive the correction.
  • Drops #1071 (closed) as the lifting change. It closed workflow::complete on the day the fix landed, and both documents postdate that.
  • Keeps what held, which is the half the entry had already conceded was sufficient: yarn refuses a version published inside npmMinimalAgeGate, one day by default, and a run measured in minutes never clears it. The entry is retitled to that constraint.
  • Says what a quarantine message means, since yarn names no cause and a missing time is the first thing a reader will suspect.
  • Names the real remaining blockers in Lifted by: yarn.Client exposes no install verb, and something has to give between yarn's gate and the row's own no-relaxation clause. Both are harness or decision, not registry.
  • Corrects the cell at npm.md:182 the same way. That cell is what an author reads first, and it repeated the stale cause and cited the closed item.

One addition

The cell warns that a lockfileVersion below 10 disables the gate and so hides the failure. yarn.EnsureLockFile writes an empty lockfile, carrying no lockfileVersion at all. Which side of 10 that falls on is not establishable from this repository, so the entry states the fact and hands the question to the row's author rather than asserting either answer. Without it a green run could be green for the wrong reason.

Verification

Gate Result
e2e-catalog generate -check exit 0
e2e-catalog check disagreements 0; 211 scenarios / 185 automatable / 154 covered, all unchanged
vale 0 errors
markdownlint-cli2@0.23.2 0 issues
lychee --offline --include-fragments 0 errors
no #1071 or "no time" left in docs/testing/ confirmed
every line in the edited range within 80 columns confirmed

Documentation only. e2e.npm.consume.install-yarn keeps critical, automatable, not started; no test is added or removed.

Merge request reports