pdd change pre-flight drift heal overwrites unrelated same-stem prompt

[Serhan-Asad]

Summary

During a live hosted pdd-issue change → sync → checkup run, pdd change Step 8.5 pre-flight drift healing overwrote an unrelated same-stem prompt before the requested change began.

The drift detector already held the authoritative prompt/code pair for hackathon_event_detail_page, but the healer invoked pdd update --sync-metadata with only the generated code path. The update command re-derived prompt identity from the leaf code stem page.tsx and frontend context, selected the unrelated existing homepage prompt, and replaced it with the hackathon event specification.

This is a generalized data-corruption risk for repositories with multiple generated files sharing leaf names such as page.tsx, layout.tsx, or config.ts.

Live evidence

• E2E issue: https://github.com/promptdriven/test_repo_3/issues/99
• Result PR: https://github.com/promptdriven/test_repo_3/pull/100
• Baseline: 53d038655df904e3a1d15a984a2def7cc7cb5423
• Initial pdd change commit: 16d5d0381589815112a9f5eb25dd1258810a2692
• Runtime PDD SHA: 6679049370fc61e6e7e62d1aee74175a830a38d7

The requested change was only for:

• prompts/frontend/app/marketplace/page_TypescriptReact.prompt

Step 8.5 detected drift for:

• basename: hackathon_event_detail_page
• authoritative prompt: prompts/hackathon_event_detail_page_TypeScriptReact.prompt
• authoritative code: frontend/src/app/hackathon/[eventId]/page.tsx

The healer ran the equivalent of:

python -m pdd update --sync-metadata frontend/src/app/hackathon/[eventId]/page.tsx

The resulting change commit unexpectedly rewrote:

• prompts/frontend/page_TypeScriptReact.prompt

That file changed wholesale from the PDD public homepage specification to a Hackathon Event Detail Page specification (84 additions / 97 deletions). The Step 9/10/11 reports listed only the marketplace prompt and architecture change, so the unrelated overwrite also escaped the workflow review.

The later pdd sync correctly saw the corrupted homepage prompt as changed, regenerated frontend/src/page.tsx, its tests/examples/metadata, and spent additional time/cost on the unrelated module. Step 8.5 itself spent approximately $3.38 healing the wrong target.

Root cause

pdd/agentic_change_orchestrator.py::_preflight_drift_heal has an authoritative DriftInfo containing both prompt_path and code_path, but passes only drift.code_path to pdd update.

The update path then calls its normal prompt/code resolver. For a code path whose leaf is a common name such as page.tsx, that re-derivation can choose another prompt in the same context instead of the authoritative prompt already discovered by drift detection.

The pre-flight healer must not discard stronger identity evidence and ask a weaker basename/context resolver to rediscover it.

Duplicate/reuse audit

• pdd sync should resolve modules by canonical path, not ambiguous short basenames #1677 / merged PR fix(sync): canonical module resolution (#1677) + carry a ResolvedSyncUnit through agentic sync (#1675) #1683 fixed canonical module identity for pdd sync and carried ResolvedSyncUnit through agentic sync. The current runtime already contains its ambiguity machinery and regression tests, but this incident still occurs because the pdd change pre-flight healer calls the separate pdd update path with only a code path.
• pdd fix from a parent dir writes orphan files to run cwd instead of the subproject #1211 and Follow-up to #1211: save_fingerprint doesn't thread project_root, e2e tests don't catch the bug #1252 cover parent-directory/project-root handling for pdd fix and fingerprint writes, not authoritative drift prompt identity being discarded.
• design: share one drift classifier across sync, update, change preflight, and CI auto-heal #884 proposes a shared drift classifier, but does not track this destructive update-target mismatch.
• Searches for pdd update wrong prompt basename collision, pre-flight drift heal wrong prompt path, and agentic change drift heal unrelated module found no exact issue or reusable PR for this call boundary.

Expected behavior

• Step 8.5 must pass or preserve the authoritative prompt identity from DriftInfo when running pdd update.
• pdd update <code-path> must fail closed when the code path can map to multiple prompt candidates; it must never silently overwrite a different existing prompt.
• A successful heal may modify only the authoritative prompt and explicitly owned metadata/artifacts.
• The change workflow must surface every pre-flight-healed path in Step 9/10/11 review scope and in the final PR summary.
• Existing unique/unambiguous update flows must remain compatible.

Acceptance criteria

• Regression fixture has two or more page.tsx modules/prompts, including an unrelated existing homepage prompt.
• Pre-flight drift healing for frontend/src/app/hackathon/[eventId]/page.tsx updates only prompts/hackathon_event_detail_page_TypeScriptReact.prompt.
• prompts/frontend/page_TypeScriptReact.prompt remains byte-identical.
• The healer threads authoritative prompt identity instead of relying on leaf-basename re-derivation.
• Direct pdd update <ambiguous-code-path> either resolves through exact architecture filepath ownership or exits non-zero with candidate choices before writing.
• Tests cover nested/path-qualified Next.js pages, a unique basename compatibility case, and no-write behavior on ambiguity.
• Step reports/final PR scope include every file mutated by pre-flight healing.
• Live replay of test_repo_3#99 produces only the marketplace prompt/module changes and no unrelated homepage cost.

Campaign constraint

This was found during an isolated pdd-issue E2E campaign. Implement the generalized fix on a topic branch and integrate only into the campaign PDD runtime branch/pin for validation. Do not merge or deploy to production/main until the full campaign completes.

[Serhan-Asad]

Campaign-only integration complete: PR #2005 merged into campaign/pdd-issue-e2e-monday as dafabb696a02a3a6fdd869df1eb90fb964e08d12 after exact-head review at 233b748130b6929018f2a93c349ee84349f4c667. Independent validation: 51 regression/preflight tests, 46 update CLI tests, 262 full agentic-change orchestrator tests, diff check, and GitHub checks green. This is not merged to production/main; keep the issue open until final live E2E replay proves the same-stem overwrite is gone.