experiment: fold check-stable into moc --stable-baseline

[Kamirus]

Why

Evaluate moc 1.11.2-stable-baseline-check-compat / motoko#6253 (LANG-1348) against real mops flows before wiring it for real. That prerelease folds typecheck + upgrade-compat into one moc --check --stable-baseline <deployed.most> (also escalates forgotten EM fields to M0267).

Exact pin only — other moc versions keep the classic 3-step path. moc --stable-baseline requires --enhanced-migration, so non-EM canisters stay on generate + --stable-compatible even on this pin.

Before / After

# before (mops check on an EM canister with [check-stable])
moc --check --enhanced-migration=… actor.mo
moc --stable-types -o .mops/.check-stable/new.wasm actor.mo …
moc --stable-compatible deployed.most .mops/.check-stable/new.most

# after (toolchain moc == 1.11.2-stable-baseline-check-compat)
moc --check --all-libs --stable-baseline deployed.most \
  --enhanced-migration=… actor.mo

Diagnostic change already visible in migrate snapshots — forgotten initial field:

# before
migrations/…_Init.mo:0.1: warning [M0254], initial actor requires field `id` …

# after
src/main.mo:4.7-4.9: type error [M0267], initial actor requires field `id` …
  … not found in the previous version — write a migration that produces it
src/main.mo:3.1-11.2: Compatibility error [M0169], …

Compat errors also gain a real locus (src/main.mo:…) instead of (unknown location).

What is unchanged

• Non-EM / .mo baselines: classic path
• Any moc version other than this exact tag
• --stable-compatible still available to moc; mops just doesn't call it on the experimental pin for EM+.most

Follow-up worth flagging

• moc still notes unexplained fields can emit both M0267 and M0169/M0263 — decide which to keep once this graduates
• Standalone mops check-stable typechecks as a side effect of moc --check on this pin (not a deliberate product change)
• Broader fixture pins (including non-EM) are intentional for this experiment so we see the binary across coverage; trim before any non-draft merge

[github-actions]

Cursor AI review

👍 APPROVE — looks safe to merge

I've reviewed the full diff against the base SHA. This is an explicitly experimental PR that folds check-stable into a single moc --check --stable-baseline invocation, gated behind an exact prerelease moc version pin. Let me confirm my read of the production-path impact before finalizing.

The critical safety property: all new fold logic is gated by supportsStableBaselineCheck() in cli/helpers/get-moc-version.ts, which returns true only when the toolchain moc equals exactly 1.11.2-stable-baseline-check-compat. On any real/normal moc version foldStableBaseline/foldedBaseline are false, so mocArgs, stdio: "inherit", autofix args, and the classic runStableCheck path are byte-for-byte unchanged from base. No apiVersion/API_VERSION, backend, registry, or frontend surface is touched.

Category	Assessment	Details
Summary	✅	Experimentally folds check/check-stable for enhanced-migration canisters into one moc --check --stable-baseline call, gated behind an exact prerelease moc pin; classic 3-step path preserved for all other versions.
Code Quality	✅	Extracts shared reportStableCheckOutcome, reusing existing check-limit helpers; DRY and no speculative surface beyond the experiment.
Consistency	⚠️	Changelog + SKILL updated, but docs/docs/cli/check.md / check-stable.md were not; acceptable for an experiment gated behind a prerelease pin.
Security	✅	No auth, identity, package-integrity, or secret-handling changes.
Tests	⚠️	Adds a meaningful single-invocation test; broad fixture re-pinning to the experimental moc (incl. non-EM/migrate fixtures) shifts some coverage off the classic path, but classic coverage remains in check-stable.test.ts and the author flags trimming before non-draft merge.
Maintainability	⚠️	Experiment-only code tied to one exact prerelease tag; clearly labeled and self-contained, cleanup acknowledged in the PR body.

Verdict

Decision: APPROVE
Risk: Low
Reason: Production CLI behavior on all real moc versions is unchanged since the new fold path is gated behind an exact prerelease pin, and the classic path/args are preserved verbatim; remaining concerns (docs, experimental fixture pins) are non-blocking and explicitly scoped as an experiment.

---

Generated for commit f3a2417