Bootstrap keeps yarn and node only at their pinned versions (closes #154)

script/bootstrap kept any yarn found on PATH, so YARN_VERSION applied
only where none was installed. It now keeps the yarn on PATH only when
yarn --version is exactly YARN_VERSION, and otherwise installs that
version as before. The node on PATH is used only when it has the
pinned major version, as REPO_POLICIES.md asks, and is at least
NODE_MIN_VERSION. After installing either, bootstrap looks the tool up
through PATH again, stops, naming the path, if that one fails the same
check, and prints the version it uses, as it does for Go. Every host
script except bootstrap that runs yarn now runs it through the new
script/yarn, which uses the first node on PATH, with ~/.local/bin
first, when it passes the same test, and otherwise the pinned node in
nvm.

Model: opus-5-5

README.md

@@ -42,12 +42,12 @@ either one is broken. We provide:
 
 - `script/bootstrap` — install all dependencies (the pinned node via nvm unless
   the `node` on `PATH` has the pinned major version and is new enough for the
-  frontend's dependencies, yarn `YARN_VERSION` via corepack unless the `yarn` on
-  `PATH` is exactly that version, `yarn install --frozen-lockfile`, Go
-  `GO_VERSION` unless the `go` on `PATH` is exactly that version, and the Go
-  modules), linking what it installs itself into `~/.local/bin`, which has to be
-  on `PATH`. It installs no Go linter and not Docker: `make test` and
-  `make lint` run in Docker
+  frontend's dependencies, yarn `YARN_VERSION` via corepack, or npm where there
+  is no corepack, unless the `yarn` on `PATH` is exactly that version,
+  `yarn install --frozen-lockfile`, Go `GO_VERSION` unless the `go` on `PATH` is
+  exactly that version, and the Go modules), linking what it installs itself
+  into `~/.local/bin`, which has to be on `PATH`. It installs no Go linter and
+  not Docker: `make test` and `make lint` run in Docker
 - `script/setup` — make a fresh clone ready for development: bootstrap plus the
   git pre-commit hook
 - `script/dev` — run the Vite dev server, which proxies `/api` to a locally
@@ -61,10 +61,11 @@ either one is broken. We provide:
 - `script/clean` — remove what `script/build` writes
 - `script/projectname` — print the project name (used for the Docker image tag)
 - `script/yarn` — run yarn with the given arguments under the node
-  `script/bootstrap` would use: with `~/.local/bin` first on `PATH`, the `node`
-  there when it has the pinned major version and is new enough for the
-  frontend's dependencies, and otherwise the pinned node in nvm. Every other
-  script that runs yarn on the host runs it through this one
+  `script/bootstrap` would use: with `~/.local/bin` first on `PATH`, the first
+  `node` on that `PATH` when it has the pinned major version and is new enough
+  for the frontend's dependencies, and otherwise the pinned node in nvm. Every
+  script that runs yarn on the host runs it through this one, except
+  `script/bootstrap`, which picks its own node and yarn
 - `script/test` — build the `test` phase of `Dockerfile`, writing no image: the
   frontend's unit tests in its `frontend-test` stage, and the backend's Go tests
   with the race detector and coverage. The frontend's production build is left

TODO.md

@@ -22,17 +22,18 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
 # Completed Steps
 
 - 2026-10-19: `script/bootstrap` keeps the `yarn` on `PATH` only when
-  `yarn --version` is exactly `YARN_VERSION`, and otherwise prepares that
-  version through corepack, as it did when no yarn was installed
+  `yarn --version` is exactly `YARN_VERSION`, and otherwise installs that
+  version as it did when no yarn was installed
   ([#154](https://git.eeqj.de/sneak/netwatch/issues/154)); any yarn used to be
   kept. It uses the `node` on `PATH` only when that node has the major version
-  of `NODE_VERSION` as well as being at least `NODE_MIN_VERSION`, as
-  `REPO_POLICIES.md` asks; a node 24 was kept before. After installing node or
-  yarn it looks the tool up through `PATH` again and stops if that is not the
-  pinned one, as it does for Go, and it prints the node and yarn versions it
-  uses. Every script that runs yarn on the host runs it through the new
-  `script/yarn`, which puts `~/.local/bin` first on `PATH`, uses the `node`
-  there when it passes the same test, and otherwise runs yarn under the pinned
+  of `NODE_VERSION`, as `REPO_POLICIES.md` asks, and is at least
+  `NODE_MIN_VERSION`; a node 24 was kept before. After installing node or yarn
+  it looks the tool up through `PATH` again and stops if that one fails the same
+  check, as it does for Go, and it prints the node and yarn versions it uses.
+  Every script that runs yarn on the host, except `script/bootstrap`, which
+  picks its own node and yarn, runs it through the new `script/yarn`. That
+  script puts `~/.local/bin` first on `PATH`, uses the first `node` on that
+  `PATH` when it passes the same test, and otherwise runs yarn under the pinned
   node in nvm; `make build` ran yarn under whatever node was first on `PATH`
 - 2026-10-19: report file writes no longer overlap
   ([#150](https://git.eeqj.de/sneak/netwatch/issues/150)), so the reports of

script/bootstrap

@@ -7,7 +7,8 @@
 # at least NODE_MIN_VERSION; otherwise NODE_VERSION is installed via nvm
 # (installing nvm itself first, from a hash-verified release archive,
 # never curl | sh). Yarn is used directly only if it is exactly
-# YARN_VERSION; otherwise that version is prepared through corepack.
+# YARN_VERSION; otherwise that version is prepared through corepack,
+# or installed with npm where there is no corepack.
 # Go, with its gofmt, is used directly only if it is exactly GO_VERSION;
 # otherwise that release is installed from its hash-verified archive.
 #
@@ -145,12 +146,10 @@ ensure_nvm() {
 }
 
 # node_ok: the node on PATH has the major version of NODE_VERSION and is
-# at least NODE_MIN_VERSION. Only the major is compared with the pin:
-# the Dockerfile's node stages start from a node 22 alpine image whose
-# exact version is not the pin, and nvm cannot install a prebuilt node
-# on alpine. node itself compares the versions: major, then minor, then
-# patch. A node that fails does not pass. script/bootstrap and
-# script/yarn carry this function unchanged.
+# at least NODE_MIN_VERSION. Only the major is compared with the pin,
+# as REPO_POLICIES.md asks. node itself compares the versions: major,
+# then minor, then patch. A node that fails does not pass.
+# script/bootstrap and script/yarn carry this function unchanged.
 node_ok() {
     if ! command -v node >/dev/null 2>&1; then return 1; fi
     node -e '

script/yarn

@@ -1,7 +1,8 @@
 #!/bin/sh
 # script/yarn: run yarn with the given arguments under the node
-# script/bootstrap would use. Every other script that runs yarn on the
-# host runs it through this one.
+# script/bootstrap would use. Every script that runs yarn on the host
+# runs it through this one, except script/bootstrap, which picks its
+# own node and yarn.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -11,12 +12,10 @@ NODE_VERSION="22.17.0"
 NODE_MIN_VERSION="22.13.0"
 
 # node_ok: the node on PATH has the major version of NODE_VERSION and is
-# at least NODE_MIN_VERSION. Only the major is compared with the pin:
-# the Dockerfile's node stages start from a node 22 alpine image whose
-# exact version is not the pin, and nvm cannot install a prebuilt node
-# on alpine. node itself compares the versions: major, then minor, then
-# patch. A node that fails does not pass. script/bootstrap and
-# script/yarn carry this function unchanged.
+# at least NODE_MIN_VERSION. Only the major is compared with the pin,
+# as REPO_POLICIES.md asks. node itself compares the versions: major,
+# then minor, then patch. A node that fails does not pass.
+# script/bootstrap and script/yarn carry this function unchanged.
 node_ok() {
     if ! command -v node >/dev/null 2>&1; then return 1; fi
     node -e '