fix(ci): unblock the release by fixing two flaky main failures (MUL-6890) (#7828)

* test(wecom): move the relay claim tests off a shared Redis DB index (MUL-6890)

The relay outcome tests keep their claims in Redis DB 12, which
internal/service also takes for its own suite — and both flush that DB on
entry and exit. `go test ./...` runs packages concurrently, so a flush from
one package can delete a live delivery claim held by the other, and the
publisher's outcome watch then reads an absent claim as "nobody delivered"
and counts a drop for a reply the holder had already sent.

That is the intermittent `outbound_dropped on the publisher = 1, want 0 —
it was delivered` on main. Reproduced by running internal/service's
Redis-backed tests alongside this one; fixed by giving the package an index
nothing else uses, with the current allocation written down so the next one
does not collide either.

Co-authored-by: multica-agent <[email protected]>

* build(turbo): generate fumadocs .source once instead of racing (MUL-6890)

`build` and `typecheck` both ran `fumadocs-mdx` before their real work, and
turbo is free to run those two tasks for the same package at the same time.
fumadocs-mdx regenerates `.source/` by removing the directory and writing it
back, so the two processes fight over one tree: whichever one mkdir's first
can have it deleted underneath, and its write dies on `ENOENT: no such file
or directory, open '.source/index.ts'` — the frontend-build failure on main,
which is pure timing and passes on a rerun.

Move the generation into its own `mdx` task that both depend on. It runs
once, its output is cached like any other task's, and the two consumers can
still run concurrently. Packages with no `mdx` script are unaffected: turbo
skips a dependency nobody implements, the same way `cache-inputs` already
works here.

Co-authored-by: multica-agent <[email protected]>

---------

Co-authored-by: J <[email protected]>
Co-authored-by: multica-agent <[email protected]>

apps/docs/package.json

@@ -5,10 +5,11 @@
   "type": "module",
   "scripts": {
     "dev": "next dev --port 4000",
-    "build": "fumadocs-mdx && next build",
+    "build": "next build",
     "start": "next start",
-    "typecheck": "fumadocs-mdx && tsc --noEmit",
+    "typecheck": "tsc --noEmit",
     "test": "vitest run",
+    "mdx": "fumadocs-mdx",
     "postinstall": "fumadocs-mdx"
   },
   "dependencies": {

apps/web/package.json

@@ -5,11 +5,12 @@
   "type": "module",
   "scripts": {
     "dev": "sh -c 'next dev --webpack --port \"${FRONTEND_PORT:-3000}\"'",
-    "build": "fumadocs-mdx && next build --webpack",
+    "build": "next build --webpack",
     "start": "next start",
-    "typecheck": "fumadocs-mdx && tsc --noEmit",
+    "typecheck": "tsc --noEmit",
     "lint": "eslint .",
     "test": "vitest run",
+    "mdx": "fumadocs-mdx",
     "postinstall": "fumadocs-mdx"
   },
   "dependencies": {

server/internal/integrations/wecom/relay_ordering_db_test.go

@@ -37,7 +37,15 @@ import (
 // wecomTestRedis is the same gate the rest of the repository uses for
 // Redis-backed tests: REDIS_TEST_URL, a dedicated DB index, flushed around
 // each test so one run cannot see another's claims.
-const wecomRelayTestRedisDB = 12
+//
+// The index has to be unique across PACKAGES, not just within this one. `go
+// test ./...` runs packages concurrently, every Redis-backed suite flushes its
+// own DB on entry and exit, and a flush is indiscriminate: sharing an index
+// means another package can delete a live delivery claim mid-test, and the
+// outcome watch then reports a reply that was delivered as lost. Current
+// allocation — 11 internal/auth, 12 internal/service, 13 internal/middleware,
+// 14 internal/handler, 15 here.
+const wecomRelayTestRedisDB = 15
 
 // testClaimBudget is the claim round trip these tests give the real store. It
 // sizes outcomeGrace (once per offer), so the production 2s would make the

turbo.json

@@ -21,8 +21,20 @@
     "DESKTOP_APP_SUFFIX"
   ],
   "tasks": {
+    // `fumadocs-mdx` regenerates `.source/` by removing the directory and
+    // writing it again, so two of them in the same package at once is a race:
+    // one process rm -rf's the tree the other has already mkdir'd, and the
+    // loser dies on `ENOENT .source/index.ts`. `build` and `typecheck` both
+    // needed those types and both used to shell out to it, which turbo is free
+    // to run concurrently — a red CI job on nothing but timing. One task the
+    // two depend on generates it once, and its output is cached like any
+    // other. Packages without an `mdx` script are unaffected: turbo skips a
+    // dependency no package implements.
+    "mdx": {
+      "outputs": [".source/**"]
+    },
     "build": {
-      "dependsOn": ["^build"],
+      "dependsOn": ["^build", "mdx"],
       // No explicit `inputs`: turbo's default (every git-tracked file in the
       // package) is the only safe hash source now that the cache is actually
       // restored in CI. The previous narrow glob list matched neither
@@ -41,7 +53,7 @@
       "persistent": true
     },
     "typecheck": {
-      "dependsOn": ["^typecheck"]
+      "dependsOn": ["^typecheck", "mdx"]
     },
     // Hash-only transit task. No package implements a `cache-inputs` script,
     // so every node resolves to <NONEXISTENT> and nothing is ever executed --