From be698e602ba64676214da4ce4ae011edc24c4a09 Mon Sep 17 00:00:00 2001
From: Jason Woltje <jason@diversecanvas.com>
Date: Wed, 11 Nov 2026 00:32:15 -0600
Subject: [PATCH] test(cli): json-redaction pins follow the label refusals

The review round changed the config-command relay and the org document
refusal to name the file by label. cli/tests/json-redaction.test.mjs still
required the host path in those two CLI refusals. They now require the
label and the path's absence. The direct scripts/mosaic-config.mjs checks
and the loadSystem check (PL1, deferred) still require the path.
---
 packages/cli/tests/json-redaction.test.mjs | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/packages/cli/tests/json-redaction.test.mjs b/packages/cli/tests/json-redaction.test.mjs
index b028356ad..bbcffd626 100644
--- a/packages/cli/tests/json-redaction.test.mjs
+++ b/packages/cli/tests/json-redaction.test.mjs
@@ -21,10 +21,15 @@ function fixture(t) {
   };
   return { root, file, env, run, boot };
 }
-function redacted(result, file, status) {
+// label: the CLI refusal names the file by this label and never by host path (PR #1916).
+// Without it, the refusal comes from scripts/mosaic-config.mjs, which still names the file.
+function redacted(result, file, status, label) {
   assert.equal(result.status, status, result.stderr);
   assert.equal(result.stdout, '');
-  assert.ok(result.stderr.includes(file), result.stderr);
+  if (label) {
+    assert.ok(!result.stderr.includes(file), result.stderr);
+    assert.ok(result.stderr.includes(label), result.stderr);
+  } else assert.ok(result.stderr.includes(file), result.stderr);
   assert.match(result.stderr, /not valid JSON/);
   assert.doesNotMatch(result.stderr, /sk-test|Unexpected token/);
 }
@@ -40,7 +45,7 @@ test('system config parse refusal and CLI relay omit parser bytes', t => {
     assert.doesNotMatch(error.message, /sk-test|Unexpected token/);
     return true;
   });
-  redacted(f.run(cli, 'org', 'config', 'validate', 'alpha'), f.file, 3);
+  redacted(f.run(cli, 'org', 'config', 'validate', 'alpha'), f.file, 3, 'configuration is not valid JSON; expected readable JSON: the system config MOSAIC_CONFIG names');
 });
 
 test('named instance marker parse refusal omits parser bytes', t => {
@@ -55,5 +60,5 @@ for (const operation of ['validate', 'create', 'update']) test(`org ${operation}
   const file = join(f.root, 'alpha.json'); writeFileSync(file, secret);
   const args = operation === 'validate' ? ['validate', file]
     : [operation, 'alpha', '--from', file, ...(operation === 'update' ? ['--if-revision', '1'] : [])];
-  redacted(f.run(cli, 'org', ...args), file, 2);
+  redacted(f.run(cli, 'org', ...args), file, 2, 'mosaic: cannot read organization document: not valid JSON\n');
 });