Row 286 r5: record green read-grant fixtures, whole suites and restored semantic mutants

2026-10-24 08:46:02 -05:00
1 parent 045eec61ae
commit ec8cb10c04
@@ -5525,3 +5525,5 @@ claim. Receipts and limitations in agents/lena/work/queue-296/BUILD.md and run-r
 - 2026-10-24 (rockerduck, row286 / #1791, r4 before gate, sage-4079): all 15 r3 commits transplanted to d0a6a87cd on new rockerduck/row286-r4. Three product overlaps auto-merged with row217 preserved; two append-log conflicts retain both histories. Range-diff and adjacent hunk evidence in agents/rockerduck/work/queue-286/BUILD.md. UNTESTED r4: Git-only until own-branch push, library/bus rerun waits for CLEAR after row285.

 - 2026-10-24 (rockerduck, row286 / #1791, r5 before gate, sage-4097/4100): transplanted r4 onto 1f3d0350f; kept row285 library.write routing and chief write-grant refusal plus both append-log histories. Chief fixture refs added; T7/T9 mint setup now pins real refusal then seeds read-only fixture as explicitly ruled, keeping real revoke/fire assertions. Scratch role declaration mutation removed; range-diff/drift evidence recorded. No r5 tests yet; CLEAR starts after own-branch push.
+
+- 2026-10-24 (rockerduck, row286 / #1791 r5 gate, sage-4097/4100): own-worktree installs; touched credential6/6 and sync24/24; whole library151/151 and bus981/981, zero fail/skip/cancel. P1 forced refspec, P2 missing inode compare and B285-M1 chief write-grant guard each killed on ERR_ASSERTION with green before/after controls and exact restoration hashes. All gate-output fixture searches zero. No normal red; source unchanged after pre-gate push045eec61a. Plain text evidence in agents/rockerduck/work/queue-286/BUILD.md and gate-r5; round2 candidate push follows.
@@ -1140,3 +1140,64 @@ successfully; no tests/mutants/build began. This historical fact corrects no cod
 For r5, sage-4097/4100 grants CLEAR after the own-branch push: every touched test
 file whole, full library/bus and affected broker mutant. Gate results follow as
 new entries; historical r3 logs above are not r5 results.
+
+## r5 CLEAR gate complete — sage-4097 / sage-4100 (2026-10-24)
+
+Source under test: pushed pre-gate 045eec61a. Own-worktree root npm ci
+--ignore-scripts --no-audit --no-fund: exit0,128 packages; packages/webui same:
+exit0,2 packages. No canonical npm/rm or module linking. Fresh TMPDIR created
+with mktemp -d /mnt/storage/scratch/tmp/XXXXXX. Every test command used
+ timeout -k 10 (180 seconds focused,900 library,1800 bus).
+
+Every touched file whole, then package suites:
+- node --test --test-reporter=tap packages/bus/tests/library-credential.test.mjs:
+  6 tests,6 pass,0 fail/skip/cancel/todo; exit0.
+- node --test packages/library/tests/sync.test.mjs:
+  24 tests,24 pass,0 fail/skip/cancel/todo; exit0.
+- node --test packages/library/tests/*.test.mjs:
+  151 tests,151 pass,0 fail/skip/cancel/todo; exit0.
+- node --test packages/bus/tests/*.test.mjs:
+  981 tests,981 pass,0 fail/skip/cancel/todo; exit0.
+No first-run red, no second red, no normal-run old-test red. No test/source edit
+after these runs. T7/T9 passed on the ruled read seed; real grant raise refused,
+real revoke/fire deleted the rows, and fetch/status refusals remained intact.
+
+Mutants, serially applied/restored in this worktree, with fresh green controls
+before and after each. Custom scratch reporter emits only test name, assertion
+code/location and counts, suppressing assertion values so a deliberately broken
+askpass cannot print a fixture token in diagnostics:
+- P1-force-push: add + only before syncCommand's push refspec. Control2/2,
+  mutant0/2 exit1 with ERR_ASSERTION at sync.test.mjs:331 and :365,
+  restored2/2. Target full SHA256 restored:
+  784af63a417b547b195ca835878daeba5b696b42a83a4c95de6728a0efa75e38.
+- P2-drop-inode: remove only askpass's inode compare. Control1/1,
+  mutant0/1 exit1 with ERR_ASSERTION at swapped-file refusal sync.test.mjs:510/:526,
+  restored1/1. Target full SHA256 restored:
+  5c9b528fd69a2493f04933fc84f352b1101d276d69d9982806975def614fd740.
+- B285-M1-chief-write: row285's affected broker mutant, remove only
+  ` || role.definition === STAFF_TO` from #giteaRole. Control1/1,
+  mutant0/1 exit1 with ERR_ASSERTION at gitea-grant.test.mjs:270,
+  restored1/1. Target full SHA256 restored:
+  9e16ff6225cf5e438b0694e2f2b5831c2750f2d0dfc43c7f2f257d8cdacf9ffd.
+  This repeats Magica's M1 for the rebase's newly inherited chief refusal.
+  Runtime.mjs and library/index.mjs match r4 byte-for-byte; no new hunk there.
+
+Whole package suites ran on the restored candidate source before mutations;
+all package bytes afterward match 045eec61a (git diff --quiet -- packages), and
+each mutant's restored positive control passed. No product or old assertion edit
+was made during the gate. Existing T7/T9 revoke/fire helpers still byte-identical
+to r4. No shell suites here: Sage's full landing gate remains authoritative.
+
+All captured gate and control/mutant/restored outputs have zero exact matches for
+six fixture-token values and zero generic fixture-token pattern matches. Full
+plain text outputs and count-only search receipts are under gate-r5/. T9 also
+checks every issued fake token against captured runtime lines. No fixture values
+are printed in the search receipts. Prior pre-CLEAR static-output slip remains
+honestly recorded earlier and is separate from these clean gate outputs.
+
+Gate complete; final bookkeeping commit updates only evidence, append-only logs
+and manifest. The candidate manifest covers the nine package paths and plain text
+receipts, excluding shared append logs and itself. Round2 reviews must examine
+sage-4100's reversal of mint setup as well as the base delta.
+
+Scratch gate directory retained: /mnt/storage/scratch/tmp/ZMiVek
@@ -1,9 +1,24 @@
 7fab157be380502b726c4a84772bfb667850766062e4952b73f172f5ada363ed  agents/ludwig/work/queue-286/BUILD.md
-4de1780a7dbfdedfb8606fd12e4d4122735d3bca9308b6b2288690f5fffa2b9f  agents/rockerduck/work/queue-286/BUILD.md
+3b19f4e6e569fabe701e2068bbded1e2e52cd1451fe98e198530c86d046df91b  agents/rockerduck/work/queue-286/BUILD.md
 1698321de2b17251ae3dd55bf3b79e03770d20d932fb60d514ee58700f80fb3b  agents/rockerduck/work/queue-286/candidate-r3.sha256
 647776d3f75e00023ce1a1b286ff67a0f7a4958165dcebe24216fb6bde27e610  agents/rockerduck/work/queue-286/candidate-r4.sha256
 e5026111e3c84f1294c80631fc5d5dad6dc77166209acdfd07c6ea8755469e19  agents/rockerduck/work/queue-286/gate-bus.txt
 4e191637baa4d8683679fd6e84d81e29ec6fe64faf38b4b33f9b5965fce1dfcf  agents/rockerduck/work/queue-286/gate-library.txt
+bb60e11b8d74da9eda11f838d99713871c55af43857811941bc1f98a3bc54ed8  agents/rockerduck/work/queue-286/gate-r5/B285-M1-chief-write-control.txt
+1b659445b779b6ba0ccbddc9f1c4c20d6dad7aeee8b59ee6c4dad97beec067c6  agents/rockerduck/work/queue-286/gate-r5/B285-M1-chief-write-mutant.txt
+bb60e11b8d74da9eda11f838d99713871c55af43857811941bc1f98a3bc54ed8  agents/rockerduck/work/queue-286/gate-r5/B285-M1-chief-write-restored.txt
+a6e9e05ee925068c53bd22ad0dac905f1d4855f81d54943b6b44fe8beb934deb  agents/rockerduck/work/queue-286/gate-r5/P1-force-push-control.txt
+1253e62d913b8b2ef60a63149c0c1dbcd94ca348011d0a59aca11810ead1c13f  agents/rockerduck/work/queue-286/gate-r5/P1-force-push-mutant.txt
+a6e9e05ee925068c53bd22ad0dac905f1d4855f81d54943b6b44fe8beb934deb  agents/rockerduck/work/queue-286/gate-r5/P1-force-push-restored.txt
+bb60e11b8d74da9eda11f838d99713871c55af43857811941bc1f98a3bc54ed8  agents/rockerduck/work/queue-286/gate-r5/P2-drop-inode-control.txt
+b0d2c28880856007400440f6158fd9ed2032a33de44540d419c8eb303e32fbf5  agents/rockerduck/work/queue-286/gate-r5/P2-drop-inode-mutant.txt
+bb60e11b8d74da9eda11f838d99713871c55af43857811941bc1f98a3bc54ed8  agents/rockerduck/work/queue-286/gate-r5/P2-drop-inode-restored.txt
+154bb3d6772186ec889e54b546929b799bf31648db7d3590f097aba4c539dde1  agents/rockerduck/work/queue-286/gate-r5/bus-r5.txt
+909bf1e6bd694275bb2555956673a330689d5acaaa9702eb2c040a5938900d60  agents/rockerduck/work/queue-286/gate-r5/library-r5.txt
+2d8a4f70e4a59dcccf147060af9c21930499a14de209889fec59e22244b0ba4e  agents/rockerduck/work/queue-286/gate-r5/mutants-summary.txt
+95f0d339495713d55a98fba6336a23e37023cdac429725647f71b30774f622a6  agents/rockerduck/work/queue-286/gate-r5/token-search.txt
+33b7f339b6d8e45fa049f19cc07d9a21ec8d9294ae74e7fa0201d5a2c777897f  agents/rockerduck/work/queue-286/gate-r5/touched-credential.txt
+f08f55c5d326acb1dfa5e91f1e3a7c33ec1f1a7044e3e9829f59bd1306e6d584  agents/rockerduck/work/queue-286/gate-r5/touched-sync.txt
 50291819572752733a1c33e846e1e1e8d66e89b677a6a6d0cc7d2402e8fa82ea  agents/rockerduck/work/queue-286/mutant-M1.txt
 ade72e9641ac5ee97b1ceaa266d54b48d28d0d613f415a030547963664a04646  agents/rockerduck/work/queue-286/mutant-M2.txt
 f640bc30c0e07dad11d57f8f00397a76638f5fbc4c71fc56e748f9cb6f4e30e1  agents/rockerduck/work/queue-286/range-diff-r4.txt
@@ -0,0 +1,2 @@
+SUMMARY {"tests":1,"failed":0,"passed":1,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0}
+SUMMARY {"tests":1,"failed":0,"passed":1,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0}
@@ -0,0 +1,4 @@
+FAIL X-G1: the chief of staff refuses at raise, whatever its definition, identity and publish declare ERR_ASSERTION
+    at async TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/rockerduck-row286-r3/packages/bus/tests/gitea-grant.test.mjs:270:3)
+SUMMARY {"tests":1,"failed":1,"passed":0,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0}
+SUMMARY {"tests":1,"failed":1,"passed":0,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0}
@@ -0,0 +1,2 @@
+SUMMARY {"tests":1,"failed":0,"passed":1,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0}
+SUMMARY {"tests":1,"failed":0,"passed":1,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0}
@@ -0,0 +1,2 @@
+SUMMARY {"tests":2,"failed":0,"passed":2,"cancelled":0,"skipped":0,"todo":0,"topLevel":2,"suites":0}
+SUMMARY {"tests":2,"failed":0,"passed":2,"cancelled":0,"skipped":0,"todo":0,"topLevel":2,"suites":0}
@@ -0,0 +1,6 @@
+FAIL C2-03b argv: a push sends one full commit to the branch, fast-forward only, with the fetch prefix ERR_ASSERTION
+    at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/rockerduck-row286-r3/packages/library/tests/sync.test.mjs:331:10)
+FAIL C2-03b T2 and T3: a moved tip reports the race after one fetch, and a second race refuses stale-base ERR_ASSERTION
+    at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/rockerduck-row286-r3/packages/library/tests/sync.test.mjs:365:10)
+SUMMARY {"tests":2,"failed":2,"passed":0,"cancelled":0,"skipped":0,"todo":0,"topLevel":2,"suites":0}
+SUMMARY {"tests":2,"failed":2,"passed":0,"cancelled":0,"skipped":0,"todo":0,"topLevel":2,"suites":0}
@@ -0,0 +1,2 @@
+SUMMARY {"tests":2,"failed":0,"passed":2,"cancelled":0,"skipped":0,"todo":0,"topLevel":2,"suites":0}
+SUMMARY {"tests":2,"failed":0,"passed":2,"cancelled":0,"skipped":0,"todo":0,"topLevel":2,"suites":0}
@@ -0,0 +1,2 @@
+SUMMARY {"tests":1,"failed":0,"passed":1,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0}
+SUMMARY {"tests":1,"failed":0,"passed":1,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0}
@@ -0,0 +1,5 @@
+FAIL C2-03b T5 helper: the named seat's user and file, never a link, 0644, another uid, or a swapped file ERR_ASSERTION
+    at refused (file:///home/jwoltje/.t3/worktrees/mosaic-stack/rockerduck-row286-r3/packages/library/tests/sync.test.mjs:510:40)
+    at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/rockerduck-row286-r3/packages/library/tests/sync.test.mjs:526:3)
+SUMMARY {"tests":1,"failed":1,"passed":0,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0}
+SUMMARY {"tests":1,"failed":1,"passed":0,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0}
@@ -0,0 +1,2 @@
+SUMMARY {"tests":1,"failed":0,"passed":1,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0}
+SUMMARY {"tests":1,"failed":0,"passed":1,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0}
@@ -0,0 +1,160 @@
+✔ C2-06 reply schema: free bodies, exact objects and safe refusal reasons (33.314657ms)
+✔ C2-06 citation setting and all four exact fixed texts (21.835423ms)
+✔ C2-06 default citation cap passes 20 and refuses 21, even with optional citations (152.366676ms)
+✔ C2-06 real Git citation scope, reachability, lines and normalized quotes (69.941057ms)
+✔ C2-06 playground cites pass but cannot state canon (39.428971ms)
+✔ C2-06 independent universes refuse; a hybrid and only its sources pass (68.325051ms)
+✔ C2-06 web cites require allowed definition, this session fetch and kept quote (17.447414ms)
+✔ C2-06 file origin is the path commit and trailer, while last follows served changes (51.608372ms)
+✔ C2-06 origin uses literal paths even when a filename contains a glob (30.364536ms)
+✔ C2-06 cited-commit guard reads exactly the C2-05a indexed file set with supporting scope (76.530249ms)
+✔ C2-06 reply limits fall back independently without coercion or inherited keys (0.650423ms)
+✔ the same commit, repo path and mapping return the same index, and only mapped files are in it (54.986891ms)
+✔ a different repo path, mapping or commit gets its own index (69.187504ms)
+✔ the cache holds at most eight indexes and evicts the least recently used (104.028712ms)
+✔ a failed read is not kept in the cache (17.496977ms)
+✔ a missing or unchecked mapping is refused before any read (14.429727ms)
+✔ a 3,000-file rebuild completes and its time is reported (3069.109382ms)
+ℹ 3,000-file index rebuild: 2828 ms
+✔ resolver step 1: a path from the repo root, with or without .md (1.823375ms)
+✔ resolver step 2: the same path with vaultPrefix/ stripped (0.371558ms)
+✔ resolver step 3: a path relative to the linking file, never above the repo root (0.325094ms)
+✔ resolver step 4: a base name that matches exactly one indexed file (0.376028ms)
+✔ a link into another of her repos resolves to nothing (0.212705ms)
+✔ wikilink forms, embeds, and links skipped inside code (1.388524ms)
+✔ only a body embed whose target has an extension other than .md, in any case, is an attachment (0.449806ms)
+✔ the fixture mapping checks and comes back frozen (3.268417ms)
+✔ C2-01c: a prefix inside or holding another entry's book refuses library-playground-other-universe (1.521134ms)
+✔ C2-01c: a prefix equal to a book folder, or holding its own, refuses library-mapping-invalid (0.813158ms)
+✔ C2-01c: universe-level prefixes lie outside every book, in a plain universe and in a hybrid with no books (1.25639ms)
+✔ C2-01c: a draft takes kind, name and playground only, and comes back frozen with books [] (2.052664ms)
+✔ C2-01d: supporting prefixes at book level, universe level, in a hybrid and in a draft, [] when absent (0.631545ms)
+✔ C2-01d: each supporting prefix rule refuses with its code (2.650859ms)
+✔ C2-01d: between the lists, a supporting prefix may equal its own playground, and a playground may hold its own supporting (1.192951ms)
+✔ C2-01d: editor is optional, kept when given, and refuses anything but a plain name and email (7.949132ms)
+✔ C2-01d: an accepted editor round-trips through a real git commit unchanged (17.215259ms)
+✔ no playground prefix holds another, and no book folder holds another (1.034693ms)
+✔ shape refusals: kind, remote, branch, unknown keys, types, manuscript, folder names (1.256404ms)
+✔ C2-03a sage-2021: user is optional, kept when given, and must be a plain account name (0.801411ms)
+✔ a hybrid universe is a shape the query code can take (1.4), with sources that must exist (1.046199ms)
+✔ a caller-supplied fail receives the code, as business file loading will pass it (C2-04) (0.377005ms)
+✔ scope comes from the path alone (design 1.2) (0.73665ms)
+✔ C2-04 mirror: exact default path, bare without checkout or remote, and idempotent initialization (75.239758ms)
+✔ C2-04 mirror: simultaneous creators publish one intact mirror and leave no staging paths (53.088037ms)
+✔ C2-04 mirror: skipped publication accepts both coreutils statuses without removing the winner (176.797837ms)
+✔ C2-04 mirror: preserve occupied directories and reject symlink ancestors and code overlaps (18.365788ms)
+✔ C2-04 mirror: existing metadata accepts only bare Git plus state and the precreated lock (37.082282ms)
+✔ C2-04 state: missing state is empty only while the served ref is absent (53.369586ms)
+✔ C2-04 state: valid problems and sync metadata return no content and change no state bytes (53.916094ms)
+✔ C2-04 state: strict keys, types, times, branch, commit and fixed R messages fail closed (158.54358ms)
+✔ C2-04 state: symlink, hardlink, non-private state and missing lock refuse without replacement (43.176748ms)
+✔ C2-04 file: served commit, not HEAD or a caller commit, owns the exact returned text (122.579251ms)
+✔ C2-04 file: R1, R2 and R7 exclusions and never-synced mirrors cannot return file bodies (116.237919ms)
+✔ C2-04 lock: a first-sync and fast-forward reader wait for a consistent pair across processes (263.203405ms)
+✔ C2-04 lock: same-process waits, timeout code, callback expiry and throw release (5032.914717ms)
+✔ C2-04 lock: owner death releases the kernel lock without replacing its file (53.90776ms)
+✔ C2-04 lock: a missing flock binary becomes a handled refusal (52.06452ms)
+✔ C2-04 lock: an unawaited scoped read drains before the lock is released (20.928211ms)
+✔ the query reply cap equals the harness reply cap (1.374042ms)
+✔ find is bound to its universe and refuses a call without one (69.298537ms)
+✔ every result carries its scope, and playground appears only when asked for (39.588069ms)
+✔ unmapped files never appear in any reply (41.725677ms)
+✔ a hybrid sees its sources canon, minus exclusions, and no playground (39.745104ms)
+✔ a hybrid gets a source file it can see, and not an excluded or foreign one (54.569795ms)
+✔ get lists visible links both ways and drops a target another universe cannot see (49.741944ms)
+✔ a long list pages by position, never cuts an item, and returns 50 per page (195.288972ms)
+✔ a page stays under the reply cap when items are large (91.308887ms)
+✔ a search line too long to fit alone comes back marked, with no excerpt, and the other hits still return (32.741226ms)
+✔ a find item that cannot fit alone is refused, not cut (30.177027ms)
+✔ get pages its lines, and the next line picks up where the page stopped (34.036647ms)
+✔ get refuses a file whose front matter alone is over the cap, and a line alone is over the cap (32.225032ms)
+✔ get pages the links of a hub note, every page carries the front matter, and the pages add up (937.453899ms)
+✔ get rejects a bad links_from (30.579713ms)
+✔ search returns scoped line hits, case-insensitively, and refuses empty text (27.317402ms)
+✔ a manuscript call returns one chapter, at most 400 lines, and names its next line (45.067736ms)
+✔ a manuscript call without a chapter returns the first chapter in path order and names the next (25.249972ms)
+✔ a chapter name that matches two visible files is refused (26.105768ms)
+✔ a hybrid reads a source chapter through its declared sources only (35.611261ms)
+✔ universe info reports a hybrid sources, constraints and notes, and refuses an unknown universe (13.375232ms)
+✔ an exclusion hides what it names from a hybrid and from nothing else (34.737212ms)
+✔ PRD 1.14: a lookup that names a book leaves book-null files out (30.351312ms)
+✔ PRD 1.14: library_manuscript never reads a book-null file (28.779537ms)
+✔ PRD 1.14: a draft universe has no canon, so its lookups return files only with scope playground (33.850331ms)
+✔ PRD 1.14: library_universe on a draft returns its kind, name and prefixes (13.005683ms)
+✔ a hybrid gets a source playground file as null, while the source gets it with scope playground (37.428538ms)
+✔ the fixture reads clean: every resolver step, appears_in and relationships wikilinks indexed (57.451116ms)
+✔ R1: executables, symlinks, gitlinks, blobs over 1 MiB and non-UTF-8 text are not indexed (97.059247ms)
+✔ R2: unmapped paths are reported and not indexed (34.657525ms)
+✔ R3: front matter not fully parsed stays raw, with the line where parsing stopped (37.636787ms)
+✔ front matter forms the reader accepts and refuses (0.684877ms)
+✔ R4: a link to no file, to more than one, or into another repo is reported and not followed (34.990314ms)
+✔ a block list link carries its item line, a scalar or flow link its key line, and problems follow (31.586964ms)
+✔ an unresolved attachment embed gives no problem; a link or front matter value to one is R4; a note embed resolves (31.279174ms)
+✔ an indexed Dr.Quinn.md resolves as a body link, a block list link and an embed (34.982445ms)
+✔ R5: a canon file that refers into the playground is reported, and the link still goes by path (31.831603ms)
+✔ R6: a canon file that refers into another universe is reported; a hybrid may refer into its sources (32.879568ms)
+✔ R7: two paths that differ only in case are both left out (39.929801ms)
+✔ the reader reads the commit, never the working tree, and refuses a bad commit id (37.264602ms)
+✔ a bare mirror reads the same as the clone (53.600446ms)
+✔ renderItems snapshot: fact (1.507608ms)
+✔ renderItems snapshot: finding (0.280328ms)
+✔ renderItems snapshot: correction (0.191449ms)
+✔ renderItems snapshot: question (0.161498ms)
+✔ renderItems snapshot: idea (0.221962ms)
+✔ renderItems numbers several items and takes a parsed body as well as a string (0.972903ms)
+✔ without options a path cite has no badge and is never marked changed (0.23437ms)
+✔ renderItems snapshot: notice no-cited-answer (0.204262ms)
+✔ renderItems snapshot: notice no-answer (0.172786ms)
+✔ renderItems snapshot: notice turn-failed (0.246359ms)
+✔ a body without the reply shape shows a fixed line and none of its text (0.577884ms)
+✔ C2-01c: each level gives its universe, and its book or null (4.098282ms)
+✔ C2-01c: prefixes come first: in a book that holds a prefix, a file outside it is canon and one under it playground (0.825776ms)
+✔ C2-01c: a canon file linking into a draft gives R6, and into its own universe-level prefix gives R5 (58.413682ms)
+✔ C2-01d: each supporting level gives its universe, and its book or null (0.934055ms)
+✔ C2-01d: supporting comes before playground; a folder in both lists is supporting, one in the playground only stays playground (0.61729ms)
+✔ C2-01d: only .md files are supporting; a .canvas or .base under a supporting prefix is unmapped (0.336669ms)
+✔ C2-01d: a path passes at book level, universe level, in a draft and in a folder in both lists (2.456474ms)
+✔ C2-01d: a path of exactly 1024 bytes passes, and 1025 bytes made of multi-byte characters refuses (1.088754ms)
+✔ C2-01d: a path outside the universe's supporting folders refuses (0.796025ms)
+✔ C2-01d: malformed paths refuse by class, in order (1.131483ms)
+✔ C2-01d: a symlink or gitlink on the way, or at the path itself, refuses (0.405651ms)
+✔ C2-01d: a name that differs from a tree name only in case or Unicode form refuses, at the file or any folder (1.45266ms)
+✔ the survey prints folder names, counts, key sets and link-form counts, and never text (56.424684ms)
+✔ folder names print DEL, C1 and bidi controls, U+061C among them, as escapes (37.540391ms)
+✔ an embed of an attachment counts as an embed and as an attachment; a plain link to one does not (26.309473ms)
+✔ with --mapping the survey adds scope, resolver step and problem counts (50.591633ms)
+✔ C2-01d: with --mapping the survey counts supporting files (46.72286ms)
+✔ survey exit codes: usage 4, bad mapping 3, unreadable repo 2 (18.657409ms)
+✔ scripts/mosaic library survey reaches the survey (108.500394ms)
+✔ C2-03a argv: the fixed sequence, one https allow, no other protocol key (2.650389ms)
+✔ C2-03a argv: only an https URL with a plain host, no userinfo, and a plain user (1.080581ms)
+✔ C2-03a helper: answers only the exact prompts for the configured host and user (dewey-0765) (52.239114ms)
+✔ C2-03a first sync: served is the fetched tip, HEAD is served, the survey reads it, and the token stays in the slot (194.31246ms)
+✔ C2-03a fast-forward: served moves, problems are rebuilt, and a repeat changes only lastFetch (290.730738ms)
+✔ C2-03a Filbert N2: a read that took served before a sync still finds its objects after served moves (256.998332ms)
+✔ C2-03a overlap: a reader during a sync sees the old pair or the new one, never a mix (194.224747ms)
+✔ C2-03a diverged: a non-fast-forward keeps serving and holds until a human accepts the tip (428.940099ms)
+✔ C2-03a accept starts the record over, so a changed branch gets a fresh state (173.492714ms)
+✔ C2-03a fetch failure: a wrong token keeps serving and records the error, lastFetch unchanged (199.807249ms)
+✔ C2-03a a failed first fetch records the error with nothing served (58.387134ms)
+✔ C2-03a a 302 to another host fails the fetch and the other host sees nothing (61.485514ms)
+✔ C2-03a the slot: missing or unsafe refuses before git, and sync never opens it (58.368256ms)
+✔ C2-03a sage-2021: an entry with no user refuses library-remote-invalid and runs no git (36.536617ms)
+✔ C2-03a one sync per mirror: an overlapping call refuses library-sync-busy (126.434304ms)
+✔ C2-03b argv: a push sends one full commit to the branch, fast-forward only, with the fetch prefix (0.466275ms)
+✔ C2-03b T1 push: a fast-forward lands with the seat's own user and file, and moves no local ref (110.989514ms)
+✔ C2-03b T2 and T3: a moved tip reports the race after one fetch, and a second race refuses stale-base (186.414291ms)
+✔ C2-03b race fetch: while a sync of the mirror runs, the race refuses library-sync-busy (218.556818ms)
+✔ C2-03b T4: a dead remote, a hook refusal and a wrong token each refuse library-push-failed (185.158633ms)
+✔ C2-03b push: a refused, missing or unsafe credential runs no git (94.141925ms)
+✔ C2-03b T10 humanCredential: her login and a 0600 slot library-human, or library-human-missing (0.97279ms)
+✔ C2-03b fetch credential: the state names the kind and user, a refusal runs no git, and a pre-286 state still reads (143.838791ms)
+✔ C2-03b T5 helper: the named seat's user and file, never a link, 0644, another uid, or a swapped file (30.403362ms)
+ℹ tests 151
+ℹ suites 0
+ℹ pass 151
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 6420.610698
@@ -0,0 +1,3 @@
+P1-force-push: control exit0; mutant exit1 at ERR_ASSERTION; restored exit0; SHA256 restored 784af63a417b547b195ca835878daeba5b696b42a83a4c95de6728a0efa75e38
+P2-drop-inode: control exit0; mutant exit1 at ERR_ASSERTION; restored exit0; SHA256 restored 5c9b528fd69a2493f04933fc84f352b1101d276d69d9982806975def614fd740
+B285-M1-chief-write: control exit0; mutant exit1 at ERR_ASSERTION; restored exit0; SHA256 restored 9e16ff6225cf5e438b0694e2f2b5831c2750f2d0dfc43c7f2f257d8cdacf9ffd
@@ -0,0 +1,14 @@
+Six exact fixture strings checked in memory; values omitted.
+B285-M1-chief-write-control.log: exact=0, pattern=0
+B285-M1-chief-write-mutant.log: exact=0, pattern=0
+B285-M1-chief-write-restored.log: exact=0, pattern=0
+P1-force-push-control.log: exact=0, pattern=0
+P1-force-push-mutant.log: exact=0, pattern=0
+P1-force-push-restored.log: exact=0, pattern=0
+P2-drop-inode-control.log: exact=0, pattern=0
+P2-drop-inode-mutant.log: exact=0, pattern=0
+P2-drop-inode-restored.log: exact=0, pattern=0
+bus-r5.log: exact=0, pattern=0
+library-r5.log: exact=0, pattern=0
+touched-credential.log: exact=0, pattern=0
+touched-sync.log: exact=0, pattern=0
@@ -0,0 +1,46 @@
+TAP version 13
+# Subtest: C2-03b T6: the slot before any chief evidence, then the listed chief's live grant
+ok 1 - C2-03b T6: the slot before any chief evidence, then the listed chief's live grant
+  ---
+  duration_ms: 28.04537
+  type: 'test'
+  ...
+# Subtest: C2-03b T7: a chief revoked through grants.revoke or fired through instance.fire refuses, and the fallback stays ended
+ok 2 - C2-03b T7: a chief revoked through grants.revoke or fired through instance.fire refuses, and the fallback stays ended
+  ---
+  duration_ms: 185.110205
+  type: 'test'
+  ...
+# Subtest: C2-03b T7 choice checks: delisted, a fire under way and held each refuse; a rehire lists the chief again
+ok 3 - C2-03b T7 choice checks: delisted, a fire under way and held each refuse; a rehire lists the chief again
+  ---
+  duration_ms: 31.316624
+  type: 'test'
+  ...
+# Subtest: C2-03b T8: a chief grant on another project ends the fallback, and two listed chiefs refuse library-fetch-no-grant
+ok 4 - C2-03b T8: a chief grant on another project ends the fallback, and two listed chiefs refuse library-fetch-no-grant
+  ---
+  duration_ms: 28.252007
+  type: 'test'
+  ...
+# Subtest: C2-03b departure (sage-2928): with no chief entry, any Gitea grant evidence refuses
+ok 5 - C2-03b departure (sage-2928): with no chief entry, any Gitea grant evidence refuses
+  ---
+  duration_ms: 15.562886
+  type: 'test'
+  ...
+# Subtest: C2-03b T9 runtime: the chief's store file and user, then a real revoke that runs no git with the slot at 0000
+ok 6 - C2-03b T9 runtime: the chief's store file and user, then a real revoke that runs no git with the slot at 0000
+  ---
+  duration_ms: 687.423158
+  type: 'test'
+  ...
+1..6
+# tests 6
+# suites 0
+# pass 6
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 1106.366032
@@ -0,0 +1,32 @@
+✔ C2-03a argv: the fixed sequence, one https allow, no other protocol key (1.436517ms)
+✔ C2-03a argv: only an https URL with a plain host, no userinfo, and a plain user (0.577916ms)
+✔ C2-03a helper: answers only the exact prompts for the configured host and user (dewey-0765) (28.778404ms)
+✔ C2-03a first sync: served is the fetched tip, HEAD is served, the survey reads it, and the token stays in the slot (116.672712ms)
+✔ C2-03a fast-forward: served moves, problems are rebuilt, and a repeat changes only lastFetch (173.590792ms)
+✔ C2-03a Filbert N2: a read that took served before a sync still finds its objects after served moves (164.95977ms)
+✔ C2-03a overlap: a reader during a sync sees the old pair or the new one, never a mix (147.534112ms)
+✔ C2-03a diverged: a non-fast-forward keeps serving and holds until a human accepts the tip (342.519699ms)
+✔ C2-03a accept starts the record over, so a changed branch gets a fresh state (151.126155ms)
+✔ C2-03a fetch failure: a wrong token keeps serving and records the error, lastFetch unchanged (172.845823ms)
+✔ C2-03a a failed first fetch records the error with nothing served (50.837991ms)
+✔ C2-03a a 302 to another host fails the fetch and the other host sees nothing (54.065385ms)
+✔ C2-03a the slot: missing or unsafe refuses before git, and sync never opens it (50.518432ms)
+✔ C2-03a sage-2021: an entry with no user refuses library-remote-invalid and runs no git (26.632778ms)
+✔ C2-03a one sync per mirror: an overlapping call refuses library-sync-busy (117.10529ms)
+✔ C2-03b argv: a push sends one full commit to the branch, fast-forward only, with the fetch prefix (0.426418ms)
+✔ C2-03b T1 push: a fast-forward lands with the seat's own user and file, and moves no local ref (104.388134ms)
+✔ C2-03b T2 and T3: a moved tip reports the race after one fetch, and a second race refuses stale-base (173.932457ms)
+✔ C2-03b race fetch: while a sync of the mirror runs, the race refuses library-sync-busy (207.439119ms)
+✔ C2-03b T4: a dead remote, a hook refusal and a wrong token each refuse library-push-failed (147.860105ms)
+✔ C2-03b push: a refused, missing or unsafe credential runs no git (86.487812ms)
+✔ C2-03b T10 humanCredential: her login and a 0600 slot library-human, or library-human-missing (0.854697ms)
+✔ C2-03b fetch credential: the state names the kind and user, a refusal runs no git, and a pre-286 state still reads (135.189846ms)
+✔ C2-03b T5 helper: the named seat's user and file, never a link, 0644, another uid, or a swapped file (27.416758ms)
+ℹ tests 24
+ℹ suites 0
+ℹ pass 24
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 2558.280321
@@ -1660,3 +1660,5 @@ are never rewritten or removed; corrections are new entries.
 - 2026-10-24 — rockerduck (a403aa78-b550-4bab-a613-7ea3fd75ec79), row286 / #1791 r4 under sage-4079: new branch from d0a6a87cd, 15 r3 commits transplanted, both append histories retained, product/test patch unchanged apart from newer base context; evidence/manifest regenerated; no setup/tests run, CLEAR pending.

 - 2026-10-24 — rockerduck (a403aa78-b550-4bab-a613-7ea3fd75ec79), row286 / #1791 r5: rebase onto row285 landing 1f3d0350f, both logs preserved, chief refs and ruled read-mint fixtures prepared; real revoke/fire checks preserved, no product change; pre-gate push next under sage-4097/4100.
+
+- 2026-10-24 — rockerduck (a403aa78-b550-4bab-a613-7ea3fd75ec79), row286 / #1791 r5 gate: touched6/6+24/24, library151/151, bus981/981; three semantic mutants killed/restored with green controls; no normal red; all output fixture searches zero; sage-4100 read seed verified, ready for round2 Boyd/Dewey checks and Sage landing gate.