merge: origin/main into fix/1019-queue-guard-stdin (union on test:framework-shell)

Both sides edited the single `test:framework-shell` line additively and did not
overlap: main prepended the test-enumeration guard pair
(check-test-enumeration.sh, test-check-test-enumeration.sh); this branch inserted
test-ci-queue-wait-parse.sh after test-ci-queue-wait-branch-absent.sh.

Resolved as the union — main's line with this branch's one insertion restored.
Main's new guard makes that insertion mandatory rather than cosmetic: the test
file ships in this branch, so leaving it unenumerated would fail the guard.

Co-authored-by: mos-dt-0 <[email protected]>

.woodpecker/ci.yml

@@ -41,6 +41,11 @@ steps:
       # (Constitution + dispatcher + each RUNTIME.md slice). See DESIGN §7 / R9.
       - bash packages/mosaic/framework/tools/quality/scripts/check-resident-budget.sh --self-test
       - bash packages/mosaic/framework/tools/quality/scripts/check-resident-budget.sh
+      # Test-membership guard (#1017): also first link of test:framework-shell.
+      # Invoked from BOTH surfaces it audits (F2, PR #1018) — the guard is link
+      # [0] of the pnpm chain, so severing that chain would silence it together
+      # with everything it guards; this direct line keeps one instrument running.
+      - bash packages/mosaic/framework/tools/quality/scripts/check-test-enumeration.sh
 
   # Blocking gate (#791): a framework upgrade must never write or delete an
   # operator-owned path. The HARD GATE proves an unanticipated operator sentinel

packages/mosaic/framework/tools/git/ci-queue-wait.sh

@@ -34,12 +34,18 @@ EOF
 # get_remote_host and get_gitea_token are provided by detect-platform.sh
 
 get_state_from_status_json() {
-    python3 - <<'PY'
+    # Capture piped JSON BEFORE invoking `python3 - <<PY`. The heredoc binds
+    # stdin to the Python program text — so json.load(sys.stdin) inside would
+    # try to re-read stdin after `-` already consumed it for the program,
+    # yielding EOF and returning "unknown" every time. Pass payload via env.
+    local payload
+    payload=$(cat)
+    CI_QUEUE_STATUS_JSON="$payload" python3 - <<'PY'
 import json
-import sys
+import os
 
 try:
-    payload = json.load(sys.stdin)
+    payload = json.loads(os.environ.get("CI_QUEUE_STATUS_JSON", ""))
 except Exception:
     print("unknown")
     raise SystemExit(0)
@@ -83,12 +89,15 @@ PY
 }
 
 print_pending_contexts() {
-    python3 - <<'PY'
+    # Same stdin hazard as get_state_from_status_json above — pass payload via env.
+    local payload
+    payload=$(cat)
+    CI_QUEUE_STATUS_JSON="$payload" python3 - <<'PY'
 import json
-import sys
+import os
 
 try:
-    payload = json.load(sys.stdin)
+    payload = json.loads(os.environ.get("CI_QUEUE_STATUS_JSON", ""))
 except Exception:
     print("[ci-queue-wait] unable to decode status payload")
     raise SystemExit(0)

packages/mosaic/framework/tools/git/issue-comment.sh

@@ -254,32 +254,15 @@ from urllib.parse import urlparse
 
 
 def _origin_and_path(url):
-    # Normalize a URL to (scheme-class, host, distinguishing-port) + comment path.
-    #
-    # #991: http and https collapse into ONE scheme class ("web"). A Gitea whose
-    # ROOT_URL is configured http:// returns http:// object URLs even when every
-    # client reaches it over https://, so a scheme-strict comparison rejects the
-    # provider's own correct answer about a write that landed — a deterministic
-    # false negative on every comment posted against such a deployment. The
-    # scheme is also not what this check defends: the forgeries it exists to
-    # catch (look-alike host, decoy path prefix, wrong owner/repo/number) all
-    # vary the HOST or the PATH, both of which stay strict below. Any OTHER
-    # scheme (file:, ftp:, javascript:) remains distinguishing and is rejected.
-    #
-    # Port: an implicit port and its own scheme's default compare equal, so
-    # http://h == https://h. An EXPLICIT non-default port still distinguishes,
-    # because a different port is a different service on the same host.
+    # Normalize a URL to (scheme, host, effective-port) + comment path. The port
+    # defaults to the scheme's default (80 http / 443 otherwise) so an implicit
+    # port and its explicit default form compare equal.
     parsed = urlparse(url or "")
     scheme = (parsed.scheme or "").lower()
     host = (parsed.hostname or "").lower()
-    if scheme in ("http", "https"):
-        scheme_class = "web"
-        default_port = 80 if scheme == "http" else 443
-        port = None if parsed.port in (None, default_port) else parsed.port
-    else:
-        scheme_class = scheme
-        port = parsed.port
-    return (scheme_class, host, port), parsed.path.rstrip("/")
+    default_port = 80 if scheme == "http" else 443
+    port = parsed.port if parsed.port is not None else default_port
+    return (scheme, host, port), parsed.path.rstrip("/")
 
 
 try:

packages/mosaic/framework/tools/git/pr-review.sh

@@ -243,35 +243,15 @@ from urllib.parse import urlparse
 
 
 def _origin_and_path(url):
-    # Normalize a URL to (scheme-class, host, distinguishing-port) + comment path.
-    #
-    # #991: http and https collapse into ONE scheme class ("web"). A Gitea whose
-    # ROOT_URL is configured http:// returns http:// object URLs even when every
-    # client reaches it over https://, so a scheme-strict comparison rejects the
-    # provider's own correct answer about a comment that landed — a deterministic
-    # false negative on EVERY review comment posted against such a deployment.
-    # That matters more here than anywhere else: on a host where no seat can
-    # create a review OBJECT, the comment-form review record this path produces
-    # is the only gate-16 evidence available, and this check refuses all of it.
-    # The scheme is also not what the check defends: the forgeries it exists to
-    # catch (look-alike host, decoy path prefix, wrong owner/repo/kind/number)
-    # all vary the HOST or the PATH, both of which stay strict below. Any OTHER
-    # scheme (file:, ftp:, javascript:) remains distinguishing and is rejected.
-    #
-    # Port: an implicit port and its own scheme's default compare equal, so
-    # http://h == https://h. An EXPLICIT non-default port still distinguishes,
-    # because a different port is a different service on the same host.
+    # Normalize a URL to (scheme, host, effective-port) + comment path. The port
+    # defaults to the scheme's default (80 http / 443 otherwise) so an implicit
+    # port and its explicit default form compare equal.
     parsed = urlparse(url or "")
     scheme = (parsed.scheme or "").lower()
     host = (parsed.hostname or "").lower()
-    if scheme in ("http", "https"):
-        scheme_class = "web"
-        default_port = 80 if scheme == "http" else 443
-        port = None if parsed.port in (None, default_port) else parsed.port
-    else:
-        scheme_class = scheme
-        port = parsed.port
-    return (scheme_class, host, port), parsed.path.rstrip("/")
+    default_port = 80 if scheme == "http" else 443
+    port = parsed.port if parsed.port is not None else default_port
+    return (scheme, host, port), parsed.path.rstrip("/")
 
 
 try:

packages/mosaic/framework/tools/git/test-ci-queue-wait-parse.sh

@@ -0,0 +1,205 @@
+#!/usr/bin/env bash
+# Regression suite for #1019: ci-queue-wait.sh's status parser must return a
+# state DERIVED FROM ITS INPUT.
+#
+# The defect this pins: both python sites piped a payload into `python3 - <<'PY'`.
+# The heredoc binds stdin to the Python program text, so json.load(sys.stdin) saw
+# EOF, the bare `except` fired, and the function returned "unknown" for every input
+# — success, pending and failure alike. "unknown" then reaches an `exit 0` arm, so
+# the gate-6 queue guard passed unconditionally on both the gitea and github paths.
+#
+# Every assertion below is on the RETURNED STATE STRING. A test that asserted only
+# `rc=0` would have passed against the broken build, which is why this bug survived.
+#
+# The functions are extracted from the shipped wrapper rather than reimplemented, so
+# this suite measures the code that actually runs.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# Overridable so a mutation test can point the suite at a deliberately-broken copy
+# without touching the tracked file. The earlier version of this suite required
+# `git stash` + `git checkout` to do that, which left a repo-global stash entry
+# that any sibling worktree could have popped onto an unrelated branch.
+WRAPPER="${CI_QUEUE_WAIT_WRAPPER:-$SCRIPT_DIR/ci-queue-wait.sh}"
+
+PASS=0
+FAIL=0
+
+pass() { printf '  PASS  %s\n' "$1"; PASS=$((PASS + 1)); }
+fail() { printf '  FAIL  %s\n' "$1"; FAIL=$((FAIL + 1)); }
+
+if [[ ! -f "$WRAPPER" ]]; then
+    printf 'FATAL: wrapper not found at %s\n' "$WRAPPER" >&2
+    exit 1
+fi
+
+TMPDIR_T="$(mktemp -d)"
+trap 'rm -rf "$TMPDIR_T"' EXIT
+
+extract_fn() {
+    # $1 = function name, $2 = source file, $3 = destination
+    sed -n "/^$1()/,/^}/p" "$2" > "$3"
+    [[ -s "$3" ]] || { printf 'FATAL: could not extract %s from %s\n' "$1" "$2" >&2; exit 1; }
+}
+
+extract_fn get_state_from_status_json "$WRAPPER" "$TMPDIR_T/state.sh"
+extract_fn print_pending_contexts     "$WRAPPER" "$TMPDIR_T/contexts.sh"
+
+state_of() {
+    # shellcheck disable=SC1091
+    ( source "$TMPDIR_T/state.sh"; printf '%s' "$1" | get_state_from_status_json )
+}
+
+expect_state() {
+    local label="$1" payload="$2" want="$3" got
+    got="$(state_of "$payload")"
+    if [[ "$got" == "$want" ]]; then
+        pass "$label -> $want"
+    else
+        fail "$label -> got '$got', want '$want'"
+    fi
+}
+
+echo "=== parser returns a state derived from its input (#1019) ==="
+
+expect_state "success payload" \
+    '{"state":"success","statuses":[{"status":"success","context":"ci/build"}]}' \
+    'terminal-success'
+
+expect_state "pending payload" \
+    '{"state":"pending","statuses":[{"status":"pending","context":"ci/build"}]}' \
+    'pending'
+
+expect_state "failure payload" \
+    '{"state":"failure","statuses":[{"status":"failure","context":"ci/build"}]}' \
+    'terminal-failure'
+
+expect_state "mixed success+pending is pending" \
+    '{"state":"pending","statuses":[{"status":"success"},{"status":"pending"}]}' \
+    'pending'
+
+expect_state "running counts as pending" \
+    '{"state":"pending","statuses":[{"status":"running"}]}' \
+    'pending'
+
+expect_state "error counts as failure" \
+    '{"state":"failure","statuses":[{"status":"error"}]}' \
+    'terminal-failure'
+
+expect_state "empty status set is no-status" \
+    '{"state":"","statuses":[]}' \
+    'no-status'
+
+# Control. This is the ONE input for which "unknown" is correct. Without it, a
+# regression that hardcoded "unknown" again would still fail the cases above but
+# the suite would give no signal that "unknown" remains reachable when it should be.
+expect_state "undecodable payload stays unknown" \
+    'not json at all' \
+    'unknown'
+
+expect_state "unrecognised status vocabulary is unknown" \
+    '{"state":"weird","statuses":[{"status":"weird"}]}' \
+    'unknown'
+
+echo "=== pending contexts are reported to the operator ==="
+
+contexts_of() {
+    # shellcheck disable=SC1091
+    ( source "$TMPDIR_T/contexts.sh"; printf '%s' "$1" | print_pending_contexts )
+}
+
+out="$(contexts_of '{"statuses":[{"status":"pending","context":"ci/alpha"},{"status":"pending","context":"ci/beta"}]}')"
+if grep -q 'ci/alpha' <<<"$out" && grep -q 'ci/beta' <<<"$out"; then
+    pass "both pending contexts emitted"
+else
+    fail "pending contexts not emitted; got: $out"
+fi
+
+out="$(contexts_of '{"statuses":[{"status":"success","context":"ci/alpha"}]}')"
+# Assert the POSITIVE message, not merely the absence of the context name. Absence
+# alone is satisfied by total silence — and the pre-fix build was silent, so an
+# absence-only assertion passed against the very defect this suite exists to catch.
+if grep -q 'ci/alpha' <<<"$out"; then
+    fail "a non-pending context was emitted; got: $out"
+elif grep -q 'no pending contexts' <<<"$out"; then
+    pass "non-pending context suppressed, and reported as 'no pending contexts'"
+else
+    fail "expected an explicit 'no pending contexts' report; got: $out"
+fi
+
+echo "=== needle: the broken construct is caught, not merely absent today ==="
+
+# Rebuild the pre-fix form and assert this suite would have failed against it.
+# Without this, the suite proves the current file is correct but not that it can
+# detect the defect returning.
+BROKEN="$TMPDIR_T/broken.sh"
+cat > "$BROKEN" <<'BROKEN_EOF'
+get_state_from_status_json() {
+    python3 - <<'PY'
+import json
+import sys
+
+try:
+    payload = json.load(sys.stdin)
+except Exception:
+    print("unknown")
+    raise SystemExit(0)
+print("terminal-success" if (payload.get("state") or "") == "success" else "pending")
+PY
+}
+BROKEN_EOF
+
+broken_got="$( ( source "$BROKEN"; printf '%s' '{"state":"success","statuses":[]}' | get_state_from_status_json ) )"
+if [[ "$broken_got" == "unknown" ]]; then
+    pass "[NEEDLE ] pre-fix construct reproduces the defect (returns 'unknown' for a success payload)"
+else
+    fail "[NEEDLE ] pre-fix construct did NOT reproduce the defect; got '$broken_got' — the needle no longer pins anything"
+fi
+
+# And assert the shipped wrapper does not contain that construct.
+#
+# The check must have HEREDOC SEMANTICS, not merely match the text. `json.load(sys.stdin)`
+# is perfectly correct under `python3 -c '...'` — there the program comes from argv, so
+# stdin really is the payload, and ci-queue-wait.sh uses that form legitimately in
+# gitea_get_branch_head_sha. Only `python3 - <<DELIM` is defective, because `-` has
+# already bound stdin to the program text.
+#
+# A flat `grep json\.load\(sys\.stdin\)` therefore fails on correct code. It did: the
+# first version of this needle flagged the innocent `python3 -c` site. Same shape as
+# #1018 F1 (a regex over raw text has no syntax semantics) reproduced inside the needle
+# written to pin a different instance of it.
+heredoc_stdin_sites() {
+    awk '
+        /python3[[:space:]]+-[[:space:]]*<</ {
+            d = $0
+            sub(/.*<<[[:space:]]*/, "", d)
+            gsub(/['"'"'"]/, "", d)
+            delim = d; inhd = 1; next
+        }
+        inhd && $0 == delim { inhd = 0; next }
+        inhd {
+            line = $0
+            sub(/[[:space:]]*#.*$/, "", line)
+            if (line ~ /sys\.stdin/) printf "%d: %s\n", FNR, $0
+        }
+    ' "$1"
+}
+
+# Positive control FIRST. An empty result from a broken scanner looks exactly like a
+# clean file, so the scanner is proven to fire before its silence is trusted.
+if [[ -n "$(heredoc_stdin_sites "$BROKEN")" ]]; then
+    pass "[NEEDLE ] scanner detects a stdin read inside a python3-heredoc"
+else
+    fail "[NEEDLE ] scanner did NOT fire on the known-broken form — its silence proves nothing"
+fi
+
+sites="$(heredoc_stdin_sites "$WRAPPER")"
+if [[ -n "$sites" ]]; then
+    fail "[NEEDLE ] wrapper reads stdin inside a python3-heredoc at: $sites"
+else
+    pass "[NEEDLE ] wrapper has no stdin read inside any python3-heredoc"
+fi
+
+printf '\nci-queue-wait parse: %d passed, %d failed\n' "$PASS" "$FAIL"
+[[ "$FAIL" -eq 0 ]] || exit 1

packages/mosaic/framework/tools/git/test-issue-comment-readback.sh

@@ -41,13 +41,7 @@
 #      that other host's credential cross-host;
 #  10. leaves NO temp files behind (POST/GET bodies + metadata) on either the
 #      success or the failure path — nested function-scoped RETURN traps do not
-#      clobber each other and every scratch file is removed on all exit paths;
-#  11. (#991) ACCEPTS a record whose provider-returned URL differs from the repo
-#      remote ONLY in http-vs-https — the standing state on a deployment whose
-#      Gitea ROOT_URL is misconfigured — while still REJECTING a different
-#      explicit port and a non-web scheme. Every prior fixture here was https://
-#      and every negative varied only host or path, so the one axis that fails
-#      in production had zero coverage: the fixtures encoded the assumption.
+#      clobber each other and every scratch file is removed on all exit paths.
 
 set -euo pipefail
 
@@ -67,29 +61,15 @@ STATE_FILE="$WORK_DIR/comments.json"
 # A dedicated scratch dir the wrapper is pointed at via TMPDIR, so the leak
 # check can assert every POST/GET body + metadata temp file is cleaned up.
 TMP_SCRATCH="$WORK_DIR/scratch"
-# #1007: a sandboxed HOME. detect-platform.sh's step-0 per-agent identity lookup
-# reads ~/.config/mosaic/gitea-tokens/<identity>, which is OUTSIDE both
-# XDG_CONFIG_HOME and MOSAIC_CREDENTIALS_FILE — so on any seat that has a real
-# per-agent token the suite resolves a PRODUCTION credential and dies at the
-# authenticated-identity read (HTTP 401) before reaching case 1. Pointing HOME
-# at the work dir keeps that lookup inside the sandbox.
-HOME_DIR="$WORK_DIR/home"
 
 cleanup() {
     rm -rf "$WORK_DIR"
 }
 trap cleanup EXIT
 
-mkdir -p "$REPO_DIR" "$BIN_DIR" "$XDG_DIR" "$TMP_SCRATCH" "$HOME_DIR"
+mkdir -p "$REPO_DIR" "$BIN_DIR" "$XDG_DIR" "$TMP_SCRATCH"
 git -C "$REPO_DIR" init -q
 git -C "$REPO_DIR" remote add origin https://git.mosaicstack.dev/mosaicstack/stack.git
-# #1007: shadow any GLOBAL `mosaic.gitIdentity` with an empty REPO-LOCAL value.
-# A repo-local key shadows the global and reads back empty at rc=0, which is the
-# only way to make step 0 fall through inside a sandbox. Note the env-var route
-# (MOSAIC_GIT_IDENTITY="") does NOT work: detect-platform.sh reads it with
-# `${MOSAIC_GIT_IDENTITY:-}`, and `:-` treats set-but-empty identically to
-# unset, so setting it empty is silently the same as not setting it at all.
-git -C "$REPO_DIR" config mosaic.gitIdentity ""
 
 ISSUE_NUMBER=7
 REPO_SLUG="mosaicstack/stack"
@@ -286,19 +266,6 @@ elif mode == "url-wrong-repo":
 elif mode == "url-suffix-injection":
     # Prefix-injected: a bare endswith("/<slug>/issues/7") test would ACCEPT this.
     issue_url = f"https://git.mosaicstack.dev/deceptive/{repo}/issues/7"
-elif mode == "url-scheme-downgrade":
-    # #991, and the ONLY one of these modes that must be ACCEPTED. A Gitea whose
-    # ROOT_URL is http:// returns http:// object URLs for a repo cloned over
-    # https://. Same host, same path, correct record — the provider is telling
-    # the truth about a write that landed.
-    issue_url = f"http://git.mosaicstack.dev/{repo}/issues/7"
-elif mode == "url-wrong-port":
-    # An EXPLICIT non-default port is a different service on the same host and
-    # must stay distinguishing — collapsing the scheme must not collapse this.
-    issue_url = f"https://git.mosaicstack.dev:8443/{repo}/issues/7"
-elif mode == "url-non-web-scheme":
-    # Only http/https collapse. Any other scheme stays distinguishing.
-    issue_url = f"ftp://git.mosaicstack.dev/{repo}/issues/7"
 record = {
     "id": new_id,
     "body": body,
@@ -398,7 +365,6 @@ run_comment() {
     (
         cd "$REPO_DIR"
         PATH="$BIN_DIR:$PATH" \
-        HOME="$HOME_DIR" \
         TMPDIR="$TMP_SCRATCH" \
         XDG_CONFIG_HOME="$XDG_DIR" \
         MOSAIC_CREDENTIALS_FILE="$CREDENTIALS_FILE" \
@@ -579,17 +545,13 @@ if grep -q " $ACTING_LOGIN\$" "$AUTH_LOG"; then
 fi
 assert_no_temp_leak "cross-host"
 
-# Cases 7-12 (#865 Blocker 3): the created record's id/author/body are all
-# correct, but its provider-returned issue_url does not belong to this issue on
-# this provider/repo. Verification pins the URL's ORIGIN (scheme-class + host +
-# explicit non-default port) and its FULL path (deployment prefix + exact
-# owner/repo + kind + number), so each must FAIL CLOSED. A bare endswith/suffix
-# test would wrongly accept the look-alike-host and prefix-injection variants.
-# url-wrong-port and url-non-web-scheme (#991) bound the scheme relaxation from
-# the other side: collapsing http/https must not also collapse a different port
-# or a different scheme family.
-for bad_mode in url-wrong-host url-wrong-owner url-wrong-repo url-suffix-injection \
-                url-wrong-port url-non-web-scheme; do
+# Cases 7-10 (#865 Blocker 3): the created record's id/author/body are all
+# correct, but its provider-returned issue_url is forged. Verification pins the
+# URL's ORIGIN (scheme+host+effective-port) and its FULL path (deployment prefix
+# + exact owner/repo + kind + number), so each forgery must FAIL CLOSED. A bare
+# endswith/suffix test would wrongly accept the look-alike-host and
+# prefix-injection variants.
+for bad_mode in url-wrong-host url-wrong-owner url-wrong-repo url-suffix-injection; do
     if run_comment "$bad_mode"; then
         echo "FAIL: forged comment URL ($bad_mode) was accepted" >&2
         cat "$OUTPUT_FILE" >&2
@@ -606,19 +568,4 @@ done
 # issue_url (already exercised by Case 1's fresh-success), so the tightened check
 # is not rejecting genuine writes.
 
-# Case 13 (#991): the deployment's ROOT_URL is http:// while the repo remote is
-# https://, so the provider returns an http:// issue_url for a record that is
-# otherwise entirely correct. This is not a forgery — it is the provider's own
-# truthful answer about a write that landed — and a scheme-strict comparison
-# rejects it deterministically, on EVERY comment, converting a successful write
-# into a reported failure. It must be ACCEPTED. Host, path, owner, repo, kind
-# and number all remain strict; only the http/https distinction is relaxed.
-run_comment url-scheme-downgrade
-grep -q 'Added and verified comment on Gitea issue #7 (comment ID 1)' "$OUTPUT_FILE"
-# The write really happened and was read back by exact id — this case passes
-# through the same POST/GET chain as case 1, not around it.
-grep -q "^POST $API_BASE/issues/7/comments$" "$CURL_LOG"
-grep -q "^GET $API_BASE/issues/comments/1$" "$CURL_LOG"
-assert_no_temp_leak "url-scheme-downgrade"
-
 echo "issue-comment.sh REST create + exact-id read-back regression passed"

packages/mosaic/framework/tools/git/test-pr-review-gitea-comment.sh

@@ -436,19 +436,6 @@ elif mode == "comment-url-wrong-repo":
 elif mode == "comment-url-suffix-injection":
     # Prefix-injected: a bare endswith("/<slug>/pulls/123") test would ACCEPT it.
     pr_url = f"{_origin}/deceptive{_slug}/pulls/123"
-elif mode == "comment-url-wrong-port":
-    # #991 bound: an EXPLICIT non-default port is a different service on the same
-    # host. Relaxing http-vs-https must NOT relax this.
-    pr_url = f"{_p.scheme}://{_p.hostname}:8443{_slug}/pulls/123"
-elif mode == "comment-url-non-web-scheme":
-    # #991 bound: ONLY http/https collapse; any other scheme stays distinguishing.
-    pr_url = f"ftp://{_p.netloc}{_slug}/pulls/123"
-elif mode == "comment-url-scheme-downgrade":
-    # #991, and the only URL mode here that must be ACCEPTED. A Gitea whose
-    # ROOT_URL is http:// returns http:// object URLs for a repo reached over
-    # https://. Same host, same path, correct record — a truthful provider
-    # answer about a comment that landed, not a forgery.
-    pr_url = f"http://{_p.netloc}{_slug}/pulls/123"
 elif mode == "comment-mixed-case-slug":
     # #875: EXPECTED_REPO_SLUG is taken verbatim from GITEA_API_BASE and can be
     # mixed-case (e.g. "USC/uconnect"), but Gitea canonicalizes the returned
@@ -903,16 +890,11 @@ fi
 assert_no_temp_leak "review-body-reuse"
 
 # Cases 12-15 (#865 Blocker 3): a PR comment whose id/author/body are all correct
-# but whose provider-returned pull_request_url does not belong to this PR must
-# FAIL CLOSED. Verification pins the URL's ORIGIN (scheme-class + host + explicit
-# non-default port) and FULL path (deployment prefix + exact owner/repo + kind +
-# number); a bare endswith/suffix test would wrongly accept the look-alike-host
-# and prefix-injection variants. comment-url-wrong-port and
-# comment-url-non-web-scheme (#991) bound the scheme relaxation from the other
-# side: collapsing http/https must not also collapse a different port or a
-# different scheme family.
-for bad_mode in comment-url-wrong-host comment-url-wrong-owner comment-url-wrong-repo \
-                comment-url-suffix-injection comment-url-wrong-port comment-url-non-web-scheme; do
+# but whose provider-returned pull_request_url is forged must FAIL CLOSED.
+# Verification pins the URL's ORIGIN (scheme+host+effective-port) and FULL path
+# (deployment prefix + exact owner/repo + kind + number); a bare endswith/suffix
+# test would wrongly accept the look-alike-host and prefix-injection variants.
+for bad_mode in comment-url-wrong-host comment-url-wrong-owner comment-url-wrong-repo comment-url-suffix-injection; do
     if run_review "$bad_mode" comment durable-body; then
         echo "FAIL: forged comment URL ($bad_mode) was accepted" >&2
         cat "$OUTPUT_FILE" >&2
@@ -938,19 +920,6 @@ run_review comment-mixed-case-slug comment durable-body https://git.mosaicstack.
 grep -q 'Added and verified comment on Gitea PR #123' "$OUTPUT_FILE"
 assert_no_temp_leak "comment-mixed-case-slug"
 
-# Case 15c (#991): the deployment's Gitea ROOT_URL is http:// while every client
-# reaches it over https://, so the provider returns an http:// pull_request_url
-# for a comment that is otherwise entirely correct. Same class as 15b — a
-# legitimate provider response, not a spoof — and a scheme-strict compare
-# rejects it on EVERY comment, deterministically. That is not a cosmetic false
-# negative here: on a host where no seat can create a review OBJECT, this
-# comment-form record is the only gate-16 evidence obtainable, and the wrapper
-# refuses all of it while the comment sits durably on the PR. Host, path, owner,
-# repo, kind and number stay strict; only http-vs-https is relaxed.
-run_review comment-url-scheme-downgrade comment durable-body
-grep -q 'Added and verified comment on Gitea PR #123' "$OUTPUT_FILE"
-assert_no_temp_leak "comment-url-scheme-downgrade"
-
 # Case 16 (#865 ITEM 1, current-head TOCTOU): the PR head advances between the
 # pre-submit head read (which pins the review) and the post-verify re-read. The
 # review is genuinely created and verified as pinned to the OLD head, but the

packages/mosaic/framework/tools/quality/scripts/check-test-enumeration.sh

@@ -0,0 +1,165 @@
+#!/usr/bin/env bash
+# check-test-enumeration.sh — CI test-membership guard (#1017).
+#
+# CI reaches shell suites through two hand-enumerated surfaces:
+#   S1  packages/mosaic/package.json  scripts."test:framework-shell"
+#   S2  .woodpecker/ci.yml            direct `bash packages/mosaic/framework/tools/...` commands
+#
+# A hand-enumerated allowlist re-arms its own gap: a new suite never auto-joins,
+# so the list silently under-runs the disk (17 of 39 suites were invisible when
+# #1017 was filed). This guard makes that under-run impossible to do silently:
+#
+#   FAIL when a suite-shaped file exists on disk and is neither enumerated on
+#        the UNION of both surfaces nor listed in the exclusions file.
+#        ("Enumerated", deliberately — F1/F2 on PR #1018 proved this guard sees
+#        NAMING, not reachability, and its words must not claim otherwise.)
+#   FAIL when either surface names a path that does not exist on disk
+#        (a rename manufactures a stale entry silently — checked BOTH directions).
+#   FAIL when an exclusion entry has no reason, names a path that is gone,
+#        names a path that is also enumerated (contradiction), or names a path
+#        outside the population (dead weight that looks like coverage).
+#
+# POPULATION PATTERN — a deliberate decision, stated per #1017's record:
+# basename matches *test*.sh (contains "test", ends ".sh"). Deliberately BROAD:
+# the strict `test-*.sh` prefix cannot even name three real boundary files
+# (tmux/agent-send.test.sh — CI-run; orchestrator/smoke-test.sh;
+# wake/validate-973/microtest-wake-assert.sh), and three independent censuses
+# handled that last file three different ways with no trace of the judgement.
+# The broad pattern makes such files MEMBERS, so their disposition must be a
+# signed exclusion, not an accident of the glob. The SAME pattern is applied to
+# both sides of the comparison (disk and enumeration) — a comparison globbed two
+# ways runs on two different populations. Scripts outside the pattern on both
+# sides symmetrically (e.g. check-resident-budget.sh, verify-sanitized.sh) are
+# check-scripts, not suites; their existence is still verified via the
+# both-directions rule because every surface-named path must exist on disk.
+#
+# The surfaces are PARSED, never line-ranged: three seats independently
+# mis-scoped hand-written line ranges against these files (#1017 thread). S1 is
+# read via JSON + command-chain tokenization; S2 by extracting every
+# packages/mosaic/framework/tools/ token wherever it appears in the file.
+#
+# Exclusions file format (framework/tools/quality/test-enumeration-exclusions.txt):
+#   <repo-relative-path> | <non-empty reason>
+# Lines starting with # and blank lines are ignored. An exclusion is a recorded
+# decision someone signed, not an omission nobody made.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/../../../../../.." && pwd)"
+while (( $# )); do
+    case "$1" in
+        --root) ROOT="$(cd "$2" && pwd)"; shift 2 ;;
+        *) echo "usage: check-test-enumeration.sh [--root <repo-root>]" >&2; exit 2 ;;
+    esac
+done
+
+PKG_JSON="$ROOT/packages/mosaic/package.json"
+CI_YML="$ROOT/.woodpecker/ci.yml"
+TOOLS_DIR="$ROOT/packages/mosaic/framework/tools"
+EXCLUSIONS="$TOOLS_DIR/quality/test-enumeration-exclusions.txt"
+
+for f in "$PKG_JSON" "$CI_YML"; do
+    [[ -f "$f" ]] || { echo "FAIL: required surface file missing: $f" >&2; exit 2; }
+done
+[[ -d "$TOOLS_DIR" ]] || { echo "FAIL: tools dir missing: $TOOLS_DIR" >&2; exit 2; }
+
+fail_count=0
+fail() { printf 'FAIL  %s\n' "$1"; fail_count=$(( fail_count + 1 )); }
+
+# in_population <repo-relative path> — the single pattern, used for BOTH sides.
+in_population() {
+    local base; base="$(basename "$1")"
+    [[ "$base" == *test*.sh ]]
+}
+
+# --- Surface 1: package.json test:framework-shell, parsed, repo-relative -----
+# Tokens are script paths iff they contain "/" and end .sh/.py; interpreter
+# names and flags are skipped. Paths are relative to packages/mosaic/.
+mapfile -t S1 < <(python3 - "$PKG_JSON" <<'PY'
+import json, shlex, sys
+cmd = json.load(open(sys.argv[1]))["scripts"].get("test:framework-shell", "")
+seen = []
+for seg in cmd.split("&&"):
+    for tok in shlex.split(seg):
+        if "/" in tok and (tok.endswith(".sh") or tok.endswith(".py")):
+            path = "packages/mosaic/" + tok
+            if path not in seen:
+                seen.append(path)
+print("\n".join(seen))
+PY
+)
+
+# --- Surface 2: ci.yml, every framework/tools token wherever it appears ------
+# Comment lines (first non-whitespace char is #) are skipped BEFORE matching:
+# commenting an invocation out is the most common way a suite actually gets
+# disabled, and a raw-text regex would keep calling it enumerated (F1, 20155 on
+# PR #1018 — demonstrated, not argued). Known residual limit: a path named only
+# in a TRAILING comment on a live line still matches; no such line exists today
+# and full fidelity would need a YAML parser the CI image does not ship.
+mapfile -t S2 < <(grep -vE '^[[:space:]]*#' "$CI_YML" \
+    | grep -oE 'packages/mosaic/framework/tools/[A-Za-z0-9_./-]+\.(sh|py)' | sort -u)
+
+# --- Union, and its population-restricted view -------------------------------
+declare -A ENUM=() ENUM_POP=()
+for p in "${S1[@]:-}" "${S2[@]:-}"; do
+    [[ -n "$p" ]] || continue
+    ENUM["$p"]=1
+    in_population "$p" && ENUM_POP["$p"]=1
+done
+
+# --- Direction B: every surface-named path must exist on disk ----------------
+for p in "${!ENUM[@]}"; do
+    [[ -f "$ROOT/$p" ]] || fail "STALE ENUMERATION: surfaces name '$p' but it does not exist on disk"
+done
+
+# --- Exclusions: parsed with the same rigor the enumeration gets -------------
+declare -A EXCLUDED=()
+if [[ -f "$EXCLUSIONS" ]]; then
+    lineno=0
+    while IFS= read -r line; do
+        lineno=$(( lineno + 1 ))
+        [[ "$line" =~ ^[[:space:]]*(#|$) ]] && continue
+        path="${line%%|*}"; reason="${line#*|}"
+        path="$(echo "$path" | sed 's/^[[:space:]]*//; s/[[:space:]]*$//')"
+        reason="$(echo "$reason" | sed 's/^[[:space:]]*//; s/[[:space:]]*$//')"
+        if [[ "$line" != *"|"* || -z "$reason" ]]; then
+            fail "EXCLUSION MISSING REASON: line $lineno ('$path') — an exclusion is a recorded decision someone signed"
+            continue
+        fi
+        if [[ ! -f "$ROOT/$path" ]]; then
+            fail "STALE EXCLUSION: line $lineno excludes '$path' which does not exist on disk"
+            continue
+        fi
+        if ! in_population "$path"; then
+            fail "EXCLUSION OUTSIDE POPULATION: line $lineno excludes '$path' which the population pattern does not name — dead weight that reads as coverage"
+            continue
+        fi
+        if [[ -n "${ENUM[$path]:-}" ]]; then
+            fail "CONTRADICTORY EXCLUSION: line $lineno excludes '$path' which the surfaces already enumerate"
+            continue
+        fi
+        EXCLUDED["$path"]=1
+    done < "$EXCLUSIONS"
+fi
+
+# --- Direction A: disk population must be enumerated or signed-excluded ------
+disk_total=0
+unlisted=0
+while IFS= read -r f; do
+    rel="${f#"$ROOT"/}"
+    in_population "$rel" || continue
+    disk_total=$(( disk_total + 1 ))
+    if [[ -z "${ENUM_POP[$rel]:-}" && -z "${EXCLUDED[$rel]:-}" ]]; then
+        fail "UNENUMERATED: '$rel' exists on disk but is neither enumerated on any CI surface nor signed in the exclusions file"
+        unlisted=$(( unlisted + 1 ))
+    fi
+done < <(find "$TOOLS_DIR" -type f -name '*.sh' | sort)
+
+if (( fail_count > 0 )); then
+    printf 'enumeration guard: %d failure(s) — population %d, enumerated (in-population) %d, excluded %d\n' \
+        "$fail_count" "$disk_total" "${#ENUM_POP[@]}" "${#EXCLUDED[@]}"
+    exit 1
+fi
+printf 'enumeration guard: OK — population %d, enumerated (in-population) %d, excluded (signed) %d, surfaces name %d path(s), all present on disk\n' \
+    "$disk_total" "${#ENUM_POP[@]}" "${#EXCLUDED[@]}" "${#ENUM[@]}"

packages/mosaic/framework/tools/quality/scripts/test-check-test-enumeration.sh

@@ -0,0 +1,166 @@
+#!/usr/bin/env bash
+# test-check-test-enumeration.sh — needles for the enumeration guard (#1017).
+#
+# Every failure mode the guard promises gets BOTH polarities:
+#   NEEDLE   a fixture that MUST trip the guard, asserted on the guard's OWN
+#            words (--out) — exit 1 alone cannot distinguish "caught the rogue
+#            file" from "choked on the fixture".
+#   CONTROL  a fixture that MUST pass. A guard that failed unconditionally
+#            would satisfy every needle here — the null-case defect the guard's
+#            own subject matter (#1017) exists to make impossible.
+#
+# The needles encode the specific errors that produced #1017's thread:
+#   n6 is the 20124 boundary file (a suite the strict prefix cannot name);
+#   n2b proves surface 2 is PARSED, not line-ranged (three seats mis-scoped
+#       hand-written ranges against ci.yml);
+#   n5/n7 keep the exclusions file honest so it cannot become the next silent cap;
+#   n8/c4 are F1 (20155): a commented-out ci.yml line is NOT enumeration —
+#       commenting-out is the most common way a suite actually gets disabled,
+#       and it must fail loud in one direction without false-staling the other.
+
+set -uo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+GUARD="$HERE/check-test-enumeration.sh"
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+PASS=0; FAIL=0
+
+# fixture <name> — a minimal repo root the guard accepts via --root:
+# one suite enumerated on S1 (plus a naming-outlier suite, so the S1 parser's
+# handling of non-prefix names is always exercised), one on S2, one check-script
+# named on S2 that is outside the population, and an empty exclusions file.
+fixture() {
+    local r="$TMP/$1"
+    mkdir -p "$r/packages/mosaic/framework/tools/git" \
+             "$r/packages/mosaic/framework/tools/tmux" \
+             "$r/packages/mosaic/framework/tools/quality/scripts" \
+             "$r/.woodpecker"
+    printf '#!/usr/bin/env bash\nexit 0\n' > "$r/packages/mosaic/framework/tools/git/test-a.sh"
+    printf '#!/usr/bin/env bash\nexit 0\n' > "$r/packages/mosaic/framework/tools/tmux/outlier.test.sh"
+    printf '#!/usr/bin/env bash\nexit 0\n' > "$r/packages/mosaic/framework/tools/quality/scripts/test-ci.sh"
+    printf '#!/usr/bin/env bash\nexit 0\n' > "$r/packages/mosaic/framework/tools/quality/scripts/verify-thing.sh"
+    cat > "$r/packages/mosaic/package.json" <<'JSON'
+{"scripts": {"test:framework-shell": "bash framework/tools/git/test-a.sh && bash framework/tools/tmux/outlier.test.sh"}}
+JSON
+    cat > "$r/.woodpecker/ci.yml" <<'YML'
+steps:
+  sanitize:
+    commands:
+      - bash packages/mosaic/framework/tools/quality/scripts/verify-thing.sh
+  guard:
+    commands:
+      - bash packages/mosaic/framework/tools/quality/scripts/test-ci.sh
+YML
+    : > "$r/packages/mosaic/framework/tools/quality/test-enumeration-exclusions.txt"
+    printf '%s' "$r"
+}
+
+# expect <kind> <want-exit> <desc> [--out <substring>] -- <root>
+expect() {
+    local kind="$1" want="$2" desc="$3"; shift 3
+    local need_out=""
+    while (( $# )); do
+        case "$1" in
+            --out) need_out="$2"; shift 2 ;;
+            --)    shift; break ;;
+        esac
+    done
+    local root="$1" got=0 out
+    out="$(bash "$GUARD" --root "$root" 2>&1)" || got=$?
+    local why=""
+    [[ "$got" == "$want" ]] || why="wanted exit $want, got $got"
+    if [[ -z "$why" && -n "$need_out" && "$out" != *"$need_out"* ]]; then
+        why="exit $got as expected, but output never said: $need_out"
+    fi
+    if [[ -z "$why" ]]; then
+        printf '  PASS  [%-7s] %s (exit %s)\n' "$kind" "$desc" "$got"
+        PASS=$(( PASS + 1 ))
+    else
+        printf '  FAIL  [%-7s] %s — %s\n' "$kind" "$desc" "$why"
+        printf '%s\n' "$out" | sed 's/^/          | /'
+        FAIL=$(( FAIL + 1 ))
+    fi
+}
+
+excl() { printf '%s\n' "$2" >> "$1/packages/mosaic/framework/tools/quality/test-enumeration-exclusions.txt"; }
+
+echo "=== c1: a fully consistent fixture passes ==="
+R="$(fixture c1)"
+expect CONTROL 0 "consistent tree: both surfaces enumerated, nothing unlisted" \
+    --out "enumeration guard: OK" -- "$R"
+
+echo "=== n1: an on-disk suite reachable from no surface must fail ==="
+R="$(fixture n1)"
+printf '#!/usr/bin/env bash\nexit 0\n' > "$R/packages/mosaic/framework/tools/git/test-rogue.sh"
+expect NEEDLE 1 "unlisted suite is named in the failure" \
+    --out "UNENUMERATED: 'packages/mosaic/framework/tools/git/test-rogue.sh'" -- "$R"
+
+echo "=== n6: the 20124 boundary file — a suite the strict prefix cannot name ==="
+R="$(fixture n6)"
+printf '#!/usr/bin/env bash\nexit 0\n' > "$R/packages/mosaic/framework/tools/git/rogue.test.sh"
+expect NEEDLE 1 "naming-outlier suite (*.test.sh) is a population member, not invisible" \
+    --out "UNENUMERATED: 'packages/mosaic/framework/tools/git/rogue.test.sh'" -- "$R"
+
+echo "=== c3: a non-suite script outside the pattern is outside it on BOTH sides ==="
+R="$(fixture c3)"
+printf '#!/usr/bin/env bash\nexit 0\n' > "$R/packages/mosaic/framework/tools/git/check-unrelated.sh"
+expect CONTROL 0 "check-script on disk, unlisted, outside population: not the guard's business" \
+    --out "enumeration guard: OK" -- "$R"
+
+echo "=== n2/n2b: a surface naming a path absent from disk must fail — both surfaces ==="
+R="$(fixture n2)"
+rm "$R/packages/mosaic/framework/tools/git/test-a.sh"
+expect NEEDLE 1 "S1 (package.json) stale entry" \
+    --out "STALE ENUMERATION: surfaces name 'packages/mosaic/framework/tools/git/test-a.sh'" -- "$R"
+R="$(fixture n2b)"
+rm "$R/packages/mosaic/framework/tools/quality/scripts/test-ci.sh"
+expect NEEDLE 1 "S2 (ci.yml) stale entry — proves ci.yml is parsed, not line-ranged" \
+    --out "STALE ENUMERATION: surfaces name 'packages/mosaic/framework/tools/quality/scripts/test-ci.sh'" -- "$R"
+
+echo "=== c2: a rogue suite with a SIGNED exclusion passes, and is counted ==="
+R="$(fixture c2)"
+printf '#!/usr/bin/env bash\nexit 0\n' > "$R/packages/mosaic/framework/tools/git/test-rogue.sh"
+excl "$R" "packages/mosaic/framework/tools/git/test-rogue.sh | non-hermetic pending fixture work (needle-suite specimen)"
+expect CONTROL 0 "signed exclusion is honoured and visible in the summary" \
+    --out "excluded (signed) 1" -- "$R"
+
+echo "=== n3: an exclusion with no reason is not a decision ==="
+R="$(fixture n3)"
+printf '#!/usr/bin/env bash\nexit 0\n' > "$R/packages/mosaic/framework/tools/git/test-rogue.sh"
+excl "$R" "packages/mosaic/framework/tools/git/test-rogue.sh |   "
+expect NEEDLE 1 "empty reason rejected" --out "EXCLUSION MISSING REASON" -- "$R"
+R="$(fixture n3b)"
+printf '#!/usr/bin/env bash\nexit 0\n' > "$R/packages/mosaic/framework/tools/git/test-rogue.sh"
+excl "$R" "packages/mosaic/framework/tools/git/test-rogue.sh"
+expect NEEDLE 1 "missing separator rejected (the path alone is not a signature)" \
+    --out "EXCLUSION MISSING REASON" -- "$R"
+
+echo "=== n4: an exclusion whose path is gone is stale, not satisfied ==="
+R="$(fixture n4)"
+excl "$R" "packages/mosaic/framework/tools/git/test-vanished.sh | was excluded once, then deleted"
+expect NEEDLE 1 "stale exclusion rejected" --out "STALE EXCLUSION" -- "$R"
+
+echo "=== n5: excluding an enumerated suite is a contradiction, not belt-and-braces ==="
+R="$(fixture n5)"
+excl "$R" "packages/mosaic/framework/tools/git/test-a.sh | already in CI but excluded anyway"
+expect NEEDLE 1 "contradictory exclusion rejected" --out "CONTRADICTORY EXCLUSION" -- "$R"
+
+echo "=== n8/c4: a commented-out ci.yml line is not enumeration (F1, 20155) ==="
+R="$(fixture n8)"
+printf '#!/usr/bin/env bash\nexit 0\n' > "$R/packages/mosaic/framework/tools/git/test-disabled.sh"
+printf '      # - bash packages/mosaic/framework/tools/git/test-disabled.sh\n' >> "$R/.woodpecker/ci.yml"
+expect NEEDLE 1 "suite named only in a commented-out invocation is UNENUMERATED" \
+    --out "UNENUMERATED: 'packages/mosaic/framework/tools/git/test-disabled.sh'" -- "$R"
+R="$(fixture c4)"
+printf '      # - bash packages/mosaic/framework/tools/git/test-vanished.sh\n' >> "$R/.woodpecker/ci.yml"
+expect CONTROL 0 "comment naming an absent path raises no false stale-enumeration" \
+    --out "enumeration guard: OK" -- "$R"
+
+echo "=== n7: excluding a file outside the population is dead weight, not coverage ==="
+R="$(fixture n7)"
+excl "$R" "packages/mosaic/framework/tools/quality/scripts/verify-thing.sh | not a suite but signing it anyway"
+expect NEEDLE 1 "out-of-population exclusion rejected" --out "EXCLUSION OUTSIDE POPULATION" -- "$R"
+
+echo
+printf 'enumeration-guard needles: %d passed, %d failed\n' "$PASS" "$FAIL"
+(( FAIL == 0 ))

packages/mosaic/framework/tools/quality/test-enumeration-exclusions.txt

@@ -0,0 +1,45 @@
+# test-enumeration-exclusions.txt — signed exclusions for check-test-enumeration.sh (#1017).
+#
+# Every entry is a recorded decision: a suite-shaped file that exists on disk,
+# is NOT reachable from any CI surface, and carries the reason someone signed
+# for that. The guard FAILS on an entry with no reason, a stale path, or a path
+# the surfaces already enumerate. Burning an entry down = making it CI-reachable
+# (package.json test:framework-shell or a ci.yml step) and deleting its line.
+#
+# Format: <repo-relative path> | <reason>
+# All entries below were signed at #1017's filing base (main 826a8b3b, 2026-07-31)
+# by pepper (sb-it-1-dt); measurements cited are one-run assertions from that seat.
+
+# --- tools/git: the #1007 five — non-hermetic, resolve real credentials ---
+packages/mosaic/framework/tools/git/test-pr-merge-gitea-empty-uid.sh | resolves real credentials (#1007 census); joins CI after the wrapper-half hermeticity fix (git -C scoping)
+packages/mosaic/framework/tools/git/test-issue-create-interactive-auth.sh | resolves real credentials (#1007 census); joins CI after the wrapper-half hermeticity fix
+packages/mosaic/framework/tools/git/test-gitea-login-resolution.sh | resolves real credentials (#1007 census); joins CI after the wrapper-half hermeticity fix
+packages/mosaic/framework/tools/git/test-pr-metadata-gitea.sh | resolves real credentials (#1007 census, fourth entry via family-grep); joins CI after the wrapper-half hermeticity fix
+packages/mosaic/framework/tools/git/test-issue-comment-readback.sh | resolves real credentials (#1007 census, fifth entry); joins CI after the wrapper-half hermeticity fix
+
+# --- tools/git: push guards — measured green locally, CI-image fitness unverified ---
+packages/mosaic/framework/tools/git/test-push-guard.sh | measured green at 826a8b3b (46 passed / 0 failed, one run, 2026-07-31); CI-image fitness unverified; #1017 burndown
+packages/mosaic/framework/tools/git/test-mutate-push-guard.sh | measured green at 826a8b3b (8/0, 13 mutants killed 0 survived, one run, 2026-07-31); requires setsid (util-linux), absent from the alpine base image; #1017 burndown
+packages/mosaic/framework/tools/git/test-issue-create-body-safety.sh | hermeticity unaudited — the unprotected suite in #1007's protected/unprotected split; audit before CI; #1017 burndown
+
+# --- tools/git: unmeasured ---
+packages/mosaic/framework/tools/git/test-verify-clean-clone.sh | unmeasured in CI image; asserts git file-mode (100644/755) semantics that need verification on the CI filesystem first; #1017 burndown
+packages/mosaic/framework/tools/git/test-help-exit-code.sh | unmeasured in CI image; stub-based (#701 regression harness), likely CI-fit; #1017 burndown
+packages/mosaic/framework/tools/git/test-lane-brief-pr-linkage.sh | unmeasured in CI image; fixture-based (#546/#547 regression harness), likely CI-fit; #1017 burndown
+
+# --- tools/tmux: require a live tmux server ---
+packages/mosaic/framework/tools/tmux/test-send-message-socket.sh | requires a real tmux server on a throwaway socket; CI image ships no tmux; #1017 burndown (needs tmux in image or a signed permanent exclusion)
+packages/mosaic/framework/tools/tmux/test-send-message-verdict.sh | requires real tmux-pane fixtures on a throwaway socket; CI image ships no tmux; #1017 burndown (same condition as its sibling)
+
+# --- single-suite directories: unmeasured in CI ---
+packages/mosaic/framework/tools/fleet/test-start-agent-session.sh | unmeasured in CI image; stubs tmux via a fake bin dir, likely CI-fit; #1017 burndown
+packages/mosaic/framework/tools/glpi/test-list-http-status.sh | unmeasured in CI image; stub-based (#807 regression harness), likely CI-fit; #1017 burndown
+packages/mosaic/framework/tools/orchestrator/test-board-roll.sh | unmeasured in CI image; file-fixture based, likely CI-fit; #1017 burndown
+packages/mosaic/framework/tools/woodpecker/test-ci-wait-exit-matrix.sh | unmeasured in CI image; drives ci-wait.sh against a stub pipeline-status.sh, likely CI-fit; #1017 burndown
+
+# --- naming-boundary files the strict test-*.sh prefix cannot even name ---
+# (#1017: three independent censuses handled the microtest file three different
+# ways — editorial drop, structural exclusion, accidental inclusion — with no
+# recorded judgement. These lines ARE that judgement, signed.)
+packages/mosaic/framework/tools/orchestrator/smoke-test.sh | behavior smoke checks for coord continue/run workflows, run manually by orchestrator seats; unmeasured in CI; #1017 burndown
+packages/mosaic/framework/tools/wake/validate-973/microtest-wake-assert.sh | #973 instrument self-test, run as a precondition of the validate-973 evidence procedure rather than as a standing CI suite; #1017 burndown candidate

packages/mosaic/framework/tools/wake/detector.sh

@@ -529,7 +529,19 @@ cmd_run() {
         echo "detector.sh: WARN — off-host liveness beacon emit failed (see beacon.sh); the off-host absence check remains the authoritative dead-man." >&2
     fi
     [ "$once" -eq 1 ] && break
-    sleep "$interval"
+    # Close the detector lock fd in the sleep child; otherwise an orphaned sleep
+    # keeps the single-instance flock (fd 9, taken at exec 9> above) alive after
+    # the detector parent dies. The lock is non-blocking (`flock -n`, above), so
+    # for as long as that sleep survives a replacement instance is REFUSED and
+    # exits rather than queueing. This particular hold is BOUNDED by one poll
+    # interval (WAKE_DETECTOR_INTERVAL, default 30s): when the orphaned sleep
+    # exits its copy of fd 9 closes, ending this bounded sleep-child hold. It
+    # does NOT follow that the next start succeeds — other inheritors of fd 9
+    # (the M1 adapter, M2 sink grandchildren) are outside this patch's scope and
+    # can keep holding the flock. The cost this removes is a restart window in
+    # which every supervisor retry fails on the sleep child's account.
+    # `9>&-` closes ONLY the child's copy — the parent's lock is unaffected.
+    sleep "$interval" 9>&-
   done
 }
 

packages/mosaic/package.json

@@ -25,7 +25,7 @@
     "lint": "eslint src",
     "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
-    "test:framework-shell": "python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh"
+    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-parse.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh"
   },
   "dependencies": {
     "@mosaicstack/brain": "workspace:*",