[
  {
    "id": "M1",
    "file": "scripts/case2-unit.sh",
    "old": "            --tester-port) die \"case2-unit.sh retires tester TCP; use --tester-socket\" ;;",
    "new": "",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "row253 factory refuses retired TCP"
  },
  {
    "id": "M2",
    "file": "scripts/case2-unit.sh",
    "old": "[ \"$PROFILE\" = factory ] || die \"the library profile refuses --tester-socket\"",
    "new": ":",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "library refuses a privileged-floor miss"
  },
  {
    "id": "M3",
    "file": "scripts/case2-unit.sh",
    "old": "        [ -z \"${seen[$name]:-}\" ] || die \"serve flag $name given twice\"",
    "new": "        :",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "factory refuses duplicate socket"
  },
  {
    "id": "M4",
    "file": "scripts/case2-unit.sh",
    "old": "    [ \"$rc\" = 0 ] || { case \"$rc\" in 81|85|86|87|88) exit \"$rc\" ;; *) exit 87 ;; esac; }",
    "new": "    :",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "row253 installer refuses unsafe location and query facts"
  },
  {
    "id": "M5",
    "file": "scripts/case2-unit.sh",
    "old": "            [ \"$TS_MARKED\" = true ] || die \"the target does not support --tester-socket\"",
    "new": "            :",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "row253 installer refuses unsafe location and query facts"
  },
  {
    "id": "M6",
    "file": "scripts/case2-unit.sh",
    "old": "case \"$data\" in \"$home\"/*)",
    "new": "case \"$data\" in \"$home\"*)",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "row253 installer refuses unsafe location and query facts"
  },
  {
    "id": "M7",
    "file": "scripts/case2-unit.sh",
    "old": "case \"$home/\" in /home/*",
    "new": "case /allowed/ in /home/*",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "row253 protected homes"
  },
  {
    "id": "M8",
    "file": "scripts/case2-unit.sh",
    "old": "    [ \"${#TS_SOCKET}\" -le 107 ] || { TS_REASON=too-long; return 1; }",
    "new": "    :",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "row253 installer refuses unsafe location and query facts"
  },
  {
    "id": "M9",
    "file": "scripts/case2-unit.sh",
    "old": "        [ -d \"$parent\" ] || { TS_REASON=parent-type; return 1; }",
    "new": "        :",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "row253 installer refuses unsafe location and query facts"
  },
  {
    "id": "M10",
    "file": "scripts/case2-unit.sh",
    "old": "        [ \"${st% *}\" = \"$uid\" ] || { TS_REASON=parent-owner; return 1; }",
    "new": "        :",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "row253 installer refuses unsafe location and query facts"
  },
  {
    "id": "M11",
    "file": "scripts/case2-unit.sh",
    "old": "        [[ \"${st#* }\" =~ ^[0-7]{3,4}$ ]] && (( (8#${st#* } & 8#077) == 0 )) || { TS_REASON=parent-mode; return 1; }",
    "new": "        :",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "row253 installer refuses unsafe location and query facts"
  },
  {
    "id": "M12",
    "file": "scripts/case1-accept.sh",
    "old": "            --tester-port) refuse \"case1-accept.sh retires tester TCP; use --tester-socket\" ;;",
    "new": "",
    "killer": "packages/cli/tests/case1-accept.test.mjs",
    "pattern": "a bad args file refuses"
  },
  {
    "id": "M13",
    "file": "scripts/case1-accept.sh",
    "old": "[ \"$TESTER_SOCKET\" = 1 ] || refuse \"$ARGS_FILE needs one bare --tester-socket after --\"",
    "new": ":",
    "killer": "packages/cli/tests/case1-accept.test.mjs",
    "pattern": "a bad args file refuses"
  },
  {
    "id": "M14",
    "file": "scripts/case1-accept.sh",
    "old": "            *) refuse \"unknown serve flag $a\" ;;",
    "new": "            *) : ;;",
    "killer": "packages/cli/tests/case1-accept.test.mjs",
    "pattern": "a bad args file refuses"
  },
  {
    "id": "M15",
    "file": "scripts/case1-accept.sh",
    "old": "    [ \"$rc\" = 0 ] || { case \"$rc\" in 81|85|86|87|88) exit \"$rc\" ;; *) exit 87 ;; esac; }",
    "new": "    :",
    "killer": "packages/cli/tests/case1-accept.test.mjs",
    "pattern": "row253 acceptance rejects bad config"
  },
  {
    "id": "M16",
    "file": "scripts/case1-accept.sh",
    "old": "other=\"$(listeners 7331)$(listeners 7333)\"",
    "new": "other=\"$(listeners 7331)\"",
    "killer": "packages/cli/tests/case1-accept.test.mjs",
    "pattern": "row253 P8 refuses"
  },
  {
    "id": "M17",
    "file": "scripts/case1-accept.sh",
    "old": "    [[ \"$p\" =~ ^$MOSAIC_UID\\ 700\\ directory\\ [0-9]+\\ [0-9]+$ ]] || return 1",
    "new": "    :",
    "killer": "packages/cli/tests/case1-accept.test.mjs",
    "pattern": "row253 P10 refuses unsafe metadata"
  },
  {
    "id": "M18",
    "file": "scripts/case1-accept.sh",
    "old": "    [[ \"$s\" =~ ^$MOSAIC_UID\\ 600\\ socket\\ [0-9]+\\ [0-9]+$ ]] || return 1",
    "new": "    :",
    "killer": "packages/cli/tests/case1-accept.test.mjs",
    "pattern": "row253 P10 refuses unsafe metadata"
  },
  {
    "id": "M19",
    "file": "scripts/case1-accept.sh",
    "old": "[ \"$pid\" = \"$CON_PID\" ] && [ \"$uid\" = \"$MOSAIC_UID\" ]",
    "new": "true && [ \"$uid\" = \"$MOSAIC_UID\" ]",
    "killer": "packages/cli/tests/case1-accept.test.mjs",
    "pattern": "row253 P10 refuses unsafe metadata"
  },
  {
    "id": "M20",
    "file": "scripts/case1-accept.sh",
    "old": "[ \"$pid\" = \"$CON_PID\" ] && [ \"$uid\" = \"$MOSAIC_UID\" ]",
    "new": "[ \"$pid\" = \"$CON_PID\" ] && true",
    "killer": "packages/cli/tests/case1-accept.test.mjs",
    "pattern": "row253 P10 refuses unsafe metadata"
  },
  {
    "id": "M21",
    "file": "scripts/case1-accept.sh",
    "old": "pattern='^([1-9][0-9]{0,9}) ([0-9]{1,10}) ([0-9]{1,10})$'",
    "new": "pattern='^([1-9][0-9]{0,9}) ([0-9]{1,10}) ([0-9]{1,10})'",
    "killer": "packages/cli/tests/case1-accept.test.mjs",
    "pattern": "row253 P10 refuses unsafe metadata"
  },
  {
    "id": "M22",
    "file": "scripts/case1-accept.sh",
    "old": "    magic=\"$(od -An -tx1 -N4 -- \"$ROOT$real\" 2>/dev/null | tr -d ' \\n')\"\n    [ \"$magic\" = 7f454c46 ] || return 1",
    "new": "    magic=\"$(od -An -tx1 -N4 -- \"$ROOT$real\" 2>/dev/null | tr -d ' \\n')\"\n    :",
    "killer": "packages/cli/tests/case1-accept.test.mjs",
    "pattern": "row253 P10 refuses unsafe metadata"
  },
  {
    "id": "M23",
    "file": "scripts/case1-accept.sh",
    "old": "        [ \"$before\" = \"$after\" ] || why=changed",
    "new": "        :",
    "killer": "packages/cli/tests/case1-accept.test.mjs",
    "pattern": "row253 P10 refuses unsafe metadata"
  },
  {
    "id": "M24",
    "file": "scripts/case2-unit.sh",
    "old": "sudo -u \"$user\" -H env -i",
    "new": "sudo -H env -i",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "row253 factory socket uses actual config"
  },
  {
    "id": "M25",
    "file": "scripts/case1-accept.sh",
    "old": "tester_capture 2 4 128 \"$S_USER\" \"$S_HOME\"",
    "new": "tester_capture 2 4 128 wrong-user \"$S_HOME\"",
    "killer": "packages/cli/tests/case1-accept.test.mjs",
    "pattern": "row253 socket observation uses configured root"
  },
  {
    "id": "M26",
    "file": "scripts/case1-accept.sh",
    "old": "    [[ \"$floor\" =~ ^[0-9]{1,5}$ ]] && [ \"$floor\" -gt \"$PORT\" ] || why=floor",
    "new": "    :",
    "killer": "packages/cli/tests/case1-accept.test.mjs",
    "pattern": "row253 P10 refuses unsafe metadata"
  },
  {
    "id": "M27",
    "file": "scripts/case1-accept.sh",
    "old": "p=struct.unpack(\"3i\",s.getsockopt(socket.SOL_SOCKET,socket.SO_PEERCRED,12))",
    "new": "import os; p=(os.getpid(),os.getuid(),os.getgid())",
    "killer": "packages/cli/tests/case1-accept.test.mjs",
    "pattern": "row253 socket observation uses configured root"
  },
  {
    "id": "M28",
    "file": "scripts/case2-unit.sh",
    "old": "    [ ! -L \"$parent\" ] || { TS_REASON=symlink-parent; return 1; }",
    "new": "    :",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "row253 installer refuses unsafe location and query facts"
  },
  {
    "id": "M29",
    "file": "scripts/case2-unit.sh",
    "old": "        [ ! -L \"$prefix$at\" ] || { TS_REASON=symlink-component; return 1; }",
    "new": "        :",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "row253 installer refuses unsafe location and query facts"
  },
  {
    "id": "M30",
    "file": "scripts/case2-unit.sh",
    "old": "    case \"$data/\" in */./*|*/../*|*//* ) TS_REASON=not-normalized; return 1 ;; esac",
    "new": "    :",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "row253 installer refuses unsafe location and query facts"
  },
  {
    "id": "M31",
    "file": "scripts/case2-unit.sh",
    "old": "    [[ \"$1\" =~ $pattern ]] || return 1",
    "new": "    [[ \"$1\" =~ \\\"dataRoot\\\":\\\"([^\\\"]+)\\\",\\\"socket\\\":(true|false) ]] || return 1",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "row253 config parser is strict"
  },
  {
    "id": "M32",
    "file": "scripts/case2-unit.sh",
    "old": "[ \"$(wc -c < \"$file\")\" -le \"$maximum\" ]",
    "new": "true",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "row253 C4 overflow is output-limit"
  },
  {
    "id": "M33",
    "file": "scripts/case2-unit.sh",
    "old": "\"$TS_TIMEOUT\" --verbose --signal=KILL \"${outer}s\"",
    "new": "\"$TS_TIMEOUT\" --foreground --verbose --signal=KILL \"${outer}s\"",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "row253 query reaps its group"
  },
  {
    "id": "M34",
    "file": "scripts/case2-unit.sh",
    "old": "seconds=\"$1\" setsid_bin=\"$2\" sleep_bin=\"$3\"; shift 3",
    "new": "seconds=\"$1\" setsid_bin=\"$2\" sleep_bin=\"$3\"; shift 3\nexec \"$@\"",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "row253 C4 signals query"
  },
  {
    "id": "M35",
    "file": "scripts/case2-unit.sh",
    "old": "LC_ALL=C \"$TS_TIMEOUT\" --verbose --signal=KILL \"${outer}s\" \"$TS_BASH\" -c",
    "new": "\"$TS_BASH\" -c",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "row253 C4 stalled supervisor"
  },
  {
    "id": "M36",
    "file": "scripts/case2-unit.sh",
    "old": "            [ \"$ST_SESSION\" = \"$child\" ] || continue",
    "new": "            [ \"$ST_SESSION\" = \"$child\" ] || continue\n            [ \"$ST_GROUP\" = \"$child\" ] || continue",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "row253 C4 member query"
  },
  {
    "id": "M37",
    "file": "scripts/case2-unit.sh",
    "old": "    LC_ALL=C \"$TS_TIMEOUT\" --verbose --signal=KILL \"${outer}s\" \"$TS_BASH\" -c '\n        set -o pipefail\n        maximum=\"$1\"; head_bin=\"$2\"; shift 2\n        \"$@\" 2>/dev/null | \"$head_bin\" -c \"$((maximum + 1))\"\n    ' -- \"$maximum\" \"$TS_HEAD\" sudo -u \"$user\" -H env -i \"HOME=$home\" \"PATH=$path\" \"$TS_BASH\" -c \"$TESTER_SUPERVISOR\" -- \"$inner\" \"$TS_SETSID\" \"$TS_SLEEP\" \"$@\" > \"$file\" 2> \"$notice\" &\n    child=$!\n    wait \"$child\" 2>/dev/null || rc=$?\n    kill -KILL -- \"-$child\" 2>/dev/null || :\n    # Only GNU timeout and the trusted head can write this root-side channel.\n    if [ \"$rc\" = 137 ] && [[ \"$(<\"$notice\")\" == *': sending signal KILL to command '* ]]; then exit 82; fi\n    [ \"$(wc -c < \"$file\")\" -le \"$maximum\" ] || exit 83\n    [ \"$rc\" = 0 ] || { case \"$rc\" in 81|85|86|87|88) exit \"$rc\" ;; *) exit 87 ;; esac; }",
    "new": "    LC_ALL=C \"$TS_TIMEOUT\" --verbose --signal=KILL \"${outer}s\" \"$TS_BASH\" -c '\n        set -o pipefail\n        maximum=\"$1\"; head_bin=\"$2\"; shift 2\n        \"$@\" 2>/dev/null | cat\n    ' -- \"$maximum\" \"$TS_HEAD\" sudo -u \"$user\" -H env -i \"HOME=$home\" \"PATH=$path\" \"$TS_BASH\" -c \"$TESTER_SUPERVISOR\" -- \"$inner\" \"$TS_SETSID\" \"$TS_SLEEP\" \"$@\" > \"$file\" 2> \"$notice\" &\n    child=$!\n    wait \"$child\" 2>/dev/null || rc=$?\n    kill -KILL -- \"-$child\" 2>/dev/null || :\n    # Only GNU timeout and the trusted head can write this root-side channel.\n    if [ \"$rc\" = 137 ] && [[ \"$(<\"$notice\")\" == *': sending signal KILL to command '* ]]; then exit 82; fi\n    :\n    [ \"$rc\" = 0 ] || { case \"$rc\" in 81|85|86|87|88) exit \"$rc\" ;; *) exit 87 ;; esac; }",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "row253 C4 overflow is output-limit"
  },
  {
    "id": "M38",
    "file": "scripts/case2-unit.sh",
    "old": "\"$setsid_bin\" \"$@\" & child=$!",
    "new": "\"$@\" & child=$!",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "row253 C4 signals query"
  },
  {
    "id": "M39",
    "file": "scripts/case2-unit.sh",
    "old": "MOSAIC_TESTER_SUPERVISOR' || :\nset +m",
    "new": "MOSAIC_TESTER_SUPERVISOR' || :\n# one-copy drift\nset +m",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "row253 C4 inline supervisor is byte-identical"
  },
  {
    "id": "M40",
    "file": "scripts/case2-unit.sh",
    "old": "clean_session() {\n    local entry pid rc live until=\"\"\n    while :; do\n        live=0\n        for entry in /proc/[0-9]*/stat; do\n            pid=\"${entry%/stat}\"; pid=\"${pid##*/}\"\n            rc=0; stat_fields \"$pid\" || rc=$?\n            [ \"$rc\" != 3 ] || continue\n            [ \"$rc\" = 0 ] || return 1\n            [ \"$ST_SESSION\" = \"$child\" ] || continue\n            case \"$ST_STATE\" in Z|X) continue ;; esac\n            live=1\n            if ! kill -KILL \"$pid\" 2>/dev/null; then\n                rc=0; stat_fields \"$pid\" || rc=$?\n                [ \"$rc\" = 3 ] || { [ \"$rc\" = 0 ] && { [ \"$ST_STATE\" = Z ] || [ \"$ST_STATE\" = X ]; }; } || return 1\n            fi\n        done\n        [ \"$live\" != 0 ] || return 0\n        clock_cs || return 1\n        # Inventory pass 1 is outside the bounded confirmation/retry budget.\n        [ -n \"$until\" ] || until=$((CLOCK_CS + 25))\n        [ \"$CLOCK_CS\" -lt \"$until\" ] || return 1\n        \"$sleep_bin\" 0.01\n    done\n}\n",
    "new": "clean_session() {\n    local entry pid rc live until\n    clock_cs || return 1\n    until=$((CLOCK_CS + 25))\n    while :; do\n        live=0\n        for entry in /proc/[0-9]*/stat; do\n            pid=\"${entry%/stat}\"; pid=\"${pid##*/}\"\n            rc=0; stat_fields \"$pid\" || rc=$?\n            [ \"$rc\" != 3 ] || continue\n            [ \"$rc\" = 0 ] || return 1\n            [ \"$ST_SESSION\" = \"$child\" ] || continue\n            case \"$ST_STATE\" in Z|X) continue ;; esac\n            live=1\n            if ! kill -KILL \"$pid\" 2>/dev/null; then\n                rc=0; stat_fields \"$pid\" || rc=$?\n                [ \"$rc\" = 3 ] || { [ \"$rc\" = 0 ] && { [ \"$ST_STATE\" = Z ] || [ \"$ST_STATE\" = X ]; }; } || return 1\n            fi\n        done\n        [ \"$live\" != 0 ] || return 0\n        clock_cs || return 1\n        # Inventory pass 1 is outside the bounded confirmation/retry budget.\n        :\n        [ \"$CLOCK_CS\" -lt \"$until\" ] || return 1\n        \"$sleep_bin\" 0.01\n    done\n}\n",
    "killer": "packages/cli/tests/case2-unit.test.mjs",
    "pattern": "row253 C4 cleanup budget starts after inventory pass one"
  }
]