stack/agents/darkwing/work/queue-188/BUILD.md

Row 188: stack-release tests for a carried proof pair and a proof file inside the repository

Brief: docs/plans/2026-10-20_proof-test-gaps.md (on origin/refactor 525990ecb). Gitea #1686, P19 409 (M8) and 410 (M9), Filbert's N1 and N2 on row 187 (#1685 comment 29424). Owner Darkwing, reviewer Filbert, gate owner Sage. Mos ruled this row lands before the Part B window runs (mos-0956).

Files

File	What
build.patch	the change, git diff 525990ecb over the one path below
candidate-manifest.sha256	one line for that path

• Base: 525990ecb. The brief names 742e98976, and the three commits above it touch only docs and the queue.
• Changed: packages/cli/tests/stack-release.test.mjs only. scripts/stack-release.sh is untouched, and its blob is still 2586a2a37cd2e7c7aeaba6d31490e5b7920fb4b2, the one the Part B window file names. scripts/webui-service.sh, docs/TOOLS.md and packages/webui are untouched too. P19 407 and 408 are not in this row.

Script line numbers below are at 525990ecb, which match the brief's (same blob).

The tests

One new top-level test, T54 row 188, after T53, with six subtests. Each one makes its own stand-in with mk and the preview flags with seedPreview, and ends with noLeak. That check fails on any open or read of a watched proof file, and on SENTINEL in any output, unit, pointer, log or steps log.

Subtest	Brief test	Setup	What it pins
test 1, chmod 644	1	activate B with the pair, then chmod the file 644	--plan for activate C1 lists proof: carried and exactly one refusal, proof-file-invalid: ... has mode 644, not 600 or 400; the run refuses the same before anything stops; the pointer stays on B with the pair
test 1, symlink	1	same, then the path becomes a symlink to a watched mode-600 file	the same, with ... is a symlink
test 1, removal	1	same, then the path is removed	the same, with ... cannot be found
test 2	2	activate C1 with the pair, then chmod 644	--plan for rollback (to B, whose Console takes the pair) lists proof: carried and the one refusal; the run refuses before anything stops; the pointer stays on C1 with the pair
test 3	3	a mode-600 file of the test's uid at <repo>/proof-r188/proof.188, with the pair on activate C1	the plan and the run refuse ... is inside the repository or the copies
test 4	4	<e.root>/repo-link.188, a directory symlink to <repo>/proof-r188, with the file given through it	the test asserts that the given path's last part is not a symlink and the path is outside REPO; the plan and the run refuse on its realpath with the same reason

"The run refuses before anything stops" is the existing refused helper (:881 of the test file): exit 3, the exact message, no unit, wrapper, pointer or store change, no start or stop, and one log line with result: refused.

The other change to the test file: proofFile takes an optional fourth argument, the directory, with the old e.root as its default, so tests 3 and 4 can put a watched file inside the fixture REPO. Each of those subtests removes its proof-r188 directory in t.after. linkSync joins the node:fs import.

The uid case is out of reach without root, as the brief says, and has no test.

Readings of the brief

1. "No log line" in brief test 1. A precheck refusal in a real run writes one log line, result: refused with the code, as every refusal does since the log began (T53 test 5 and every other refused case pin it). I read the brief as no activation line, which refused pins: one line, refused, and no unit or pointer change. Changing that would need a script change, which this row can't make.
2. Removal and the symlink swap keep a hard link to the old file under e.root before they unlink its path. The read watch is on the inode. When a watched inode is freed, inotify sends IN_IGNORED, which no mask filters out, and the watch counts it as an event. A probe of the T53 watch counted 1 after a plain unlink and 0 with a hard link kept. The script sees the same thing either way: the path is gone, or it is a symlink.

Results

All runs are from ~/darkwing-scratch/r188/run188.sh, in a git worktree of 525990ecb plus the candidate, with TMPDIR under ~/darkwing-scratch. The runs took 10:38:55Z-10:46:50Z.

• The whole stack-release.test.mjs passes 151/151 (144 before this row, plus T54 and its six subtests).
• Control: on the unchanged script (blob 2586a2a37c), T53 and T54 pass 19/19. The brief's base control is this run. The row changes no script, so base and candidate run the same script, and the new tests must pass on it.
• Mutants. The runner runs T53 and T54 under each one, then puts the script back and checks its sha256. The restore matched every time, and the worktree script is blob 2586a2a37c after the run.

Mutant	Replacement	Fails	Failing subtests
M8	return 0 before the fi that ends the carried branch (:738)	5	T54 test 1 (all three changes) and test 2
M9	"$REPO" | "$REPO"/* | dropped from the realpath case (:775)	3	T54 tests 3 and 4
M10	why=""; [ -z "$PROOF_HEADER" ] || why="$(proof_file_problem "$2")" (:759)	5	T54 test 1 (all three changes) and test 2

The fail counts include the T54 parent. Each failing subtest stops at its first --plan (exit 0, not 3). T53 passes under all three mutants, which matches Filbert's finding that M8 and M9 survived it. The new tests are what kill them.

Candidate

• candidate-manifest.sha256 (sha256 86aa549bad75...): d38a2f9d6e4ece57907e95b9c24601ec823cfab8d22ab783a8ee64c79104100b packages/cli/tests/stack-release.test.mjs
• build.patch (sha256 db7e41b2ba76..., 85 lines) applies on 525990ecb, and sha256sum -c of the manifest passes on the result.

For Sage's gate

• The one changed path is packages/cli/tests/stack-release.test.mjs. No test or script reads it as a file (grep -rln stack-release.test packages/*/tests scripts/test-*.sh finds nothing), and no file pins the base blob's sha256 (95e44c2f...).
• Run the cli suite and every scripts/test-*.sh from a git worktree of the candidate, as the brief says.