tep 0.11.5 → 0.11.7

data/lib/tep/shell.rb

@@ -36,18 +36,29 @@ module Tep
 
     # Read a file's contents. Useful for /proc/loadavg, /proc/meminfo,
     # /sys/class/thermal/.../temp, and similar small-text endpoints.
-    # Returns "" on open failure (spinel's File.read swallows fopen
-    # errors and returns the empty string -- matches the prior
-    # sphttp_file_read behaviour).
+    # Returns "" on open failure. Spinel's File.read now raises a
+    # CRuby-correct Errno on a missing/unreadable path (it used to
+    # silently return ""); we rescue here to preserve this helper's
+    # never-raise contract -- a handler reading /proc should get "" for
+    # an absent file, not a 502'd worker.
     def self.read(path)
-      File.read(path)
+      begin
+        File.read(path)
+      rescue => e
+        ""
+      end
     end
 
     # Bounded read: slice after the fact. The cap is mostly a
     # defensive cue -- callers that need it should be reading
-    # bounded /proc files anyway.
+    # bounded /proc files anyway. Same never-raise contract as #read.
     def self.read_limited(path, max_bytes)
-      out = File.read(path)
+      out = ""
+      begin
+        out = File.read(path)
+      rescue => e
+        out = ""
+      end
       out.length > max_bytes ? out[0, max_bytes] : out
     end
 

data/lib/tep/version.rb

@@ -1,3 +1,3 @@
 module Tep
-  VERSION = "0.11.5"
+  VERSION = "0.11.7"
 end

data/lib/tep/websocket/handshake.rb

@@ -26,13 +26,16 @@ module Tep
         end
 
         # Upgrade + Connection headers (downcased per Tep::Request).
+        # A missing header reads as nil; treat it as absent ("").
         upgrade = req.headers["upgrade"]
+        upgrade = "" if upgrade.nil?
         if Handshake.icontains(upgrade, "websocket") == false
           out.valid = false
           out.reason = "missing/invalid Upgrade"
           return out
         end
         conn = req.headers["connection"]
+        conn = "" if conn.nil?
         if Handshake.icontains(conn, "upgrade") == false
           out.valid = false
           out.reason = "missing/invalid Connection"
@@ -49,6 +52,7 @@ module Tep
 
         # Sec-WebSocket-Key: 24-char base64 (16-byte nonce).
         key = req.headers["sec-websocket-key"]
+        key = "" if key.nil?
         if key.length == 0
           out.valid = false
           out.reason = "missing Sec-WebSocket-Key"
@@ -60,7 +64,9 @@ module Tep
 
         # Parse Sec-WebSocket-Protocol (comma-separated). Handler
         # gets the offered list; can opt-in via Driver.accept_protocol.
-        out.protocols = Handshake.split_csv(req.headers["sec-websocket-protocol"])
+        proto_blob = req.headers["sec-websocket-protocol"]
+        proto_blob = "" if proto_blob.nil?
+        out.protocols = Handshake.split_csv(proto_blob)
         out
       end
 

data/lib/tep.rb

@@ -129,6 +129,28 @@ module Tep
     h
   end
 
+  # Read a request cookie. A missing cookie reads as "" -- that is the
+  # documented `cookies["k"]` DSL contract (test_cookies pins it) --
+  # while the underlying hash reads nil for a missing key. bin/tep
+  # rewrites `cookies[k]` reads to this call.
+  def self.cookie(req, k)
+    v = req.cookies[k]
+    v = "" if v.nil?
+    v
+  end
+
+  # Read a request param. A missing param reads as "" -- tep's
+  # documented `params[k]` DSL contract (test_params pins it; a
+  # deliberate divergence from sinatra's nil, ledgered in
+  # docs/mirrors/sinatra.md). bin/tep rewrites `params[k]` reads to
+  # this call; direct `req.params[...]` access keeps raw Hash
+  # semantics (nil on miss).
+  def self.param(req, k)
+    v = req.params[k]
+    v = "" if v.nil?
+    v
+  end
+
   # str_find -- naive substring search returning the int position of
   # `needle` in `s` starting from `start`, or -1 if not found.
   #

data/test/differential/10_semantics.rb

@@ -0,0 +1,56 @@
+# Differential fixture: core routing/response semantics that both real
+# sinatra and tep claim. This file must stay valid under BOTH dialects
+# (docs/mirrors/sinatra.md condition 2) -- no tep extensions
+# (request.headers, cookies[], set_cookie) and no sinatra-contrib.
+require 'sinatra'
+
+get '/hi/:name' do
+  'hi ' + params[:name]
+end
+
+get '/two/:a/:b' do
+  params[:a] + '-' + params[:b]
+end
+
+get '/q' do
+  q = params[:q]
+  q = '' if q.nil?
+  'q=' + q
+end
+
+post '/form' do
+  t = params[:text]
+  t = '' if t.nil?
+  'text=' + t
+end
+
+get '/redir' do
+  redirect '/hi/there'
+end
+
+get '/redir301' do
+  redirect '/hi/there', 301
+end
+
+get '/teapot' do
+  status 418
+  'short and stout'
+end
+
+get '/halted' do
+  halt 401, 'no entry'
+end
+
+get '/hdr' do
+  headers['x-custom'] = 'yes'
+  'ok'
+end
+
+get '/ct' do
+  content_type 'text/plain'
+  'plain body'
+end
+
+not_found do
+  'nope: ' + request.path
+end

data/test/differential/11_matrix.rb

@@ -0,0 +1,63 @@
+# Differential fixture: broader Phase A matrix coverage. Valid under
+# BOTH real sinatra and tep (docs/mirrors/sinatra.md condition 2).
+# Divergent read-APIs (splat value, regex captures, cookies DSL) are
+# deliberately NOT read here -- routes only exercise surface both
+# dialects share; the known divergences are pinned by the runner's
+# ledgered-divergence assertions instead.
+require 'sinatra'
+
+put '/verb' do
+  'put-ok'
+end
+
+patch '/verb' do
+  'patch-ok'
+end
+
+# Splat: single-segment matches in both dialects. The VALUE is not
+# read (sinatra: params['splat'] array; tep: no exposed value) and
+# multi-segment matching diverges -- see runner ledger L5.
+get '/files/*' do
+  'file-route'
+end
+
+# Regex route, no capture reads (sinatra: params['captures']; tep:
+# params["1"] -- runner ledger L6). Unanchored on purpose: sinatra's
+# mustermann raises at boot on ^/$ anchors (it anchors implicitly),
+# while tep accepts them -- anchored regex routes are tep-only (L6).
+get %r{/rx/\d+} do
+  'rx-route'
+end
+
+# after-filter mutating a response header; both dialects claim it.
+after do
+  headers['x-after'] = 'ran'
+end
+
+get '/afterhdr' do
+  'body'
+end
+
+# Query-string URL decoding: %xx and `+` as space.
+get '/dec' do
+  v = params[:v]
+  v = '' if v.nil?
+  'v=[' + v + ']'
+end
+
+# Multipart/form-data: text fields merge into params in both dialects
+# (file parts are tep-ledgered as skipped; not exercised here).
+post '/mp' do
+  f = params[:field]
+  f = '' if f.nil?
+  'field=[' + f + ']'
+end
+
+# Bare halt (status only, empty body).
+get '/gone' do
+  halt 410
+end
+
+not_found do
+  'nf: ' + request.path
+end

data/test/differential/Gemfile

@@ -0,0 +1,14 @@
+# Gems for the differential oracle ONLY (test/differential/runner.rb):
+# real sinatra as the behavioural reference. Deliberately a separate
+# Gemfile so sinatra never becomes a dependency of tep itself -- the
+# main Gemfile stays rake/minitest/base64/rbs.
+#
+#   BUNDLE_GEMFILE=test/differential/Gemfile bundle install
+#   ruby test/differential/runner.rb
+
+source "https://rubygems.org"
+
+gem "sinatra"
+gem "rackup"
+gem "puma"
+gem "minitest"

data/test/differential/runner.rb

@@ -0,0 +1,250 @@
+# Differential oracle: real sinatra vs tep (mirror condition 2,
+# docs/mirrors/sinatra.md). Boots each fixture app twice -- once under
+# CRuby + the real sinatra gem, once as a tep-compiled binary -- fires
+# the same requests at both, and diffs status / body / declared
+# headers. Any divergence not recorded in LEDGER is a failure: new
+# divergences must be either fixed or explicitly ledgered with a
+# reason (which then belongs in docs/mirrors/sinatra.md too).
+#
+# Not part of `rake test` (FileList only globs test/test_*.rb): the
+# sinatra gem must never become a tep dependency. Run explicitly:
+#
+#   gem install sinatra rackup puma       # or bundle with ./Gemfile
+#   ruby test/differential/runner.rb
+#
+# CI runs this as its own job (`differential` in ci.yml).
+
+begin
+  gem "sinatra"
+rescue Gem::LoadError
+  abort "differential runner needs the sinatra gem (gem install sinatra rackup puma)"
+end
+
+require "minitest/autorun"
+require "net/http"
+require "socket"
+require "tmpdir"
+require "fileutils"
+require "shellwords"
+require "rbconfig"
+
+module Differential
+  TEP_BIN   = File.expand_path("../../bin/tep", __dir__)
+  ROOT      = File.expand_path("../..", __dir__)
+  PORT_BASE = 5300 + ($$ % 100)
+
+  @port = PORT_BASE
+  def self.next_port
+    @port += 1
+  end
+
+  # ---- the exclusion ledger, harness-side ----
+  # Divergences we accept, keyed by response facet. Every entry needs a
+  # reason and should be mirrored in docs/mirrors/sinatra.md. The
+  # runner *normalizes* these away before diffing; anything left is a
+  # real, unledgered divergence and fails the run.
+  #
+  # L1 content-type charset: sinatra appends ";charset=utf-8" to text
+  #    types; tep emits the bare type.
+  # L2 protection headers: sinatra ships rack-protection by default
+  #    (x-xss-protection / x-content-type-options / x-frame-options);
+  #    tep's Tep::Security::Headers is opt-in.
+  # L3 server/date/connection/content-length: transport furniture --
+  #    body equality already covers length.
+  # L4 redirect Location absolutization: sinatra expands "/path" to an
+  #    absolute http://host:port/path; tep echoes the path as given.
+  #    Compare path component only.
+  # L5 splat scope: sinatra's `*` spans path segments; tep's matches a
+  #    single trailing segment. Pinned per-request via `diverge:`.
+  # L6 divergent read APIs, not exercised by fixtures: regex captures
+  #    (sinatra params['captures'] / block args vs tep params["1".."9"]),
+  #    splat value (params['splat'] array vs none), request.headers
+  #    (tep extension), bare set_cookie/cookies[] (tep mirrors
+  #    contrib-style helpers), and ^/$-anchored regex routes (tep
+  #    accepts; sinatra's mustermann raises at boot -- anchor-free
+  #    regexes are the portable form). Fixtures avoid these; the
+  #    ledger in docs/mirrors/sinatra.md records them.
+  IGNORED_HEADERS = %w[
+    server date connection content-length x-xss-protection
+    x-content-type-options x-frame-options keep-alive
+  ].freeze
+
+  def self.normalize_content_type(v)
+    v.to_s.split(";").first.to_s.strip.downcase # L1
+  end
+
+  def self.normalize_location(v)
+    return "" if v.nil?
+    v.sub(%r{\Ahttps?://[^/]+}, "") # L4
+  end
+
+  Server = Struct.new(:pid, :port, :log) do
+    def stop
+      return unless pid
+      Process.kill("TERM", -pid) rescue Process.kill("TERM", pid) rescue nil
+      Process.wait(pid) rescue nil
+    end
+  end
+
+  def self.wait_for_port(port, pid, timeout: 15.0)
+    deadline = Time.now + timeout
+    while Time.now < deadline
+      begin
+        TCPSocket.new("127.0.0.1", port).close
+        return true
+      rescue Errno::ECONNREFUSED
+        raise "server died before binding :#{port}" if Process.wait(pid, Process::WNOHANG) rescue nil
+        sleep 0.05
+      end
+    end
+    raise "server on :#{port} didn't come up"
+  end
+
+  def self.boot_sinatra(app_path)
+    port = next_port
+    log  = File.join(Dir.mktmpdir("diff-sin"), "sinatra.log")
+    pid  = Process.spawn(
+      RbConfig.ruby, app_path, "-p", port.to_s, "-o", "127.0.0.1", "-e", "production",
+      out: log, err: [:child, :out], pgroup: true
+    )
+    wait_for_port(port, pid)
+    Server.new(pid, port, log)
+  end
+
+  def self.boot_tep(app_path)
+    tmp = Dir.mktmpdir("diff-tep")
+    bin = File.join(tmp, "app")
+    out = `#{Shellwords.escape(TEP_BIN)} build #{Shellwords.escape(app_path)} -o #{Shellwords.escape(bin)} 2>&1`
+    raise "tep build failed for #{app_path}:\n#{out}" unless $?.success?
+    port = next_port
+    log  = File.join(tmp, "tep.log")
+    pid  = Process.spawn(bin, "-p", port.to_s, "-q",
+                         out: log, err: [:child, :out], pgroup: true)
+    wait_for_port(port, pid)
+    Server.new(pid, port, log)
+  end
+
+  def self.request(port, verb, path, body: nil, headers: {})
+    http = Net::HTTP.new("127.0.0.1", port)
+    http.open_timeout = 5
+    http.read_timeout = 5
+    klass = { "GET" => Net::HTTP::Get, "POST" => Net::HTTP::Post,
+              "PUT" => Net::HTTP::Put, "PATCH" => Net::HTTP::Patch,
+              "DELETE" => Net::HTTP::Delete }.fetch(verb)
+    req = klass.new(path)
+    headers.each { |k, v| req[k] = v }
+    if body
+      req.body = body
+      req["Content-Type"] ||= "application/x-www-form-urlencoded"
+    end
+    http.request(req)
+  end
+end
+
+# One test class per fixture; each boots both servers once and replays
+# the same request script against each.
+class DifferentialCase < Minitest::Test
+  FIXTURES = {
+    File.expand_path("../real_world/01_simple.rb", __dir__) => [
+      ["GET", "/"],
+    ],
+    File.expand_path("../real_world/04_health_api.rb", __dir__) => [
+      ["GET", "/healthz"],
+      ["GET", "/version"],
+      ["GET", "/"],
+      ["GET", "/missing"],          # custom not_found on both
+    ],
+    File.expand_path("../real_world/05_todo_api.rb", __dir__) => [
+      ["GET", "/todos"],
+      ["POST", "/todos", { body: "text=buy-milk" }],
+      ["POST", "/todos", { body: "text=ship-tep" }],
+      ["GET", "/todos"],
+      ["DELETE", "/todos/1"],
+      ["DELETE", "/todos/9999"],
+      ["GET", "/todos"],
+    ],
+    File.expand_path("11_matrix.rb", __dir__) => [
+      ["PUT", "/verb"],
+      ["PATCH", "/verb"],
+      ["GET", "/files/one"],
+      # L5: sinatra's splat spans segments (/files/a/b matches); tep's
+      # splat is last-segment-only (404s). Pinned divergence.
+      ["GET", "/files/a/b", { diverge: { "status" => "L5 splat last-segment-only" } }],
+      ["GET", "/rx/123"],
+      ["GET", "/rx/abc"],               # regex miss -> not_found on both
+      ["GET", "/afterhdr", { expect_headers: ["x-after"] }],
+      ["GET", "/dec?v=a%20b+c"],        # %xx and + decoding
+      ["POST", "/mp", {
+        body: "--XDIFFB\r\nContent-Disposition: form-data; name=\"field\"\r\n\r\nzap-mp\r\n--XDIFFB--\r\n",
+        headers: { "Content-Type" => "multipart/form-data; boundary=XDIFFB" },
+      }],
+      ["GET", "/gone"],                 # bare halt 410
+      ["GET", "/nowhere"],
+    ],
+    File.expand_path("10_semantics.rb", __dir__) => [
+      ["GET", "/hi/tep"],
+      ["GET", "/two/a/b"],
+      ["GET", "/q?q=hello"],
+      ["GET", "/q"],                 # missing param -> ""
+      ["POST", "/form", { body: "text=zap" }],
+      ["GET", "/redir"],
+      ["GET", "/redir301"],
+      ["GET", "/teapot"],
+      ["GET", "/halted"],
+      ["GET", "/hdr", { expect_headers: ["x-custom"] }],
+      ["GET", "/ct"],
+      ["GET", "/hi%20there"],        # url-decoded 404 path via not_found
+    ],
+  }.freeze
+
+  def compare(app, sin, tep, verb, path, opts)
+    body    = opts[:body]
+    headers = opts[:headers] || {}
+    r_sin = Differential.request(sin.port, verb, path, body: body, headers: headers)
+    r_tep = Differential.request(tep.port, verb, path, body: body, headers: headers)
+    ctx = "#{File.basename(app)} #{verb} #{path}"
+
+    # Ledgered per-request divergences (opts[:diverge] = {facet =>
+    # "Ln reason"}): the divergence is EXPECTED and pinned -- if the
+    # two servers ever agree again, the assertion flips, telling us to
+    # clean the ledger entry (and docs/mirrors/sinatra.md). A status
+    # divergence short-circuits the body/content-type diff: different
+    # routes answered, comparing their bodies is meaningless.
+    diverge = opts[:diverge] || {}
+    if diverge.key?("status")
+      refute_equal r_sin.code, r_tep.code,
+                   "#{ctx}: ledgered status divergence (#{diverge["status"]}) healed -- remove from ledger"
+      return
+    end
+
+    assert_equal r_sin.code, r_tep.code, "#{ctx}: status diverged"
+    assert_equal r_sin.body, r_tep.body, "#{ctx}: body diverged"
+    assert_equal Differential.normalize_content_type(r_sin["content-type"]),
+                 Differential.normalize_content_type(r_tep["content-type"]),
+                 "#{ctx}: content-type diverged (post-normalization)"
+    if %w[301 302 303 307 308].include?(r_sin.code)
+      assert_equal Differential.normalize_location(r_sin["location"]),
+                   Differential.normalize_location(r_tep["location"]),
+                   "#{ctx}: redirect Location diverged (path component)"
+    end
+    (opts[:expect_headers] || []).each do |h|
+      assert_equal r_sin[h], r_tep[h], "#{ctx}: declared header #{h} diverged"
+    end
+  end
+
+  FIXTURES.each do |app, script|
+    name = File.basename(app, ".rb")
+    define_method("test_differential_#{name}") do
+      sin = Differential.boot_sinatra(app)
+      tep = Differential.boot_tep(app)
+      begin
+        script.each do |verb, path, opts|
+          compare(app, sin, tep, verb, path, opts || {})
+        end
+      ensure
+        sin.stop
+        tep.stop
+      end
+    end
+  end
+end

data/test/test_broadcast_pg.rb

@@ -111,8 +111,12 @@ class TestBroadcastPg < TepTest
   end
 
   def test_poll_returns_zero_on_timeout
-    # With no preceding publish + no other publisher on the channel,
-    # poll should time out cleanly.
+    # Test order is randomized and the LISTEN channel is shared:
+    # another test's publish can leave an unconsumed NOTIFY queued.
+    # Drain first, then assert a clean timeout.
+    5.times do
+      break if get("/poll?timeout=50").body == "0"
+    end
     res = get("/poll?timeout=100")
     assert_equal "0", res.body
   end

data/test/test_live_view.rb

@@ -18,8 +18,10 @@ class TestLiveView < TepTest
       end
       def mount(req)
         # Pull a seed value from the request's params if present;
-        # otherwise leave at 0.
+        # otherwise leave at 0. A missing param reads as nil
+        # (sinatra-parity) -- guard before String calls.
         seed = req.params["seed"]
+        seed = "" if seed.nil?
         if seed.length > 0
           @count = seed.to_i
         end

data/test/test_mcp.rb

@@ -12,7 +12,9 @@ class TestMCP < TepTest
     # paths -- we just override req.identity with a synthetic one
     # so req.identity.may?(:admin) returns true on demand.
     before do
-      if req.req_headers["x-test-cap-admin"].length > 0
+      cap = req.req_headers["x-test-cap-admin"]
+      cap = "" if cap.nil?
+      if cap.length > 0
         req.identity = Tep::Identity.new(
           "user:42", nil, [:admin])
       end

data/test/test_pg.rb

@@ -268,10 +268,22 @@ class TestPg < TepTest
         r.clear
         out = "raised=no"
       rescue PG::UndefinedTable => e
+        # Hierarchy proof via a nested rescue arm instead of
+        # `e.is_a?(PG::Error)`: is_a? on a rescued local is
+        # unsupported at the current spinel pin (typed-rescue local
+        # widens; tracked in the SPINEL_PIN notes). Re-raising e and
+        # catching it with the PARENT class proves the subclass
+        # relation just as strictly.
+        hier = "no"
+        begin
+          raise e
+        rescue PG::Error
+          hier = "yes"
+        end
         out = "raised=UndefinedTable" +
               " sqlstate=" + c.last_sqlstate +
               " match42P01=" + (c.last_sqlstate == "42P01" ? "yes" : "no") +
-              " is_pg_error=" + (e.is_a?(PG::Error) ? "yes" : "no")
+              " is_pg_error=" + hier
       end
       c.close
       out
@@ -295,9 +307,16 @@ class TestPg < TepTest
         r2.clear
         out = "first_ok=yes second_raised=no"
       rescue PG::UniqueViolation => e
+        # Same nested-rescue hierarchy proof as /missing_table.
+        hier = "no"
+        begin
+          raise e
+        rescue PG::Error
+          hier = "yes"
+        end
         out = "first_ok=yes second_raised=UniqueViolation" +
               " sqlstate=" + c.last_sqlstate +
-              " is_pg_error=" + (e.is_a?(PG::Error) ? "yes" : "no")
+              " is_pg_error=" + hier
       end
       r3 = c.exec_params("DELETE FROM " + TBL + " WHERE id = $1", ["99001"])
       r3.clear

data/test/test_real_world.rb

@@ -30,10 +30,14 @@ class TestRealWorld < TepTest
     PORT_BASE + 100 + @@port_counter
   end
 
-  def with_app(example_filename)
+  # lax: true builds with --lax for fidelity copies of upstream apps
+  # that use out-of-contract DSL on purpose (02_lifecycle's `on_stop`)
+  # -- the strict default (mirror condition 3) would rightly refuse.
+  def with_app(example_filename, lax: false)
     src = File.join(EXAMPLES_DIR, example_filename)
     bin = Dir.mktmpdir + "/app"
-    out = `#{Shellwords.escape(File.expand_path("../bin/tep", __dir__))} build #{Shellwords.escape(src)} -o #{Shellwords.escape(bin)} 2>&1`
+    lax_flag = lax ? " --lax" : ""
+    out = `#{Shellwords.escape(File.expand_path("../bin/tep", __dir__))} build#{lax_flag} #{Shellwords.escape(src)} -o #{Shellwords.escape(bin)} 2>&1`
     raise "build failed:\n#{out}" unless $?.success?
     port = TestRealWorld.next_port
     pid = Process.spawn(bin, "-p", port.to_s, "-q",
@@ -73,7 +77,8 @@ class TestRealWorld < TepTest
   # ---- 02: lifecycle ----
 
   def test_02_lifecycle_root_renders
-    with_app("02_lifecycle.rb") do
+    # upstream example uses `on_stop` (no tep shutdown path) -> --lax
+    with_app("02_lifecycle.rb", lax: true) do
       res = get("/")
       assert_equal "200", res.code
       assert_match(/lifecycle events/, res.body)

data/test/test_request_methods.rb

@@ -24,7 +24,13 @@ class TestRequestMethods < TepTest
     end
 
     get '/accept-and-ct' do
-      "accept=" + request.accept + " ct=" + request.content_type
+      # Absent headers read as nil through the Rack-parity accessors
+      # (sinatra too) -- guard before concatenation.
+      a = request.accept
+      a = "" if a.nil?
+      ct = request.content_type
+      ct = "" if ct.nil?
+      "accept=" + a + " ct=" + ct
     end
   RB
 

data/test/test_unsupported.rb

@@ -29,4 +29,51 @@ class TestUnsupported < TepTest
 
   # send_file, configure, pass, multiple filters, optional segments
   # have all moved into supported and have their own test files.
+
+  # ---- strict-by-default translator (mirror condition 3) ----
+  # Out-of-contract constructs must FAIL the build, not silently
+  # drop (docs/mirrors/sinatra.md). These assert at translate level,
+  # so no spinel compile is needed. `--lax` restores warn-and-continue.
+
+  def translate_out(source, flags: "")
+    tmp = Dir.mktmpdir("tep-strict")
+    src = File.join(tmp, "app.rb")
+    File.write(src, "require 'sinatra'\n" + source + "\nget('/') { 'ok' }\n")
+    out = `#{TepHarness::TEP_BIN} translate #{flags} #{src} 2>&1 >/dev/null`
+    [$?.success?, out]
+  ensure
+    FileUtils.remove_entry(tmp) if tmp
+  end
+
+  def assert_strict_refusal(source, message_fragment)
+    ok, out = translate_out(source)
+    refute ok, "expected strict translate to fail, but it succeeded"
+    assert_match(/error: .*#{Regexp.escape(message_fragment)}/, out)
+    assert_match(/--lax/, out, "refusal should mention the --lax escape hatch")
+  end
+
+  def test_strict_rejects_rack_use
+    assert_strict_refusal(%(use Rack::Session::Cookie, secret: "x"),
+                          "unsupported `use`")
+  end
+
+  def test_strict_rejects_helpers_block
+    assert_strict_refusal(%(helpers do\n  def shout(s); s.upcase; end\nend),
+                          "unsupported `helpers do ... end`")
+  end
+
+  def test_strict_rejects_unknown_set_key
+    assert_strict_refusal(%(set :sessions, true), "unsupported `set :sessions`")
+  end
+
+  def test_strict_rejects_on_stop
+    assert_strict_refusal(%(on_stop do\n  puts "bye"\nend), "on_stop")
+  end
+
+  def test_lax_downgrades_to_warning
+    ok, out = translate_out("use Rack::Head", flags: "--lax")
+    assert ok, "expected --lax translate to succeed, got:\n#{out}"
+    assert_match(/unsupported `use`/, out)
+    refute_match(/error:/, out)
+  end
 end