@codyswann/lisa 4.48.0 → 4.50.0

package/typescript/copy-contents/.husky/pre-push

@@ -76,6 +76,51 @@ unset LISA_PUSHED_REFS LISA_PUSHED_REF_COUNT LISA_PUSHED_COMMIT_COUNT
 unset LISA_PUSHED_LOCAL_REF LISA_PUSHED_LOCAL_SHA LISA_PUSHED_TAIL
 # END: deletion-only push guard
 
+# BEGIN: pushed refs file
+# ---------------------------------------------------------------------------
+# The pushed refs, kept somewhere every later reader can still find them.
+#
+# READING THE STREAM SPENDS IT. Git delivers `<local ref> <local sha> <remote
+# ref> <remote sha>` on stdin exactly once, and this hook has four readers: the
+# deletion guard above, the destination guard below, `validate-push`, and every
+# declared gate. Each one that reads it replays it — but a replay only reaches
+# the NEXT reader in this file. A gate the runner spawns is a different process
+# started at a different time, and by then whichever gate ran before it may
+# already have drained the stream for good.
+#
+# That is not hypothetical, it is CodySwannGT/lisa#3874: on a project that
+# declares `gates.traceability`, the built-in call below stands down and the
+# work-item check runs from inside the gate runner instead. It found empty
+# stdin, fell back to `git rev-list HEAD --not --remotes=<remote>` — the
+# PUSHER'S branch, not the pushed one — and printed
+# `WORK_ITEM_TRACKING_OK 0 commit(s)` for a branch whose commit carried a
+# perfectly good `Work-Item:` trailer. A green meaning "I had nothing to look
+# at", in the same shape as a green meaning "I looked and it was clean".
+#
+# A named file has none of that ordering. It is written once, read as many
+# times as anything likes, and removed on exit. Stdin is still replayed byte
+# for byte, so nothing that reads the stream today has to change.
+#
+# If no scratch file can be created this stands down without reading a byte and
+# the hook behaves exactly as it did before — the same fail-towards-running
+# direction the deletion guard takes.
+# ---------------------------------------------------------------------------
+LISA_PUSHED_REFS_FILE="$(mktemp "${TMPDIR:-/tmp}/lisa-pushed-refs-file.XXXXXXXX")" || LISA_PUSHED_REFS_FILE=""
+if [ -n "$LISA_PUSHED_REFS_FILE" ]; then
+  cat > "$LISA_PUSHED_REFS_FILE"
+  # Put the stream back for the guards and gates that still read stdin.
+  exec < "$LISA_PUSHED_REFS_FILE"
+  # Exported, because the reader that needs it most is a grandchild process:
+  # the gate runner's `check:work-item:push`. `--refs` names the same file for
+  # anyone invoking the validator directly.
+  export LISA_PUSHED_REFS_FILE
+  # Both traps remove both files, so whichever is installed last still cleans
+  # up everything. A single-file trap here would be silently replaced by the
+  # gate-coverage trap further down and leak this file on every push.
+  trap 'rm -f "$LISA_PUSHED_REFS_FILE" "$LISA_GATE_COVERAGE"' EXIT
+fi
+# END: pushed refs file
+
 WORK_ITEM_SCRIPT="node_modules/@codyswann/lisa/all/copy-overwrite/scripts/lisa-work-item.mjs"
 if [ ! -f "$WORK_ITEM_SCRIPT" ]; then
   WORK_ITEM_SCRIPT="scripts/lisa-work-item.mjs"
@@ -322,11 +367,109 @@ process.stdin.on("data", chunk => { raw += chunk }).on("end", () => {
 ')
 fi
 
+LISA_TRACEABILITY_RAN=""
 if [ "$TRACEABILITY_DECLARED" = "declared" ]; then
   echo "ℹ️  gates.traceability is declared at push; the gate registry decides what runs."
 else
   node "$WORK_ITEM_SCRIPT" validate-push "${1:-origin}" || exit 1
+  LISA_TRACEABILITY_RAN=1
+fi
+
+# BEGIN: pushed-tree scope guard
+# ---------------------------------------------------------------------------
+# Everything below this line reads the FILES IN THIS WORKING TREE — lint,
+# types, tests, dead code. That is correct when the branch being pushed is the
+# branch checked out here, which is the ordinary case and is left untouched.
+#
+# It is wrong the moment it is not. A session pinned to one worktree can only
+# push another worktree's branch cross-tree, and when it does, `eslint .` and
+# `knip` walk the PUSHER'S tree while the push carries a commit from somewhere
+# else — and then print PASSED. A green meaning "I examined a different tree"
+# arrives in the same shape as a green meaning "I examined this and it was
+# clean" (CodySwannGT/lisa#3874). Because the worktree binding makes the
+# cross-tree route the only permitted one for a pinned agent, this is not an
+# edge case; it is the normal path for a growing share of the fleet.
+#
+# REFUSING IS THE HONEST ANSWER AND PASSING IS NOT. An operator told "these
+# gates cannot see the tree you are pushing, push it from that tree" has been
+# given a true statement they can act on; one told PASSED has been given a
+# false one. This adds no bypass and takes nothing away: no gate is skipped,
+# relaxed, or made optional, and the push does not proceed.
+#
+# TRACEABILITY RUNS FIRST, and unconditionally, because it is the one push gate
+# that CAN answer correctly from here: it reads git objects, which every
+# worktree of a repository shares, so the pushed range is fully visible from
+# any tree. Refusing before it ran would throw away the one true answer
+# available at this moment — and its verdict is the one an operator most needs,
+# because a missing work item is fixed by rewriting the commit, not by moving
+# to another terminal.
+#
+# ANCESTOR, NOT EQUALITY. A pushed commit reachable from local `HEAD` is in
+# this tree's history — the ordinary "push something older" case — so only a
+# commit this checkout has never contained is out of scope.
+#
+# WHAT IT DELIBERATELY DOES NOT EXAMINE: deletions (the guard above exits
+# first, and a deleted ref has no tree), and any local ref that is neither
+# `refs/heads/*` nor `HEAD` — a tag push moves a label rather than proposing a
+# tree, and release automation pushes tags for commits that shipped long ago.
+# If the refs file could not be written, or `HEAD` is unborn, this stands down
+# rather than guessing.
+# ---------------------------------------------------------------------------
+LISA_OUT_OF_TREE=""
+if [ -n "$LISA_PUSHED_REFS_FILE" ] && git rev-parse -q --verify HEAD >/dev/null 2>&1; then
+  # The `||` keeps a final line with no trailing newline, exactly as the
+  # deletion guard reads the same stream.
+  while read -r LISA_SCOPE_REF LISA_SCOPE_SHA LISA_SCOPE_TAIL || [ -n "$LISA_SCOPE_REF" ]; do
+    case "$LISA_SCOPE_REF" in
+      refs/heads/* | HEAD) ;;
+      *) continue ;;
+    esac
+    # A zeroed or non-hex local sha is a deletion or an unreadable line, and
+    # neither is a tree this can ask a question about.
+    case "$LISA_SCOPE_SHA" in
+      "" | *[!0-9a-f]*) continue ;;
+    esac
+    case "$LISA_SCOPE_SHA" in
+      *[!0]*) ;;
+      *) continue ;;
+    esac
+    if ! git merge-base --is-ancestor "$LISA_SCOPE_SHA" HEAD >/dev/null 2>&1; then
+      LISA_OUT_OF_TREE="$LISA_OUT_OF_TREE
+     $LISA_SCOPE_REF -> $LISA_SCOPE_SHA"
+    fi
+  done < "$LISA_PUSHED_REFS_FILE"
+fi
+unset LISA_SCOPE_REF LISA_SCOPE_SHA LISA_SCOPE_TAIL
+
+if [ -n "$LISA_OUT_OF_TREE" ]; then
+  # The one gate that can answer correctly from here, run before the refusal so
+  # its verdict is not lost to it. Skipped only when it has already run above.
+  if [ -z "$LISA_TRACEABILITY_RAN" ] && [ -f "$WORK_ITEM_SCRIPT" ]; then
+    node "$WORK_ITEM_SCRIPT" validate-push "${1:-origin}" || exit 1
+  fi
+  echo ""
+  echo "❌ Push refused: the push checks cannot see the commits being pushed."
+  echo ""
+  echo "   Being pushed, but not in this working tree:$LISA_OUT_OF_TREE"
+  echo ""
+  echo "   This checkout is on $(git rev-parse --abbrev-ref HEAD 2>/dev/null)."
+  echo "   The checks after this point read the files in THIS folder — lint,"
+  echo "   types, tests, dead code. Run here they would report on this"
+  echo "   checkout, not on what is leaving the machine, and report it as a"
+  echo "   pass. That pass would be false, and a false pass is worse than no"
+  echo "   answer, so this stops instead of printing one."
+  echo ""
+  echo "   What to do: push each branch from the folder it is checked out in."
+  echo "   These are the folders this repository is checked out into:"
+  git worktree list 2>/dev/null | sed 's/^/     /'
+  echo ""
+  echo "   Work-item traceability above DID examine the pushed commits — it"
+  echo "   reads git history, which every folder shares — so that answer stands."
+  echo ""
+  exit 1
 fi
+unset LISA_OUT_OF_TREE
+# END: pushed-tree scope guard
 
 # Git supplies repository-local GIT_* variables to hooks. Keep them for push
 # validation above, then remove exactly Git's documented local set so nested
@@ -386,7 +529,9 @@ fi
 LISA_GATE_COVERAGE=""
 if [ -f "$GATE_RUNNER" ] && command -v node >/dev/null 2>&1; then
   LISA_GATE_COVERAGE="$(mktemp "${TMPDIR:-/tmp}/lisa-gate-coverage.XXXXXXXX")" || LISA_GATE_COVERAGE=""
-  trap 'rm -f "$LISA_GATE_COVERAGE"' EXIT
+  # Removes the pushed-refs file too: this trap REPLACES the one installed by
+  # the pushed refs file block above, so a single-file body here would leak it.
+  trap 'rm -f "$LISA_GATE_COVERAGE" "$LISA_PUSHED_REFS_FILE"' EXIT
   if [ -n "$LISA_GATE_COVERAGE" ]; then
     node "$GATE_RUNNER" --moment=push --coverage="$LISA_GATE_COVERAGE"
   else
@@ -846,7 +991,7 @@ fi
 # measured, and the honest command for such a project is still `test:cov` —
 # slower, but answering to the floor that was configured for what it runs.
 COVERAGE_SCRIPT="test:cov"
-if node -e 'const s=require("./package.json").scripts||{};const u=s["test:cov:unit"];const marker=/^(?:env(?:\s+-\S+)*\s+)?(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+)*LISA_COVERAGE_SCOPE=unit(?:\s|$)/;process.exit(typeof u==="string"&&marker.test(u.trim())?0:1)' >/dev/null 2>&1; then
+if node -e 'const s=require("./package.json").scripts||{};const resolve=(k,d)=>{const v=s[k];const hop=/^\$npm_execpath\s+run\s+(\S+)$/.exec((v||"").trim());return hop&&d<4?resolve(hop[1],d+1):v;};const u=resolve("test:cov:unit",0);const marker=/^(?:env(?:\s+-\S+)*\s+)?(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+)*LISA_COVERAGE_SCOPE=unit(?:\s|$)/;process.exit(typeof u==="string"&&marker.test(u.trim())?0:1)' >/dev/null 2>&1; then
   COVERAGE_SCRIPT="test:cov:unit"
 fi
 

package/typescript/copy-overwrite/ast-grep/rules/no-day-truncating-file-age-predicate.yml

@@ -0,0 +1,50 @@
+# This file is managed by Lisa and IS replaced on each `lisa` run.
+# Do not edit directly — durable changes belong upstream in Lisa.
+
+id: no-day-truncating-file-age-predicate
+language: bash
+severity: error
+message: |
+  `-mtime`, `-atime` and `-ctime` do NOT mean "older than N days".
+
+  `find` divides the file's age by 86400 and DISCARDS the remainder, so
+  `-mtime +N` matches only files older than N+1 days. Measured on this
+  repository's own platform with fixtures stamped at known ages:
+
+    age    -mtime +2   -mmin +2880
+    47h        no          no
+    49h        NO          yes   <- the whole disagreement
+    71h        NO          yes
+    73h        yes         yes
+
+  The 49h-71h band is silently dropped. The failure direction is what makes
+  this worth a rule: the under-selection reports "nothing to do", and nobody
+  questions an empty result from a cleanup predicate, so it prevents needed
+  work instead of causing visible harm. Reported once as a broken `find`; it
+  is not. `find` is answering a different question than the flag appears to
+  ask, which is exactly why it survives review.
+
+  Write the question you mean:
+
+    older than N days   ->  -mmin +$((N * 1440))
+    older than N days   ->  ! -newermt "<an ISO timestamp N days back>"
+    older than N hours  ->  -mmin +$((N * 60))
+
+  `-mmin` is minute-granularity and is not truncated to days, so it means
+  what it reads. `-newermt` is exact but needs a timestamp, and the two
+  `date` implementations disagree on how to produce one: `date -v-2d` is
+  BSD/macOS and `date -d '2 days ago'` is GNU/Linux. Prefer `-mmin` in any
+  script that runs on both.
+note: |
+  This rule matches the flag itself rather than a `find` invocation, so it
+  still fires through `/usr/bin/find`, `$FIND`, and `xargs find`. There are
+  no legitimate uses in this repository: every shipped age predicate already
+  uses `-mmin`, and this rule exists to keep it that way, because `-mtime` is
+  the form a maintainer reaches for by reflex and the shell hooks that carry
+  these predicates are copied across five per-agent plugin variants, so one
+  wrong edit lands in eight files at once.
+
+  See CodySwannGT/lisa#3905.
+rule:
+  kind: word
+  regex: ^-(mtime|atime|ctime)$

package/typescript/copy-overwrite/audit.ignore.config.json

@@ -137,16 +137,6 @@
       "id": "GHSA-j759-j44w-7fr8",
       "package": "@xmldom/xmldom",
       "reason": "XML node injection via unvalidated comment serialization. Transitive via expo > @expo/config-plugins > @expo/plist; only serializes developer-authored plist files at build/prebuild time, no runtime code path serializes attacker-controlled XML."
-    },
-    {
-      "id": "GHSA-v39h-62p7-jpjc",
-      "package": "fast-uri",
-      "reason": "Host confusion via percent-encoded authority delimiters in fast-uri parser. Reachable transitively via eslint > @eslint/eslintrc > ajv > fast-uri and (in CDK projects) via aws-cdk-lib's bundled JSON Schema validator. aws-cdk-lib is invoked only at build/synth/deploy time \u2014 its ajv usage validates CloudFormation/CDK schemas authored by the developer, not attacker-controlled URIs. No runtime/production code path passes attacker-controlled URIs through ajv schema validation that relies on fast-uri parsing."
-    },
-    {
-      "id": "GHSA-q3j6-qgpj-74h6",
-      "package": "fast-uri",
-      "reason": "Path traversal via percent-encoded dot segments in fast-uri parser. Reachable transitively via eslint > @eslint/eslintrc > ajv > fast-uri and (in CDK projects) via aws-cdk-lib's bundled JSON Schema validator. aws-cdk-lib is invoked only at build/synth/deploy time \u2014 its ajv usage validates CloudFormation/CDK schemas authored by the developer, not attacker-controlled URIs. No runtime/production code path passes attacker-controlled URIs through ajv schema validation that relies on fast-uri parsing."
     }
   ]
 }

package/typescript/copy-overwrite/scripts/lisa-mutation.mjs

@@ -196,8 +196,96 @@ export const OUTCOMES = Object.freeze({
   inflatedByTimeouts: "mutation-gate: score-below-break-without-timeouts",
   clearedBreakThreshold: "mutation-gate: cleared-break-threshold",
   noFloorApplied: "mutation-gate: no-floor-applied",
+  notMeasured: "mutation-gate: not-measured",
 });
 
+/**
+ * The one-line denial a green-but-unmeasured job puts on the check list.
+ *
+ * Exported so the exact wording is assertable, and built here rather than in
+ * the workflow because the workflow cannot see WHICH exit happened.
+ *
+ * It deliberately avoids the words "mutation score", even in a negation.
+ * `tests/integration/mutation-gate-diff-bite.test.ts` asserts that a
+ * nothing-to-mutate run's output does not match /mutation score/i, and that
+ * control is right: a run that scored nothing must not put the phrase in front
+ * of a reader at all, because a skim keeps the noun and drops the "no". The
+ * first draft of this line read "no mutation score was produced" and failed it.
+ * @param {string} outcome - The {@link OUTCOMES} marker this run ended on.
+ * @returns {string} A GitHub Actions warning command, one line.
+ */
+export const unmeasuredAnnotation = outcome =>
+  `::warning title=Mutation gate measured nothing::${outcome} — no mutant was ` +
+  "executed, so this job's green says the run ended cleanly, NOT that mutation " +
+  "coverage was verified. Read it as NOT MEASURED, never as nothing to " +
+  'measure. Change a file this project\'s Stryker "mutate" list selects to get ' +
+  "a measurement.";
+
+/**
+ * Put the denial where a reader of the check list will meet it.
+ *
+ * ## Why an annotation and not a conclusion — CodySwannGT/lisa#3968
+ *
+ * The honest answer would be a `neutral` check-run conclusion, and it is not
+ * available: `test_mutation` in `quality.yml` runs under `contents: read`, and
+ * `quality.yml` is `workflow_call`-only, where asking for `checks: write` is a
+ * `startup_failure` for the caller's entire run (#2049). So the job's row will
+ * read `pass`, and the only thing that can travel with it is an annotation —
+ * the same device the `gates.unproven` family already uses one job away.
+ *
+ * REPORT-ONLY, and that is the decision rather than an accident: this returns
+ * nothing and touches no exit code. A gate that failed a push because a change
+ * touched no mutate target would red-wall every docs-only branch, which is the
+ * frequent, benign state this whole file exists to make legible rather than to
+ * punish. The fail-CLOSED half of the fix is `mutation_measured`, which is the
+ * signal that actually composes into a coverage claim.
+ *
+ * `disabled` is the one outcome excluded, and it is excluded for a reason that
+ * does not generalise: an opt-out is a decision somebody recorded, not a
+ * question this gate failed to evaluate, and its own exit already prints a
+ * notice naming itself. Every other unmeasured exit annotates, including ones
+ * added later — the condition is `measured !== true`, not a roster.
+ * @param {string} outcome - The {@link OUTCOMES} marker this run ended on.
+ * @param {number} code - The exit code being returned.
+ * @param {boolean} measured - Whether this run produced a score.
+ * @param {NodeJS.ProcessEnv} env - Environment, injectable for tests.
+ * @returns {void}
+ */
+const annotateUnmeasured = (outcome, code, measured, env) => {
+  const onCi = env.GITHUB_ACTIONS === "true";
+  const greenAndUnmeasured = code === 0 && measured !== true;
+  const optedOut = outcome === OUTCOMES.disabled;
+  if (onCi && greenAndUnmeasured && !optedOut) {
+    console.log(unmeasuredAnnotation(outcome));
+  }
+};
+
+/**
+ * Append the outcome pair to `$GITHUB_OUTPUT`, when there is one to append to.
+ *
+ * Best-effort by construction: it returns nothing, so no failure in here has a
+ * value the caller could mistake for an exit code. A lost output line must
+ * never change the code the gate worked to earn.
+ * @param {string} outcome - The {@link OUTCOMES} marker this run ended on.
+ * @param {boolean} measured - Whether this run produced a score.
+ * @param {NodeJS.ProcessEnv} env - Environment, injectable for tests.
+ * @returns {void}
+ */
+const writeOutcomeOutputs = (outcome, measured, env) => {
+  const target = env.GITHUB_OUTPUT;
+  if (target === undefined || target === "") return;
+  try {
+    fs.appendFileSync(
+      target,
+      `mutation_outcome=${outcome}\nmutation_measured=${measured === true}\n`
+    );
+  } catch (error) {
+    console.error(
+      `[mutation-gate] outcome outputs not written: ${error.message}`
+    );
+  }
+};
+
 /**
  * Publishes the outcome where the workflow can render it, then returns the code.
  *
@@ -225,18 +313,8 @@ export const OUTCOMES = Object.freeze({
  * @returns {number} `code`, unchanged
  */
 export const finish = (outcome, code, measured = false, env = process.env) => {
-  const target = env.GITHUB_OUTPUT;
-  if (target === undefined || target === "") return code;
-  try {
-    fs.appendFileSync(
-      target,
-      `mutation_outcome=${outcome}\nmutation_measured=${measured === true}\n`
-    );
-  } catch (error) {
-    console.error(
-      `[mutation-gate] outcome outputs not written: ${error.message}`
-    );
-  }
+  annotateUnmeasured(outcome, code, measured, env);
+  writeOutcomeOutputs(outcome, measured, env);
   return code;
 };
 
@@ -1119,6 +1197,67 @@ const unmeasuredBlock = () =>
   '   Add "clear-text" to `reporters` in your Stryker config to measure it, or set\n' +
   "   MUTATION_CAPTURE=0 to say out loud that this run is not being accounted for.";
 
+/**
+ * The verdict for a run that executed no mutant at all.
+ *
+ * ## The defect this closes — CodySwannGT/lisa#3968
+ *
+ * "I looked and found nothing" and "I did not look" are opposite facts, and a
+ * vocabulary missing the second inevitably prints the first. A tally of all
+ * zeros scores `NaN`, and this file used to hand that to the FLOOR sentence:
+ * the run was reported as one where "no floor was applied", `measured` stayed
+ * `true`, and the exit stayed 0. Three surfaces then said the same wrong thing
+ * — the pre-push block read as a benign footnote on a pass, `mutation_measured`
+ * went out as `true`, and the one job whose entire purpose is to distinguish a
+ * measured run RENDERED GREEN saying "Stryker generated mutants against this
+ * change and produced a score."
+ *
+ * The reachable cause is not exotic. Stryker excludes errored mutants from
+ * every denominator, so a change where every mutant fails to compile — a mutant
+ * whose source no longer parses yields zero tests, not failures — lands here
+ * with `errors` set and everything else zero. So does a run whose generated
+ * mutants were all discarded. Both are runs that measured nothing while looking
+ * exactly like a run that measured zero.
+ *
+ * ## This surface is REPORT-ONLY, deliberately
+ *
+ * It never changes an exit code: a gate that failed a push because a mutant
+ * would not compile is a throughput governor masquerading as a correctness
+ * guard, and `nothing-to-mutate` states are frequent and benign here. What it
+ * does instead is refuse to report a measurement — {@link judgeTimeoutAccounting}
+ * returns `measured: false` from this arm, which is a fail-CLOSED answer on the
+ * one signal that composes into a coverage claim. Report-only on the code,
+ * fail-closed on the claim.
+ * @param {{killed: number, timedOut: number, survived: number,
+ *   noCoverage: number, errors?: number}} tally - From
+ *   {@link parseMutantTally}.
+ * @param {number|null} breakThreshold - `thresholds.break`, or null.
+ * @returns {string} The block, appended to the accounting report.
+ */
+const notMeasuredBlock = (tally, breakThreshold) => {
+  const errored = Number.isFinite(tally.errors) ? tally.errors : 0;
+  const floorNote =
+    breakThreshold === null
+      ? '   Your Stryker config declares no "thresholds.break", and there is no score to\n' +
+        "   judge against one anyway.\n"
+      : `   A break threshold of ${breakThreshold} is declared and was NOT applied, because a\n` +
+        "   floor needs a number to compare against.\n";
+  return (
+    `\n⚪ ${OUTCOMES.notMeasured}\n` +
+    `   NO mutant produced a verdict on this run: 0 killed, 0 timed out, 0 survived\n` +
+    `   and 0 without coverage, against ${errored} errored mutant(s). Stryker excludes an\n` +
+    `   errored mutant from every denominator — it never ran, so it was neither\n` +
+    `   caught nor missed — which leaves nothing to take a score of.\n` +
+    `   READ THIS AS NOT MEASURED, NEVER AS NOTHING TO MEASURE. Mutate targets\n` +
+    `   changed and Stryker was invoked; what did not happen is the measurement.\n` +
+    `   Nothing here is a verdict about your tests, in either direction.\n` +
+    `${floorNote}` +
+    `   This gate does NOT fail the run for it, and reports mutation_measured=false\n` +
+    `   so no check row may claim this change was measured. Read Stryker's own\n` +
+    `   output above for why the mutants errored, then re-run for a score.`
+  );
+};
+
 /**
  * The floor a completed run was judged against, named with its value.
  *
@@ -1135,13 +1274,14 @@ const unmeasuredBlock = () =>
  *
  * ## Where no floor was applied it says so, rather than inventing one
  *
- * Two arms reach this with nothing to name, and `0` would be a fabrication in
- * both: a project that declared no `thresholds.break` has not asked for a floor
- * (see {@link resolveBreakThreshold}, which returns null and not zero for
- * exactly this reason), and a run whose tally produced no score has nothing to
- * judge against the floor it did declare. Both say NO floor was applied, which
- * is the same answer this gate's `nothing-to-mutate` and `no-diff-base` exits
- * already give: nothing was measured, so nothing passed.
+ * A project that declared no `thresholds.break` has not asked for a floor (see
+ * {@link resolveBreakThreshold}, which returns null and not zero for exactly
+ * this reason), so this says NO floor was applied rather than naming one.
+ *
+ * A run that produced no score at all never reaches here: it is answered by
+ * {@link notMeasuredBlock} above, which is a statement about the RUN and not
+ * about the floor. Routing it through a floor sentence was the older shape and
+ * it read as a benign footnote to a passing verdict — see CodySwannGT/lisa#3968.
  *
  * This is reporting only. It changes no threshold and gates nothing — the arm
  * that fails a run is below, and it is untouched.
@@ -1159,13 +1299,6 @@ const clearedFloorBlock = (tally, accounting, breakThreshold) => {
       "   to this run. The scores above are reported, not cleared — nothing here says\n" +
       "   they are good enough, because nothing said what good enough is."
     );
-  if (!Number.isFinite(accounting.withoutTimeouts))
-    return (
-      `\n⚪ ${OUTCOMES.noFloorApplied}\n` +
-      `   A break threshold of ${breakThreshold} is declared, but this run produced no score to\n` +
-      "   judge against it, so NO floor was applied. Nothing here is a verdict about\n" +
-      "   your tests."
-    );
   return (
     `\n✅ ${OUTCOMES.clearedBreakThreshold}\n` +
     `   Without crediting the ${tally.timedOut} timed-out mutant(s), this run scores\n` +
@@ -1178,7 +1311,13 @@ const clearedFloorBlock = (tally, accounting, breakThreshold) => {
 /**
  * Judge a completed run on what it can prove, rather than on what it counted.
  *
- * Two verdicts, and neither can turn a red run green — both are checks the gate
+ * Three answers, not two. A run that executed no mutant is NOT-MEASURED and is
+ * answered by {@link notMeasuredBlock}; the two below are verdicts about a run
+ * that produced a score. Collapsing the first into the third is CodySwannGT/lisa#3968:
+ * a green row then composes into "mutation coverage was verified here", a claim
+ * nobody proved.
+ *
+ * Neither verdict below can turn a red run green — both are checks the gate
  * applies IN ADDITION to Stryker's own, on a run Stryker already judged:
  *
  * - the score recomputed without crediting timeouts is under the project's
@@ -1186,16 +1325,28 @@ const clearedFloorBlock = (tally, accounting, breakThreshold) => {
  *   helped it;
  * - the timed-out share of detected mutants is over the ceiling, so the score is
  *   more a property of the machine than of the tests, whatever its value.
- * @param {{killed: number, timedOut: number}} tally - The counts.
+ * @param {{killed: number, timedOut: number, survived?: number,
+ *   noCoverage?: number, errors?: number}} tally - The counts.
  * @param {number|null} breakThreshold - `thresholds.break`, or null.
  * @param {number} ceiling - The share ceiling in force.
  * @returns {{failed: boolean, measured: boolean, message: string}} The block,
- *   whether a tally was read, and whether it fails.
+ *   whether this run produced a score, and whether it fails.
  */
 export const judgeTimeoutAccounting = (tally, breakThreshold, ceiling) => {
   const accounting = timeoutAccounting(tally);
   const report = accountingBlock(tally, accounting, ceiling);
 
+  // FIRST, because every arm below reads a score this run does not have, and
+  // the two that guard for it would fall through to the third — which reported
+  // a floor that was not applied and called that a measured pass (#3968).
+  if (!Number.isFinite(accounting.withoutTimeouts)) {
+    return {
+      failed: false,
+      measured: false,
+      message: `${report}${notMeasuredBlock(tally, breakThreshold)}`,
+    };
+  }
+
   if (
     breakThreshold !== null &&
     Number.isFinite(accounting.withoutTimeouts) &&

package/typescript/copy-overwrite/scripts/threshold-ratchet-families.mjs

@@ -75,6 +75,18 @@ export const FAMILIES = [
     match: /(^|\/)\.github\/k6\/thresholds\/[^/]+\.json$/,
     kind: "k6",
   },
+  {
+    // #3992. The always-on eager rule tier is concatenated into every session
+    // AND every subagent start, so its byte ceiling is a quality threshold like
+    // any other. `max` because the number is a ceiling: lowering it tightens the
+    // gate and is free, raising it re-authorises context the cleanup removed and
+    // is the change a human has to see. The tier was cut to 26,540 bytes once
+    // and regrew to 201,083 in fourteen weeks with nothing watching it.
+    id: "eager-rules",
+    match: /(^|\/)eager-rules\.thresholds\.json$/,
+    kind: "json-num",
+    direction: "max",
+  },
   {
     id: "lisa-config",
     match: /(^|\/)\.lisa\.config\.json$/,