@feigi/fleet-ctl 3.19.3 → 3.19.5

package/commands/review-and-fix.md

@@ -44,7 +44,7 @@ Three claims, none substituting for another: **run-binding** (this green belongs
 ```bash
 R=<scratch>/review-<pr>.json
 jq '{pr, head, resume, testEnvironment, dimensionsRun, dimensionsUnrun, cwdAudit, counts}' "$R"  # the digest
-jq -r '.testEnvironment' "$R"                                    # what every test_run is evidence about
+jq -r '.testEnvironment' "$R"                                    # what the shared test run is evidence about
 jq '.survived' "$R"                                              # apply candidates, every one
 jq '[.unverified[] | select(.refutersDispatched > 0)]' "$R"      # refuters crashed, twice: defer, naming the crash
 jq '[.unverified[] | select(.refutersDispatched == 0)]' "$R"     # suggestions, 0-refuter budget: step 2's scope split
@@ -53,7 +53,7 @@ jq '.refuted' "$R"                                               # refuted: your
 
 **Every finding in the file is yours to rule on, not the ones that read sharpest.** The file is the only complete copy a member can reach — the specialists' transcripts exist, but nothing you hold addresses one — so a finding you never read is one nobody rules on. `counts` is the check that you read them all: your apply/defer split covers every `survived` and `unverified` finding it counts, and your disposition record (step 2) carries an entry for each `refuted` one you reversed, with the evidence in its `reason`, which the controller copies to the ledger's `ruled` line.
 
-**Read `testEnvironment` and `cwdAudit` before you act on any `test_run`.** `testEnvironment` says whether the snapshot the specialists ran in was verified as the reviewed tree: verified, a red there is a fact about the tree; UNVERIFIED, tests that ask git what ships decline or fail for the environment, so a red or a short count there is not a finding until you reproduce it in the worktree, and not a reason to rule a dimension unrun either. `cwdAudit` is each specialist's audit of the checkout it inherited, `{dimension, state, line}`: `dirty` and `missing` are equally loud, because either names a checkout a specialist may have written to (#1433, #1673). Check it with `git -C <that path> status --porcelain -uall` — the path is in a `dirty` entry's `line`, and a `missing` entry's is the main checkout, the parent of `git rev-parse --path-format=absolute --git-common-dir` — and report what it printed; never revert content you did not write. A `dimensionsUnrun` entry is a dimension that did not cover its ground, its `reason` naming which failure: name it unrun in your report, because an absence of findings is not coverage, and re-run nothing — the review already re-dispatched every crashed specialist once, in-run.
+**Read `testEnvironment` and `cwdAudit` before you act on any result of the shared test run.** `testEnvironment` says whether the snapshot the specialists ran in was verified as the reviewed tree: verified, a red there is a fact about the tree; UNVERIFIED, tests that ask git what ships decline or fail for the environment, so a red or a short count there is not a finding until you reproduce it in the worktree, and not a reason to rule a dimension unrun either. `cwdAudit` is each specialist's audit of the checkout it inherited, `{dimension, state, line}`: `dirty` and `missing` are equally loud, because either names a checkout a specialist may have written to (#1433, #1673). Check it with `git -C <that path> status --porcelain -uall` — the path is in a `dirty` entry's `line`, and a `missing` entry's is the main checkout, the parent of `git rev-parse --path-format=absolute --git-common-dir` — and report what it printed; never revert content you did not write. A `dimensionsUnrun` entry is a dimension that did not cover its ground, its `reason` naming which failure: name it unrun in your report, because an absence of findings is not coverage, and re-run nothing — the review already re-dispatched every crashed specialist once, in-run.
 
 **Scan the findings against each other for MUTUAL EXCLUSION, and rule before the conflicting change reaches the tree.** Refuters are blind to their siblings, so two can approve changes that cannot both land — one preserving a comment block another's change deletes, one keeping a binding another collapses. Two runs produced it: PR #332, and PR #404, where a refuter proved a variable collapse behavior-equivalent over 844 cases while its own blast-radius scan named the two comment blocks a *different* refuter had just established as guarding distinct pinned hazards. You hold every finding, so only you can see the pair — and the scan's two inputs arrive at different times, so run it twice. **Before you apply anything**, group the findings by `file:line` and by whether one's fix undoes another's; that is in the findings' own text. **Then as each refuter you dispatch reports**, read its blast radius against what you have already ruled on. **A conflicting pair goes to a SINGLE refuter, briefed with both claims** — that is what settled #332's, one refuter ruling *"B wins: A's premise is false"* where two independent refuters would each have approved their own side. Defer only when no single refuter can settle it, with the equivalence evidence recorded in the filed issue so the work is not redone. Never let both reach the tree and hope the diff coheres.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.19.3",
+  "version": "3.19.5",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/dispatch-block-golden-prose.test.mjs

@@ -522,8 +522,9 @@ const REVIEWER_BLOCKS = [
       "the rest of the recipes and every ruling on the findings: both",
       "mutual-exclusion scans, the suggested-fix re-derivation, `refuted=false` ≠",
       "apply, per-site measurement for a sibling-site extension, and `testEnvironment`",
-      "and `cwdAudit` before any `test_run`. Every one of those rulings is yours —",
-      "nobody upstream has made one, and the controller never reads the findings.",
+      "and `cwdAudit` before any result of the shared test run. Every one of those",
+      "rulings is yours — nobody upstream has made one, and the controller never",
+      "reads the findings.",
       "",
       "**Every factual claim your diff restates needs a settling command run",
       "against the tree first** — the issue body is a lead, never a citation.",

package/scripts/fix-applier-result-file-prose.test.mjs

@@ -3,12 +3,13 @@
 // and owns every per-PR ruling the controller used to make before dispatch —
 // both mutual-exclusion scans, the suggested-fix re-derivation, `refuted=false`
 // ≠ apply, per-site measurement for a sibling-site extension, and reading
-// `testEnvironment`/`cwdAudit` before acting on a `test_run`. Their new home is
-// review-and-fix.md's `## The review result file`, which is the copy the
-// fix-applier reads. The controller-side copies in run-team/SKILL.md are due to
-// be retired once the controller stops making these rulings (§ 8), and a
-// retirement that loses the destination copy too would leave the rulings made
-// by nobody, with every pin that read SKILL.md simply deleted alongside it.
+// `testEnvironment`/`cwdAudit` before acting on a result of the shared test
+// run. Their new home is review-and-fix.md's `## The review result file`, which
+// is the copy the fix-applier reads. The controller-side copies in
+// run-team/SKILL.md are due to be retired once the controller stops making
+// these rulings (§ 8), and a retirement that loses the destination copy too
+// would leave the rulings made by nobody, with every pin that read SKILL.md
+// simply deleted alongside it.
 //
 // Two halves. The recipes half is not prose: a `jq` path naming a field the
 // result does not carry prints `null` at exit 0, which reads exactly like an
@@ -19,11 +20,12 @@ import { test } from "node:test";
 import assert from "node:assert/strict";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
-import { between, phrase } from "./prose-pin.mjs";
+import { between, paragraph, phrase } from "./prose-pin.mjs";
 import { DIGEST_KEYS } from "./review-core.mjs";
 
 const REPO = join(import.meta.dirname, "..");
 const DOC = readFileSync(join(REPO, "commands", "review-and-fix.md"), "utf8");
+const RUN_TEAM = readFileSync(join(REPO, "skills", "run-team", "SKILL.md"), "utf8");
 const RESULT_KEYS = new Set([...DIGEST_KEYS, "snapshot", "survived", "refuted", "unverified"]);
 
 const section = () => between(DOC, "\n## The review result file\n", "\n## Specialists\n", "review-and-fix.md's result-file section");
@@ -92,9 +94,40 @@ test("the fix-applier owns refuted=false ≠ apply, and per-site measurement for
   );
 });
 
-test("the fix-applier reads testEnvironment and cwdAudit before acting on any test_run, and re-runs nothing", () => {
-  const p = ruling("**Read `testEnvironment` and `cwdAudit` before you act on any `test_run`.**");
+test("the fix-applier reads testEnvironment and cwdAudit before acting on any result of the shared test run, and re-runs nothing", () => {
+  const p = ruling("**Read `testEnvironment` and `cwdAudit` before you act on any result of the shared test run.**");
   assert.match(p, phrase("status --porcelain -uall"), "the cwdAudit check lost its explicit untracked mode");
   assert.match(p, phrase("never revert content you did not write"));
   assert.match(p, phrase("re-run nothing"), "a dimensionsUnrun entry now reads as an instruction to re-run the review");
 });
+
+// The two run-team/SKILL.md sentences that hand the fix-applier the same ruling
+// were reworded off the specialists' retired `test_run` field (#2374), and
+// nothing read either one. They go with the rest of the SKILL.md copies (§ 8).
+test("run-team's digest paragraph tells the controller the fix-applier reads testEnvironment before acting on any count from the shared test run", () => {
+  const p = paragraph(
+    RUN_TEAM,
+    "`testEnvironment` says what the review's shared test run is evidence about",
+    "run-team/SKILL.md's testEnvironment digest paragraph",
+    { emphasisTolerant: true },
+  );
+  assert.match(
+    p,
+    phrase("fix-applier reads it before acting on any count from the shared test run"),
+    "the digest paragraph no longer says the fix-applier reads testEnvironment before acting on a count from the shared test run",
+  );
+});
+
+test("run-team's fix-applier dispatch hands it testEnvironment and cwdAudit before any result of the shared test run", () => {
+  const p = between(
+    RUN_TEAM,
+    "\n**Then dispatch a fix-applier** — on `DISPATCH fix-pr PR#<M>`",
+    "\n**A `DISPATCH fix-pr PR#<M>` on a conflict hold**",
+    "run-team/SKILL.md's fix-applier dispatch paragraph",
+  );
+  assert.match(
+    p,
+    phrase("`testEnvironment`/`cwdAudit` before any result of the shared test run."),
+    "the fix-applier dispatch paragraph no longer says to read testEnvironment/cwdAudit before a result of the shared test run",
+  );
+});

package/scripts/recipe-prove.mjs

@@ -45,8 +45,9 @@
 // Exit 1: NOT PROVEN — no cache written; the reason on stderr.
 // Exit 2: no verdict on the proof — it could not be attempted (usage, not a
 //         repository, origin/main missing, the worktree could not be made), or
-//         a filesystem fault stopped it before the cache was settled (the
-//         cache or its temp file could not be written).
+//         a git or filesystem fault stopped it before the cache was settled
+//         (a git command could not be started; the cache or its temp file
+//         could not be written).
 
 import { spawnSync } from "node:child_process";
 import { closeSync, existsSync, mkdirSync, mkdtempSync, openSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
@@ -108,8 +109,16 @@ function parseArgs(argv) {
   };
 }
 
+// A git that cannot be started is no verdict, as for `sh` below: read as a
+// failed git command, it would surface as whatever that command's failure
+// means to its caller — a missing repository, an unfetched origin/main, a
+// proof that did not hold. Only a spawn that produced no process counts:
+// spawnSync also sets `error` for a git that ran and was killed — ENOBUFS,
+// when its output outgrows the default maxBuffer — and that is a failed git
+// command like any other, never a git that could not be started.
 function git(args, cwd) {
   const r = spawnSync("git", args, { cwd, env: ENV, encoding: "utf8" });
+  if (r.error && !r.pid) throw cannot(`could not start git: ${r.error.message}`);
   return { ok: r.status === 0, out: (r.stdout ?? "").replace(/\n$/, ""), err: (r.stderr ?? "").trim() };
 }
 
@@ -231,9 +240,19 @@ function writeCache(cache, recipe, repo) {
 // is the usual one; the repo ignores them) makes both git's removal and a
 // plain recursive delete fail, so the fallback makes the tree writable first.
 // The prune always runs: it is what drops the registration of a worktree
-// whose directory is gone.
+// whose directory is gone. A git that cannot be started is reported and
+// skipped here, since this runs in the proof's `finally`.
 function removeWorktree(wt, repo) {
-  if (!git(["worktree", "remove", "--force", wt], repo).ok) {
+  const tryGit = (args) => {
+    try {
+      return git(args, repo).ok;
+    } catch (e) {
+      if (!(e instanceof Refusal)) throw e;
+      process.stderr.write(`${NAME}: skipped git ${args.join(" ")}: ${e.message}\n`);
+      return false;
+    }
+  };
+  if (!tryGit(["worktree", "remove", "--force", wt])) {
     spawnSync("chmod", ["-R", "u+w", wt], { stdio: "ignore" });
     try {
       rmSync(wt, { recursive: true, force: true });
@@ -241,7 +260,7 @@ function removeWorktree(wt, repo) {
       process.stderr.write(`${NAME}: could not remove the throwaway worktree ${wt}: ${e.message}\n`);
     }
   }
-  git(["worktree", "prune"], repo);
+  tryGit(["worktree", "prune"]);
 }
 
 function main(argv) {

package/scripts/recipe-prove.test.mjs

@@ -1,7 +1,7 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
 import { execFileSync, spawnSync } from "node:child_process";
-import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tempDir } from "./temp-dir.mjs";
 import { writeExecStub } from "./exec-stub.mjs";
@@ -371,13 +371,75 @@ test("a proof that cannot be attempted exits 2, distinct from a Recipe that is n
     "a refusal at the argument boundary creates no worktree");
 });
 
+// Every temp dir the proof made, scanned for the throwaway worktree it names `wt`.
+function assertNoWorktreeLeft(tmp) {
+  for (const d of readdirSync(tmp)) {
+    assert.deepEqual(readdirSync(join(tmp, d)).filter((n) => n === "wt"), [], `${d} still holds the throwaway worktree`);
+  }
+}
+
 test("the proof leaves no worktree directory behind in its temp dir", () => {
   const { dir } = repo(MAVEN_FILES);
   const r = prove(dir, MAVEN_PROOF);
   assert.equal(r.status, 0, r.err);
-  for (const d of readdirSync(r.tmp)) {
-    assert.deepEqual(readdirSync(join(r.tmp, d)).filter((n) => n === "wt"), [], `${d} still holds the throwaway worktree`);
-  }
+  assertNoWorktreeLeft(r.tmp);
+});
+
+test("a git that cannot be started is named as such, not reported as a missing repository", () => {
+  const { dir } = repo(MAVEN_FILES);
+  const r = prove(dir, MAVEN_PROOF, { env: { PATH: "/nonexistent" } });
+  assert.equal(r.status, 2, r.err);
+  assert.match(r.err, /^recipe-prove: could not start git: .*ENOENT/);
+  assert.doesNotMatch(r.err, /not a git repository/);
+});
+
+// A PATH holding only `sh` and a `git` that execs the real one, so the Install
+// step can take git away by deleting it: every later git call then
+// fails to start, in the proof and in the worktree cleanup alike.
+test("a git that stops starting during the Install step is no verdict, never NOT PROVEN — and the worktree is still removed", () => {
+  const realGit = execFileSync("sh", ["-c", "command -v git"], { encoding: "utf8" }).trim();
+  const { dir } = repo(MAVEN_FILES);
+  const bin = tempDir("recipe-prove-path-");
+  writeExecStub(join(bin, "git"), `#!/bin/sh\nexec '${realGit}' "$@"\n`);
+  symlinkSync("/bin/sh", join(bin, "sh"));
+  const install = `'${process.execPath}' -e 'require("fs").rmSync(process.argv[1])' '${join(bin, "git")}'`;
+  const r = prove(dir, ["--install", install, "--test", "true", "--count-line", "x 1", "--test-count", "1"], { env: { PATH: bin } });
+  assert.equal(r.status, 2, r.err);
+  assert.match(r.err, /could not start git: .*ENOENT/);
+  assert.match(r.err, /skipped git worktree remove/);
+  assert.doesNotMatch(r.err, /NOT PROVEN/);
+  assertNoWorktreeLeft(r.tmp);
+});
+
+// A git that started and ran is never "could not start": here its status
+// output outgrows spawnSync's default 1 MiB buffer, which kills it and sets
+// `error` (ENOBUFS) on a process that did run. The tree the Install step left
+// is unreadable, so the proof does not hold — NOT PROVEN, exit 1.
+test("a git whose output outgrows the spawn buffer is a failed command, not a git that could not be started", () => {
+  const { dir } = repo(MAVEN_FILES);
+  const flood = 'const fs = require("fs"); for (let i = 0; i < 7000; i++) fs.writeFileSync("f".repeat(200) + i, "")';
+  const install = `'${process.execPath}' -e '${flood}'`;
+  const r = prove(dir, ["--install", install, "--test", "true", "--count-line", "x 1", "--test-count", "1"]);
+  assert.equal(r.status, 1, r.err);
+  assert.match(r.err, /NOT PROVEN — could not read the tree state in the throwaway worktree/);
+  assert.doesNotMatch(r.err, /could not start git/);
+});
+
+// A git that starts for the worktree removal and not for the prune after it:
+// the stub deletes itself once `worktree remove` has run. The proof's own
+// outcome is NOT PROVEN (the Install step fails), and the prune that cannot
+// start must not replace it.
+test("a git that stops starting during cleanup does not replace the proof's own NOT PROVEN", () => {
+  const realGit = execFileSync("sh", ["-c", "command -v git"], { encoding: "utf8" }).trim();
+  const { dir } = repo(MAVEN_FILES);
+  const bin = tempDir("recipe-prove-path-");
+  const stub = join(bin, "git");
+  writeExecStub(stub, `#!/bin/sh\n'${realGit}' "$@"\nrc=$?\nif [ "$2" = remove ]; then /bin/rm -f '${stub}'; fi\nexit $rc\n`);
+  symlinkSync("/bin/sh", join(bin, "sh"));
+  const r = prove(dir, ["--install", "false", "--test", "true", "--count-line", "x 1", "--test-count", "1"], { env: { PATH: bin } });
+  assert.equal(r.status, 1, r.err);
+  assert.match(r.err, /NOT PROVEN/);
+  assert.match(r.err, /skipped git worktree prune: could not start git/);
 });
 
 // Whether the process ignores file modes: root writes into a 0555 directory.
@@ -393,9 +455,7 @@ test("read-only install output cannot turn a proof that held into a crash", { sk
   const r = prove(dir, ["--install", READ_ONLY_INSTALL, ...MAVEN_PROOF.slice(2)]);
   assert.equal(r.status, 0, r.err);
   assert.equal(JSON.parse(readFileSync(cachePath(dir), "utf8")).derivedAt, head);
-  for (const d of readdirSync(r.tmp)) {
-    assert.deepEqual(readdirSync(join(r.tmp, d)).filter((n) => n === "wt"), [], `${d} still holds the throwaway worktree`);
-  }
+  assertNoWorktreeLeft(r.tmp);
   assert.equal(git(dir, "worktree", "list", "--porcelain").split("\n").filter((l) => l.startsWith("worktree ")).length, 1);
 });
 

package/scripts/review-core-cwd-isolation.test.mjs

@@ -25,7 +25,7 @@
 // agent must not write to, `pwd` fixes which directory that is, and the
 // `CWD-AUDIT:` line is what makes a CLEAN run say so. An audit reported only
 // when it finds something is indistinguishable from one never run — the same
-// reading `unrunReason` already applies to a `test_run` reporting nothing, and
+// reading `unrunReason` already applies to a shared test run reporting nothing, and
 // the reason "four files dirty" was found by chance rather than by a report.
 //
 // WHY THESE PINS RENDER RATHER THAN GREP, and why the slice is the pin: same
@@ -335,7 +335,6 @@ function fakeReviewHost(scopeSearched) {
           dimension: "correctness",
           scope_searched: scopeSearched,
           findings: [],
-          test_run: { command: "node --test", tests: 5, pass: 5, fail: 0 },
         };
       throw new Error(`fakeReviewHost: unexpected dispatch ${opts.label}`);
     },

package/scripts/review-core-shared-test-run.test.mjs

@@ -18,7 +18,7 @@ import { execFileSync } from "node:child_process";
 import { mkdtempSync, mkdirSync, readFileSync, existsSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { runReview, DEFAULT_DIMENSIONS, FINDINGS_SCHEMA, CRASHED_REASON } from "./review-core.mjs";
+import { runReview, DEFAULT_DIMENSIONS, CRASHED_REASON } from "./review-core.mjs";
 import { pipeline, parallel, ARGS, SNAP, review, finding, vote, scriptedHost } from "./review-host-fixture.mjs";
 
 const ALL = DEFAULT_DIMENSIONS.map((d) => d.key);
@@ -229,10 +229,47 @@ test("a crashed dimension is listed once, with its crash reason, beside the shar
   assert.equal(result.dimensionsUnrun.find((u) => u.dimension === "types").reason, CRASHED_REASON);
 });
 
-// Downstream readers of `test_run` see the shape they always did.
-test("test_run's shape is unchanged: command and tests required, pass and fail optional, nothing else", () => {
-  const t = FINDINGS_SCHEMA.properties.test_run;
-  assert.deepEqual(Object.keys(t.properties).sort(), ["command", "fail", "pass", "tests"]);
-  assert.deepEqual([...t.required].sort(), ["command", "tests"]);
-  assert.equal(t.additionalProperties, false);
+// The shared run alone decides. A specialist whose payload still carries its
+// own `test_run` — from a prompt that predates the field's removal — is
+// ignored: a count that disagrees with the shared run changes no verdict, and
+// leaves no trace in the result. The baseline is the same script with no stray
+// field, so the comparison is the whole result, not a chosen key.
+test("a specialist's stray test_run never changes the result, and the shared run alone decides", async () => {
+  const stray = (r, testRun) => ({ ...r, test_run: testRun });
+  const cases = [
+    // The shared run counted nothing; a stray copy claims a full suite ran.
+    ["shared tests 0, stray 9999", { exitCode: 0, tests: 0, pass: 0, fail: 0 }, { command: "MARKER-CMD", tests: 9999, pass: 9999, fail: 0 }, {}],
+    // The shared run is clean; a stray copy claims nothing ran. Findings on
+    // three dimensions put an entry in survived, refuted and unverified.
+    [
+      "shared clean, stray 0",
+      { exitCode: 0, tests: 5, pass: 5, fail: 0 },
+      { command: "MARKER-CMD", tests: 0 },
+      {
+        "review:correctness": [review([finding("critical")])],
+        "verify:correctness": [vote(false)],
+        "review:types": [review([finding("important")])],
+        "verify:types": [vote(true)],
+        "review:tests": [review([finding("suggestion")])],
+      },
+    ],
+  ];
+  for (const [name, shared, testRun, extra] of cases) {
+    const base = script({ "test-run": [shared], ...extra });
+    const withStray = Object.fromEntries(
+      Object.entries(base).map(([label, seq]) => [label, label.startsWith("review:") ? seq.map((r) => stray(r, testRun)) : seq]),
+    );
+    const expected = await run(scriptedHost(base).host);
+    const actual = await run(scriptedHost(withStray).host);
+    assert.deepEqual(actual, expected, `${name}: a stray test_run changed the result`);
+    const text = JSON.stringify(actual);
+    assert.doesNotMatch(text, /MARKER-CMD|test_run/, `${name}: the stray test_run reached the result`);
+    if (shared.tests === 0) {
+      assert.deepEqual(actual.dimensionsUnrun.map((u) => u.dimension), ALL, `${name}: not every live dimension is unrun`);
+      assert.doesNotMatch(text, /9999/, `${name}: the stray count reached the result`);
+    } else {
+      assert.deepEqual(actual.dimensionsUnrun, [], `${name}: a stray count of 0 made a dimension unrun`);
+      for (const key of ["survived", "refuted", "unverified"]) assert.equal(actual[key].length, 1, `${name}: ${key} holds no finding — this case tests nothing`);
+    }
+  }
 });

package/scripts/review-core-unrun.test.mjs

@@ -292,27 +292,22 @@ test("scope_searched is in the required array, not only in its own description",
   const { required } = FINDINGS_SCHEMA;
   assert.ok(Array.isArray(required), "FINDINGS_SCHEMA no longer has a top-level required array — update this test");
   assert.ok(required.includes("scope_searched"), "scope_searched is documented Required and is not in the required array (#139)");
-  assert.ok(required.includes("test_run"), "test_run is not required, so an unrun dimension can still return a clean-looking object (#137)");
 });
 
-// `additionalProperties: false` REJECTS an undeclared field, so a `required`
-// entry whose property is not declared is worse than neither: the specialist is
-// forced to send a field the schema then drops. Both halves, one pin.
-test("test_run is declared, carries the command and count, and does not force pass/fail", () => {
-  const testRun = FINDINGS_SCHEMA.properties.test_run;
-  assert.ok(testRun, "test_run is not declared in FINDINGS_SCHEMA's properties — additionalProperties:false drops it");
-  for (const field of ["command", "tests", "pass", "fail"]) {
-    assert.ok(testRun.properties[field], `test_run no longer declares ${field}`);
-  }
-  assert.ok(Array.isArray(testRun.required), "test_run no longer names which of its fields are required — update this test");
-  assert.ok(testRun.required.includes("command"), "test_run.command must be required — a count with no command bounds nothing");
-  assert.ok(testRun.required.includes("tests"), "test_run.tests must be required — it is the count every specialist copies from the shared run");
-  // A runner whose output does not split pass from fail must not be forced to
-  // invent numbers: an unanswerable required field is answered with a guess,
-  // and a guessed count is worse than an absent one.
-  for (const optional of ["pass", "fail"]) {
-    assert.ok(!testRun.required.includes(optional), `${optional} must stay optional — see the comment above this assertion`);
-  }
+// The review's ONE shared run is the single record of the test run: a
+// specialist is not asked to copy it, so the payload neither requires nor
+// declares a field for the copy. Both halves pinned together, because under
+// `additionalProperties: false` either one re-added alone is a contract the
+// specialist cannot meet — a required field the schema rejects, or a declared
+// one nothing reads.
+test("FINDINGS_SCHEMA neither requires nor declares a specialist copy of the test run", () => {
+  assert.deepEqual(
+    [...FINDINGS_SCHEMA.required].sort(),
+    ["dimension", "findings", "scope_searched"],
+    "FINDINGS_SCHEMA's required list changed — a specialist must return exactly these",
+  );
+  assert.ok(!Object.hasOwn(FINDINGS_SCHEMA.properties, "test_run"), "FINDINGS_SCHEMA declares test_run again — nothing reads a specialist's copy of the shared run");
+  assert.equal(FINDINGS_SCHEMA.additionalProperties, false);
 });
 
 // The entry, not the call site. `unrunEntries` returns zero entries or one per
@@ -403,20 +398,34 @@ test("the returned object carries dimensionsUnrun alongside dimensionsRun", () =
   assert.match(tail, /dimensionsUnrun/, "the return never surfaces dimensionsUnrun — the classification dies in the script (#137, #138)");
 });
 
-// The schema field is inert unless the prompt points at it — the specialists
-// are what fill it in, and a field nothing asks for comes back absent from
-// every one of them. #2315 moved the instruction into `sharedRunNote`, the
-// Tests paragraph every specialist prompt interpolates, and what it says now is
-// to COPY the shared run — including a run that stated no counts.
-test("the shared-run note names test_run as where the shared run gets reported, even one with no counts", () => {
-  for (const run of [
-    { command: "node --test", logPath: "/r/test-run.log", tests: 5, pass: 5, fail: 0 },
-    { command: "node --test", logPath: "/r/test-run.log", error: "no summary" },
+// The note hands every specialist the shared run and tells it not to run the
+// full command itself — and nothing more about the run: the shared run is the
+// single record of it, so no specialist is told to report or copy it anywhere.
+// Every rendering the note has — usable, no counts (NOT usable), and failing
+// tests for the owner and for a non-owner — is checked, because each appends a
+// different paragraph to the same opening one.
+test("the shared-run note hands over the run and forbids a rerun, and asks for no copy of it in any rendering", () => {
+  const usable = { command: "node --test", logPath: "/r/test-run.log", exitCode: 0, tests: 5, pass: 5, fail: 0 };
+  const noCounts = { command: "node --test", logPath: "/r/test-run.log", error: "no summary" };
+  const failing = { command: "node --test", logPath: "/r/test-run.log", exitCode: 1, tests: 5, pass: 3, fail: 2 };
+  for (const [name, run, key, paragraph] of [
+    ["usable", usable, "tests", null],
+    ["no counts", noCounts, "tests", /This run is NOT usable: /],
+    ["failing, owner", failing, "correctness", /filing them is YOUR job in this review/],
+    ["failing, non-owner", failing, "tests", /the correctness dimension files the finding/],
   ]) {
-    const note = sharedRunNote(run, "correctness", "tests");
-    assert.match(note, /`test_run`/, "the note never names test_run, so nothing fills the field the schema requires");
-    assert.match(note, /`tests: 0` when it states\s+none/, "the note no longer says what to report for a run with no counts");
-    assert.match(note, /never a run of your own/);
+    const note = sharedRunNote(run, "correctness", key);
+    assert.doesNotMatch(note, /test_run/, `${name}: the note still names test_run`);
+    assert.match(note, /Do NOT run that full command yourself/, `${name}: the note no longer forbids a rerun`);
+    assert.match(note, /\n {2}command: node --test\n/, `${name}: the note lacks the command line`);
+    assert.match(note, /\n {2}counts: {2}\S/, `${name}: the note lacks the counts line`);
+    assert.match(note, /\n {2}exit: {4}\S/, `${name}: the note lacks the exit line`);
+    assert.match(note, /\n {2}log: {5}\/r\/test-run\.log\n/, `${name}: the note lacks the log line`);
+    // The opening paragraph ends on the log instruction: nothing after it
+    // asks the specialist to report the run.
+    const first = note.split(/\n(?=This run is NOT usable|It has )/)[0];
+    assert.match(first, /Read the log for anything the counts do not say\.$/, `${name}: the opening paragraph says more after the log instruction`);
+    if (paragraph) assert.match(note, paragraph, `${name}: the paragraph this rendering appends is missing`);
   }
 });
 
@@ -437,13 +446,13 @@ test("run-team's Reviewers section documents dimensionsUnrun, not only dimension
 });
 
 // What the absence of an unrun classification ESTABLISHES is that a suite ran —
-// never that the dimension is covered. `unrunReason` above reads `test_run`'s
-// counts and quotes `command` into its message; it never compares that command
-// against the one the dispatch handed out, so a specialist that substituted a
-// narrower runner reports a non-zero count, is not classified unrun, and reads
-// as covered having validated a fraction of the suite. Comparing the two was
-// refuted 2-0 and stays refuted (#535) — the doc claiming only what the
-// classifier can see is the remedy, and nothing pinned the word it turns on.
+// never that the dimension is covered. `unrunReason` above reads the shared
+// run's counts and quotes its `command` into its message; it never judges what
+// that command covers, so a narrower runner reports a non-zero count, is not
+// classified unrun, and reads as covered having validated a fraction of the
+// suite. Comparing that command against the dispatched one was refuted 2-0 and
+// stays refuted (#535) — the doc claiming only what the classifier can see is
+// the remedy, and nothing pinned the word it turns on.
 //
 // The positive pin carries the claim: sliced to the paragraph so a failure
 // prints it rather than the whole 2000-line doc, matched through `phrase` so a

package/scripts/review-core.mjs

@@ -40,7 +40,7 @@ import { isDigits } from "./arg.mjs";
 export const FINDINGS_SCHEMA = {
   type: "object",
   additionalProperties: false,
-  required: ["dimension", "scope_searched", "findings", "test_run"],
+  required: ["dimension", "scope_searched", "findings"],
   properties: {
     dimension: { type: "string" },
     scope_searched: {
@@ -48,19 +48,6 @@ export const FINDINGS_SCHEMA = {
       description:
         "The exact commands/paths this pass covered. Required so a negative claim is bounded: a grep that found nothing looks identical to a grep never run.",
     },
-    test_run: {
-      type: "object",
-      additionalProperties: false,
-      required: ["command", "tests"],
-      description:
-        "The review's ONE shared test run, copied from your prompt — you do not run the full suite yourself (#2315). Report it even when it failed or produced nothing.",
-      properties: {
-        command: { type: "string", description: "The shared run's command, verbatim as your prompt states it." },
-        tests: { type: "integer", description: "The shared run's test count as your prompt states it; 0 when it states none." },
-        pass: { type: "integer" },
-        fail: { type: "integer" },
-      },
-    },
     findings: {
       type: "array",
       items: {
@@ -536,9 +523,7 @@ still yours to run.
   counts:  ${countsOf(run) || "none — the run produced no counts"}
   exit:    ${run.exitCode ?? "(not reported)"}
   log:     ${run.logPath}
-Read the log for anything the counts do not say. Report this run in
-\`test_run\` — its command verbatim and these counts, \`tests: 0\` when it states
-none — never a run of your own.`,
+Read the log for anything the counts do not say.`,
   ];
   const why = testRunReason(run);
   if (why)

package/scripts/review-host-fixture.mjs

@@ -38,16 +38,14 @@ export const SNAP = {
   repoVerified: true,
   testCmd: "node --test",
 };
-export const RAN = { command: "node --test", tests: 5, pass: 5, fail: 0 };
 // #2315. The shared test run's agent report — the `test-run` dispatch every
 // review makes once, before any specialist. Clean, so a script that is about
 // something else need not answer it; one that is about it names its own.
 export const SHARED = { exitCode: 0, tests: 5, pass: 5, fail: 0 };
-export const review = (findings, testRun = RAN) => ({
+export const review = (findings) => ({
   dimension: "correctness",
   scope_searched: "CWD-AUDIT: clean /repo",
   findings,
-  test_run: testRun,
 });
 export const finding = (severity) => ({ severity, claim: `a ${severity} claim`, file: "a.js", line: 3, evidence: "line 3 has no else" });
 export const vote = (refuted) => ({ refuted, reason: "measured. CWD-AUDIT: clean /repo" });

package/skills/run-team/SKILL.md

@@ -2024,7 +2024,7 @@ up to ~10k characters, in every fix-applier prompt you wrote. The fix-applier
 reads every one off the file and makes every ruling on them
 (`review-and-fix.md`'s **The review result file**). What the digest tells you:
 
-**`testEnvironment` says what every dimension's `test_run` is evidence about**,
+**`testEnvironment` says what the review's shared test run is evidence about**,
 and it is present on a healthy run as well as a degraded one, so there is
 nothing to notice by its absence. The snapshot is `git archive`d and then
 `git init`ed with one commit, and the block that cuts it compares that commit's
@@ -2032,8 +2032,8 @@ tree hash against the reviewed commit's (#1056): verified, a suite run in the
 snapshot collects and runs what a checkout does, and a red is a fact about the
 tree. UNVERIFIED, it is not — tests that ask git what ships decline or fail for
 the environment, and this field carries which line of the cut failed. The
-fix-applier reads it before acting on any `test_run` count; you read it so a
-degraded review never passes for a clean one.
+fix-applier reads it before acting on any count from the shared test run; you
+read it so a degraded review never passes for a clean one.
 `unverified` is *not* "checked and cleared" — a `suggestion` skips the pass by
 policy, and a finding whose refuters all crashed lands there too. Both go to the
 fix-applier with the rest, in the file; never rule on them yourself.
@@ -2104,10 +2104,10 @@ the same `testCmd` you passed the review, and the **path** `<scratch>/review-<pr
 — never the findings. The fix-applier owns every per-PR ruling you once made
 before dispatch: both mutual-exclusion scans, the suggested-fix re-derivation,
 `refuted=false` ≠ apply, per-site measurement for a sibling-site extension, and
-`testEnvironment`/`cwdAudit` before any `test_run`. It holds every finding and
-you hold none, so there is nothing for you to rank, relay or pre-rule — and a
-report from a refuter it spawns that surfaces to you is its to retrieve, never
-yours to scan or pass on.
+`testEnvironment`/`cwdAudit` before any result of the shared test run. It
+holds every finding and you hold none, so there is nothing for you to rank,
+relay or pre-rule — and a report from a refuter it spawns that surfaces to you
+is its to retrieve, never yours to scan or pass on.
 
 **A `DISPATCH fix-pr PR#<M>` on a conflict hold** — the row carries the merge
 bot's unresolved `conflict-hold:#<M>` (`run-merge-bot.md` step 1's fallback) —
@@ -2225,8 +2225,9 @@ all.
 > the rest of the recipes and every ruling on the findings: both
 > mutual-exclusion scans, the suggested-fix re-derivation, `refuted=false` ≠
 > apply, per-site measurement for a sibling-site extension, and `testEnvironment`
-> and `cwdAudit` before any `test_run`. Every one of those rulings is yours —
-> nobody upstream has made one, and the controller never reads the findings.
+> and `cwdAudit` before any result of the shared test run. Every one of those
+> rulings is yours — nobody upstream has made one, and the controller never
+> reads the findings.
 >
 > **Every factual claim your diff restates needs a settling command run
 > against the tree first** — the issue body is a lead, never a citation.