@ssheleg/sheleg-dev 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -4,6 +4,68 @@ All notable changes to this project are documented here.
 Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 Versioning: [SemVer](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.0 — 2026-08-20
+
+**The self-test that proved the money invariants was measuring one thing and claiming
+another.** `--self-test` deleted a rule, ran an invariant, and asked whether the invariant
+went red. Twelve invariants carried **45 `assert.` calls**, and the verdict line called
+them *"12 assertions, each watched failing"* — so any assertion that was not the sole
+discriminator of a rule could be replaced by `assert.ok(true)` and nothing anywhere would
+notice. Measured against the shipped v0.7.0 pack: three neutered assertions (the
+`clawbacks.map` deepEqual, the `mirror.periodEnd` equality, the `response.body` deepEqual)
+left `--self-test` at exit 0 and `npm test` at 0. The same hole in `ad-tracking`, in the PII
+guard `references/meta-linkedin.md` advertises by name.
+
+The `assert` an invariant receives is now a recorder: a failure is remembered instead of
+thrown, so the assertions after it still run, and each call site is one measurement
+identified by its line. **37 of 45 watched failing, one call site at a time. Eight declared
+`assert.unmutated`** — an assertion no rule in the pack varies — **and measured unbreakable,
+with the reason at the call site.** Both directions: an `unmutated` assertion a mutant does
+break is a failure too, or the escape hatch is the bypass. Four assertions that were being
+pre-empted by a `TypeError` on the line above them became measurable rather than declared
+away. `test/fixtures_test.js` grew three plants, one of them the NON-first assertion inside
+a multi-assert invariant — the plant that used to pass.
+
+Then the sweep that started there and did not stop:
+
+- **The validator's check count did not count checks.** `checks = 10 + len(skill_dirs)`, so
+  adding a skill moved the number and adding a check did not — and five ledger rows read it
+  as evidence a guard had arrived. Every check is registered; the verdict prints the
+  registry's length, and the ledger's quoted copy of that line is compared against it.
+- **The ledger described an artifact nobody ships.** Its shipped block was headed `v0.6.0`
+  while `v0.7.0` was tagged and on npm, and 37 rows read *verified locally · unreleased*
+  under four blocks closing *"Nothing was released."* The heading is now compared against
+  `git describe --tags` and against `package.json`.
+- **The `mcp__.*` half of the manual gate had no guard.** Deleting that entry from
+  `hooks/hooks.json` left all three suites green, while the decision module does refuse
+  `mcp__…__create_refund` by name. And `README.md`'s copy-channel snippet registered one
+  matcher against the plugin's two — a weaker gate handed out by the document that exists
+  because the channel has none. Both are now checked; the snippet by matcher set.
+- **This repository measured no body budget at all**, so `crypto-payments/SKILL.md` sat past
+  the house working limit and was caught by another repository's auditor. Measured here now,
+  and the skill was **split rather than trimmed**: `references/callback-route-hardening.md`
+  and `references/testing-and-local-dev.md`, 4894 → 4387 tokens. All six skills `0 GAP`.
+- **Counted numbers became computed ones.** Seven in `SECURITY.md` (all four correct on the
+  day they were written, three of them moved by this change) and two in
+  `docs/evals/stripe-billing.md`, which restated `4994` tokens / `441` lines / `0 GAP, 13
+  PASS` against a measured 4747 / 409 / `0 GAP, 14 PASS`.
+- **A document that ships now resolves against the tarball, not only against a clone.**
+  `SECURITY.md` sent a reader to two documents `npm pack` does not contain.
+- **`docs/` joined the checked corpus**, with every document in it classified as live or as
+  a dated record — `docs/AGENT_SYNC.md` had been naming six paths this repository does not
+  have.
+- **`.claude/agent-sync.json` pointed at a file that did not exist** and guarded the ledger
+  without guarding the board.
+- **`CONTRIBUTING.md` called the gate two suites and it runs three**; the PR template asked
+  for one third of it. Both derive the list from `package.json` → `scripts.test` now.
+- **`install.sh` — the channel that `rm -rf`s each destination — printed no notice** that
+  the gate does not travel with it, while the npm installer did.
+
+Fourteen negative self-tests were added, one per guard, and all **42** were watched refusing
+their plants on a green tree. CI run `32293489020` at `6f66255` — 39 steps, 39 `success`,
+28 of 28 negatives — retires the *"CI has not seen any of this"* limitation the ledger had
+recorded four separate times.
+
 ## v0.7.0 — 2026-08-19
 
 **The pack that takes money had the weakest controls in the family, and every one of them

package/README.md

@@ -22,8 +22,9 @@ Each carries its own references and loads them only when the work reaches them.
 
 **Two of them ship a suite rather than a warning.** `stripe-billing` and `ad-tracking`
 carry a `fixtures/` directory — real provider webhook bodies, an assertion pack, and a
-`--self-test` that deletes one rule at a time so you can watch every assertion fail. Copy
-the directory in and run it:
+`--self-test` that deletes one rule at a time so you can watch every assertion fail — one
+call site at a time, which is not the same thing as one invariant at a time. Copy the
+directory in and run it:
 
 ```bash
 node plugins/sheleg-dev/skills/stripe-billing/fixtures/assert-money-invariants.mjs --self-test
@@ -163,12 +164,24 @@ settings, by design.
   `.claude/settings.json`:
 
   ```json
-  { "hooks": { "PreToolUse": [ { "matcher": "Bash",
+  { "hooks": { "PreToolUse": [
+    { "matcher": "Bash",
       "hooks": [ { "type": "command",
         "command": "node \"$HOME/.claude/skills/.sheleg-dev-hooks/money-gate.js\"",
-        "timeout": 15 } ] } ] } }
+        "timeout": 15 } ] },
+    { "matcher": "mcp__.*",
+      "hooks": [ { "type": "command",
+        "command": "node \"$HOME/.claude/skills/.sheleg-dev-hooks/money-gate.js\"",
+        "timeout": 15 } ] }
+  ] } }
   ```
 
+  **Both entries, not just the first.** A refund does not care which door it came
+  through: `create_refund` on an MCP server never touches a shell, and the table above
+  advertises it. Until 2026-08-20 this snippet carried the `Bash` matcher alone — a
+  weaker gate than the plugin's, handed out by the document that exists because the copy
+  channels have no gate at all. `test/validate.py` now compares the two matcher sets.
+
   Copy `plugins/sheleg-dev/hooks/` to that path first. `npx @ssheleg/sheleg-dev` prints
   this reminder; **nothing enforces it**, which is why the plugin channel is the
   recommended one.
@@ -219,8 +232,9 @@ matter does not error — hosts truncate it silently, which is worse); and
 dangling link nor a file nobody loads can ship.
 
 Plus, for the money fixtures, that every assertion has been watched failing and that no
-two rules are covering for each other — `test/fixtures_test.js` neuters three assertions
-and requires each pack's `--self-test` to notice.
+two rules are covering for each other — `test/fixtures_test.js` neuters assertions,
+including one that is **not** the first inside a multi-assert invariant, and requires each
+pack's `--self-test` to notice. That last plant is the one that used to pass.
 
 CI plants a defect against every one of those guards and requires the validator
 to fail. A green from a check nobody has watched fail is not evidence.

package/SECURITY.md

@@ -16,7 +16,7 @@ documents name that does not exist here.
 
 ## What ships, and what of it executes
 
-`git ls-files plugins` returns **50 files: 28 markdown, one plugin manifest, three
+`git ls-files plugins` returns **52 files: 30 markdown, one plugin manifest, three
 files of the manual gate, and 18 files of money fixtures.** Two of the six skills now
 ship code you can run — the assertion packs under `fixtures/` — and that is a change
 from every release before v0.7.0, so it is stated here rather than left to be noticed.
@@ -26,19 +26,23 @@ no socket; the greps below prove all three.
 | Component | Count | Runtime behavior |
 |---|---|---|
 | `SKILL.md`, one per skill | 6 | Text. Read by the agent, executes nothing. |
-| `references/` files, loaded on demand | 20 | Text. Same. |
+| `references/` files, loaded on demand | 22 | Text. Same. |
 | `plugins/sheleg-dev/.claude-plugin/plugin.json` | 1 | Manifest read by Claude Code. |
 | `plugins/sheleg-dev/hooks/hooks.json` | 1 | Hook manifest read by Claude Code. Declares one `PreToolUse` hook and no `if` filter. |
 | `plugins/sheleg-dev/hooks/money-gate.js` | 1 | Runs on a tool call, when the plugin is enabled. Requires `path` and its own decision module — nothing else. Reads stdin, writes one JSON line, exits 0 on every path. |
 | `plugins/sheleg-dev/hooks/lib/moneygate.js` | 1 | Pure. Payload and environment in, verdict out. No `require` at all, no filesystem, no clock. |
 | `bin/sheleg-dev.js` — the npm installer | 1 | Runs only when you invoke it. Node built-ins only: `fs`, `path`, `os`. |
-| `install.sh` — the shell installer | 1 | Runs only when you invoke it. Coreutils only: `cd`, `pwd`, `dirname`, `basename`, `mkdir`, `rm`, `cp`, `echo`. |
+| `install.sh` — the shell installer | 1 | **Not in the tarball** — `files` ships `bin/` and `plugins/`, so this one reaches you only through a clone. Runs when you invoke it. Coreutils only: `cd`, `pwd`, `dirname`, `basename`, `mkdir`, `rm`, `cp`, `echo`. It is the destructive channel: `rm -rf` per skill, then `cp -R`. |
 | `plugins/sheleg-dev/skills/*/fixtures/*.json` — webhook payloads | 12 | Data. Placeholder ids only; no key, token, signing secret or real customer id. |
 | `plugins/sheleg-dev/skills/*/fixtures/*.mjs` — the assertion packs and their reference implementations | 4 | Runs only when you invoke it. Reads the JSON beside it with `readFileSync` and nothing else: no `child_process`, no `fetch`, no write, no `process.env`. |
 | `plugins/sheleg-dev/skills/*/fixtures/manifest.json` and its `README.md` | 4 | Text. The invariant-to-fixture-to-document map, which `test/validate.py` reads. |
 
-The published tarball is those plus `README.md`, `CHANGELOG.md`, `SECURITY.md`,
-`LICENSE` and `package.json` — 56 files, listed by `npm pack --dry-run`.
+The published tarball is `bin/` and `plugins/` plus `README.md`, `CHANGELOG.md`,
+`SECURITY.md`, `LICENSE` and `package.json` — 58 files, listed by
+`npm pack --dry-run`. `install.sh`, `test/`, `docs/` and `CONTRIBUTING.md` are **not**
+in it; `test/validate.py` now refuses a path these shipped documents name that the
+tarball does not carry, because resolving in a clone is the wrong question for a
+document that ships.
 
 **The gate can refuse a command and can never run one.** `money-gate.js` requires
 `path` and the decision module; the decision module requires nothing. There is no
@@ -140,8 +144,11 @@ Not the bytes — the advice. These six skills describe Stripe, Heleket and BTCP
 Google Sign-In, Workload Identity Federation, four ad platforms and browser
 defaults, and every one of those changes. **A claim here that a provider has since
 changed is a security defect in this pack**, not merely a stale doc, and it is the
-exposure `docs/evidence/verification.md` names as the largest one this repository
-does not test. `CONTRIBUTING.md` requires a claim about what a provider does
+exposure the verification ledger names as the largest one this repository does not
+test. **Neither that ledger nor the contributor guide is in this tarball** —
+`docs/evidence/verification.md` and `CONTRIBUTING.md` live in the git repository at
+<https://github.com/ssheleg/sheleg-dev>, and until 2026-08-20 this paragraph named
+both as if you had them. The guide requires a claim about what a provider does
 *today* to carry the date it was true. If you find one that has rotted, report it
 with what the correct claim is and what backs it.
 
@@ -161,7 +168,7 @@ git clone https://github.com/ssheleg/sheleg-dev && cd sheleg-dev
 # self-describing documents name -- this file included.
 python3 test/validate.py
 
-# The shipped payload: 50 files.
+# The shipped payload: 52 files.
 git ls-files plugins
 
 # 22 lines: the plugin manifest, the three files of the manual gate, and the 18
@@ -176,11 +183,13 @@ grep -nE "\brequire\(" plugins/sheleg-dev/hooks/money-gate.js plugins/sheleg-dev
 grep -nE "child_process|\bfetch\(|require\('(http|https|net|fs|dns|tls)'\)|spawn\(|execFile|writeFile|appendFile|unlink" \
   plugins/sheleg-dev/hooks/money-gate.js plugins/sheleg-dev/hooks/lib/moneygate.js
 
-# Both directions of the gate, watched: 65 fixtures, refusals and allow-plants.
+# Both directions of the gate, watched: every refusal and every false-positive
+# plant. The command prints its own count -- this document does not restate it.
 node test/moneygate_test.js
 
 # The money fixtures: both assertion packs against their reference implementation, both
-# --self-test runs, and three plants that neuter an assertion. 13 checks.
+# --self-test runs (per ASSERTION, not per invariant), and the plants that neuter one.
+# The command prints its own count.
 node test/fixtures_test.js
 
 # What the assertion packs cannot reach: NO OUTPUT, and grep exits 1 because it
@@ -196,6 +205,6 @@ grep -nE "require|child_process|exec|spawn|fetch|socket|rm -rf|cp -R|copyFileSyn
 # Live-key shapes across the skill payload: one line, and it is a placeholder.
 grep -rnE "sk_live_[A-Za-z0-9]|rk_live_[A-Za-z0-9]|whsec_[A-Za-z0-9]{8}|BEGIN [A-Z ]*PRIVATE KEY" plugins
 
-# What npm publishes, and nothing else: 56 files.
+# What npm publishes, and nothing else: 58 files.
 npm pack --dry-run
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/sheleg-dev",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Six integration skills for the layer a product reaches once it has users: Stripe subscription billing, crypto payments, ad and conversion tracking under Consent Mode v2, Google sign-in and the wider Google auth surface, and Core Web Vitals. This package is the installer CLI.",
   "bin": {
     "sheleg-dev": "bin/sheleg-dev.js"

package/plugins/sheleg-dev/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "sheleg-dev",
   "displayName": "Sheleg Dev",
   "description": "The integration layer a product needs once it has users: Stripe subscription billing reconciled into your own database, crypto payments that survive over-payment and duplicate webhooks, ad and conversion tracking under Consent Mode v2, Google sign-in with the account-linking guards, the wider Google auth surface, and Core Web Vitals work that moves the score.",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/sheleg-dev/skills/ad-tracking/fixtures/README.md

@@ -3,12 +3,13 @@
 **Copy this whole directory into your repository.** It is the executable half of what
 `SKILL.md` → *E-commerce* and `references/meta-linkedin.md` →
 *Deduplication with the Conversions API* state in prose: the three payloads one purchase
-produces, six assertions a correct emitter must pass, and a self-test that breaks the
-emitter one rule at a time so you can watch every assertion fail.
+produces, six invariants a correct emitter must hold — 12 assertions between them — and a
+self-test that breaks the emitter one rule at a time so you can watch each assertion fail
+on its own.
 
 ```bash
-node assert-dedup-contract.mjs              # 6 assertions against the reference emitter
-node assert-dedup-contract.mjs --self-test  # break one rule at a time; every assertion must go red
+node assert-dedup-contract.mjs              # 6 invariants / 12 assertions
+node assert-dedup-contract.mjs --self-test  # break one rule at a time; EACH ASSERTION must go red
 ```
 
 No dependencies, no network, **no access token anywhere in this directory** — the sink

package/plugins/sheleg-dev/skills/ad-tracking/fixtures/assert-dedup-contract.mjs

@@ -77,7 +77,7 @@ export const INVARIANTS = [
     fixtures: [PIXEL_BROWSER, CAPI_SERVER],
     states: 'one id, generated once and used by both sides, or the revenue counts twice',
     breaks: ['shared-event-id'],
-    run({ sink, emitter }) {
+    run({ sink, emitter, assert }) {
       runPurchase({ sink, emitter }, CLEARED());
       // The browser side is read from the SHIPPED fixture rather than from the sink. That
       // is deliberate: it keeps this assertion independent of whether the browser event
@@ -95,7 +95,7 @@ export const INVARIANTS = [
     fixtures: [PIXEL_BROWSER, CAPI_SERVER],
     states: 'Meta compares the name as well as the id, and the name is the half that is missed',
     breaks: ['exact-event-name'],
-    run({ sink, emitter }) {
+    run({ sink, emitter, assert }) {
       runPurchase({ sink, emitter }, CLEARED());
       const pixelName = fixture(PIXEL_BROWSER)[1];   // the browser contract, not the sink
       const serverName = sink.capi[0].data[0].event_name;
@@ -110,7 +110,7 @@ export const INVARIANTS = [
     fixtures: [CAPI_FORBIDDEN],
     states: 'the thank-you page has no idea whether the money moved, so it reports nothing',
     breaks: ['webhook-sourced'],
-    run({ sink, emitter }) {
+    run({ sink, emitter, assert }) {
       runPurchase({ sink, emitter }, NOT_CLEARED());
       assert.equal(sink.capi.length, 0,
         'a Conversions API purchase was sent for a charge that has not cleared — this is '
@@ -125,12 +125,16 @@ export const INVARIANTS = [
     fixtures: [PIXEL_BROWSER],
     states: 'the browser event stays and stays subordinate — it carries the click ids',
     breaks: ['keep-browser-event'],
-    run({ sink, emitter }) {
+    run({ sink, emitter, assert }) {
       runPurchase({ sink, emitter }, CLEARED());
       assert.equal(sink.pixel.length, 1,
         'no browser event fired: the click id, the consent state and the session are lost, '
         + 'and only the browser had them');
-      assert.equal(sink.pixel[0][0], 'track');
+      // `|| []` on purpose: with no browser event at all this must FAIL rather than throw a
+      // TypeError, because an assertion the runner never reached is one no mutant has been
+      // watched breaking — which is how it sat unmeasured until 2026-08-20.
+      assert.equal((sink.pixel[0] || [])[0], 'track',
+        'the browser event is not a `track` call — the pixel contract is `fbq(\'track\', …)`');
     },
   },
   {
@@ -138,7 +142,7 @@ export const INVARIANTS = [
     fixtures: [CAPI_SERVER],
     states: 'advanced matching sends hashes, never the address itself',
     breaks: ['hashed-identifiers'],
-    run({ sink, emitter }) {
+    run({ sink, emitter, assert }) {
       runPurchase({ sink, emitter }, CLEARED());
       const userData = sink.capi[0].data[0].user_data;
       for (const value of userData.em) {
@@ -156,7 +160,7 @@ export const INVARIANTS = [
     // Broad by construction: it compares the whole body, so every rule that changes any
     // field turns it red. It is here so a reader can trust the fixtures they copy.
     breaks: ['shared-event-id', 'exact-event-name', 'hashed-identifiers', 'keep-browser-event'],
-    run({ sink, emitter }) {
+    run({ sink, emitter, assert }) {
       runPurchase({ sink, emitter }, CLEARED());
       assert.deepEqual(sink.capi[0], fixture(CAPI_SERVER));
       assert.deepEqual(sink.pixel[0], fixture(PIXEL_BROWSER));
@@ -164,46 +168,166 @@ export const INVARIANTS = [
   },
 ];
 
+// ------------------------------------------------- one assertion, one measurement
+//
+// Why the assertions are not called straight through `node:assert`. Until 2026-08-20 the
+// runner returned on the FIRST throw and the matrix compared one row per invariant, so an
+// invariant was measured as a single unit: any assertion that was not the sole
+// discriminator could be replaced by `assert.ok(true)` and nothing went red. Measured that
+// day in this pack too — the PII guard below (*"user_data carries something with an @ in
+// it"*, advertised by name at `references/meta-linkedin.md`) was neutered and
+// `--self-test` stayed at exit 0, because the `assert.match` above it discriminated the
+// same rule.
+//
+// So the `assert` an invariant receives is a RECORDER: same API, but a failure is
+// remembered instead of thrown and the assertions after it still run. Each call site is one
+// assertion with its own identity — its line in this file — and `--self-test` asks the
+// question per assertion rather than per invariant.
+//
+// `assert.unmutated.equal(...)` marks an assertion NO mutant in this pack varies: it pins
+// something the rules do not touch, so it has never been watched failing and the verdict
+// counts it apart rather than as evidence. Measured, not asserted — the self-test fails
+// both when a plain assertion turns out unbreakable and when an `unmutated` one turns out
+// breakable.
+//
+// Duplicated from `stripe-billing/fixtures/assert-money-invariants.mjs` for the reason
+// given at the top: a reader installs one skill, not six.
+
+const SELF = import.meta.url;
+const METHODS = ['equal', 'notEqual', 'deepEqual', 'notDeepEqual', 'ok', 'match', 'doesNotMatch'];
+
+/**
+ * The line in THIS file that called the recorder.
+ *
+ * `captureStackTrace(holder, boundary)` drops `boundary` and everything above it, so the
+ * top frame is the assertion's own line — no frame counting, which is what makes the
+ * identity survive a refactor of the recorder itself.
+ */
+function siteOf(boundary) {
+  const holder = {};
+  Error.captureStackTrace(holder, boundary);
+  const frame = (holder.stack || '').split('\n').slice(1).find((f) => f.includes(SELF));
+  const m = frame && frame.match(/:(\d+):\d+\)?\s*$/);
+  return m ? Number(m[1]) : 0;
+}
+
+function recorder() {
+  const seen = new Map(); // line -> { site, unmutated, ok, why }
+
+  function record(site, unmutated, name, args) {
+    let ok = true;
+    let why = null;
+    try {
+      assert[name](...args);
+    } catch (error) {
+      ok = false;
+      why = error.message.split('\n')[0];
+    }
+    const prev = seen.get(site);
+    if (prev) {
+      prev.ok = prev.ok && ok;
+      prev.why = prev.why || why;
+    } else {
+      seen.set(site, { site, unmutated, ok, why });
+    }
+  }
+
+  const bind = (unmutated) => {
+    const api = {};
+    for (const name of METHODS) {
+      const call = (...args) => record(siteOf(call), unmutated, name, args);
+      api[name] = call;
+    }
+    return api;
+  };
+
+  const api = bind(false);
+  api.unmutated = bind(true);
+  return { api, seen };
+}
+
 // ------------------------------------------------------------------------- runners
 
 async function runOne(invariant, without) {
-  const context = harness(without);
+  const { api, seen } = recorder();
+  const { sink, emitter } = harness(without);
+  let threw = null;
   try {
-    await invariant.run(context);
-    return null;
+    await invariant.run({ sink, emitter, assert: api });
   } catch (error) {
-    return error.message.split('\n')[0];
+    // A real error — a read off a row the mutant never wrote, say. It aborts the remaining
+    // assertions, and it is still the invariant going red.
+    threw = error.message.split('\n')[0];
   }
+  const sites = [...seen.values()];
+  return {
+    threw,
+    sites,
+    failed: sites.filter((s) => !s.ok),
+    broke: Boolean(threw) || sites.some((s) => !s.ok),
+  };
 }
 
 async function runAll() {
   let failed = 0;
+  let asserted = 0;
   for (const invariant of INVARIANTS) {
-    const why = await runOne(invariant, []);
-    if (why) {
+    const result = await runOne(invariant, []);
+    asserted += result.sites.length;
+    if (result.broke) {
       failed += 1;
-      console.error(`FAIL ${invariant.id}\n     ${why}`);
+      console.error(`FAIL ${invariant.id}`);
+      for (const s of result.failed) console.error(`     :${s.site} ${s.why}`);
+      if (result.threw) console.error(`     threw: ${result.threw}`);
     } else {
-      console.log(`pass ${invariant.id} — ${invariant.states}`);
+      console.log(`pass ${invariant.id} (${result.sites.length} assertions) — ${invariant.states}`);
     }
   }
   if (failed) {
     console.error(`\n${failed} of ${INVARIANTS.length} deduplication assertions failed`);
     return 1;
   }
-  console.log(`\nOK: ${INVARIANTS.length} deduplication assertions hold against the emitter`);
+  console.log(`\nOK: ${INVARIANTS.length} deduplication invariants hold against the emitter `
+    + `(${asserted} assertions)`);
   return 0;
 }
 
 async function selfTest() {
   const problems = [];
   const matrix = [];
+  const coverage = []; // one row per ASSERTION: which mutants turn that call site red
   for (const invariant of INVARIANTS) {
+    // The clean run is the census: it names every assertion this invariant executes. One
+    // that records nothing has a run() which never took the recorder, so nothing about it
+    // is measured — the failure mode of the injection itself.
+    const clean = await runOne(invariant, []);
+    if (clean.broke) {
+      problems.push(`${invariant.id}: fails against the unmutated emitter `
+        + `(${(clean.failed[0] && `:${clean.failed[0].site} ${clean.failed[0].why}`) || clean.threw})`);
+    }
+    if (!clean.sites.length) {
+      problems.push(`${invariant.id}: recorded no assertion — its run() does not take the `
+        + '`assert` the runner passes it, so nothing about it is measured');
+    }
+    const broken = new Map(clean.sites.map((s) => [s.site, []]));
+
     const broke = [];
     for (const rule of RULES) {
-      if (await runOne(invariant, [rule])) broke.push(rule);
+      const r = await runOne(invariant, [rule]);
+      if (r.broke) broke.push(rule);
+      for (const s of r.failed) if (broken.has(s.site)) broken.get(s.site).push(rule);
     }
     matrix.push({ id: invariant.id, broke });
+
+    for (const site of clean.sites) {
+      coverage.push({
+        invariant: invariant.id,
+        site: site.site,
+        unmutated: site.unmutated,
+        by: broken.get(site.site) || [],
+      });
+    }
+
     const expected = [...invariant.breaks].sort().join(', ');
     const measured = [...broke].sort().join(', ');
     if (expected !== measured) {
@@ -215,12 +339,33 @@ async function selfTest() {
   }
 
   const width = Math.max(...matrix.map((row) => row.id.length));
-  console.log(`\nassertion x mutant — ${RULES.length} mutants, `
-    + 'and which removed rule turns each assertion red\n');
+  console.log(`\ninvariant x mutant — ${RULES.length} mutants, `
+    + 'and which removed rule turns each invariant red\n');
   for (const row of matrix) {
     console.log(`  ${row.id.padEnd(width)}  ${row.broke.join(', ') || '(nothing)'}`);
   }
 
+  // The per-ASSERTION half, and the one the table above cannot give: an invariant goes red
+  // as a unit, so a dead assertion inside a live one is invisible there.
+  console.log('\nassertion x mutant — every call site, and what turns IT red\n');
+  for (const row of coverage) {
+    const label = `${row.invariant}:${row.site}`.padEnd(width + 6);
+    if (row.unmutated) {
+      console.log(`  ${label}  unmutated — no rule varies what it checks`);
+      if (row.by.length) {
+        problems.push(`${row.invariant} :${row.site} is declared assert.unmutated and `
+          + `[${row.by.join(', ')}] breaks it — it discriminates, so drop the .unmutated`);
+      }
+    } else {
+      console.log(`  ${label}  ${row.by.join(', ') || '(nothing)'}`);
+      if (!row.by.length) {
+        problems.push(`${row.invariant} :${row.site} is broken by no mutant — the assertion `
+          + 'cannot fail. Either it is not testing anything, or no rule varies what it '
+          + 'checks and it belongs on assert.unmutated, which the verdict counts apart');
+      }
+    }
+  }
+
   console.log('\nisolation — the fixture that separates each rule from every other\n');
   for (const rule of RULES) {
     const isolating = matrix.filter((row) => row.broke.length === 1 && row.broke[0] === rule);
@@ -237,7 +382,10 @@ async function selfTest() {
     for (const p of problems) console.error(`  - ${p}`);
     return 1;
   }
-  console.log(`\nOK: ${INVARIANTS.length} assertions, each watched failing; `
+  const pinned = coverage.filter((r) => r.unmutated).length;
+  console.log(`\nOK: ${INVARIANTS.length} invariants over ${coverage.length} assertions — `
+    + `${coverage.length - pinned} watched failing ONE CALL SITE AT A TIME against `
+    + `${RULES.length} mutants; ${pinned} declared unmutated and measured unbreakable; `
     + `${RULES.length} rules, each isolated by a fixture`);
   return 0;
 }

package/plugins/sheleg-dev/skills/ad-tracking/references/meta-linkedin.md

@@ -102,8 +102,12 @@ by accident, because the wrapper accepts whatever you hand it and hashes it
 without judgement. SHA-256 does **not** make a value safe to send: hashing is a
 matching mechanism, not a permission. That the wrapper receives a hash at all is checkable:
 `identifiers-reach-the-server-hashed` in `fixtures/assert-dedup-contract.mjs` requires every
-`user_data.em` entry to be 64 hex characters and refuses anything with an `@` in it. What may
-be hashed in the first place is the table below, and no assertion decides it.
+`user_data.em` entry to be 64 hex characters and refuses anything with an `@` in it. **Both
+halves are separately watched failing**, which they were not until 2026-08-20: the pack's
+`--self-test` measured one row per invariant, so the `@` guard could be neutered while the
+hex-shape assertion above it kept the invariant red, and this paragraph advertised a control
+nothing had ever seen fail. The matrix is now per call site. What may be hashed in the first
+place is the table below, and no assertion decides it.
 
 Meta's Business Tools Terms prohibit sharing data that "includes or is based on"
 any of these, and the prohibition covers the Pixel, the Conversions API, the

package/plugins/sheleg-dev/skills/crypto-payments/SKILL.md

@@ -39,15 +39,13 @@ and anything else that issues an invoice and calls you back.
 - [Status mapping — and finality](#status-mapping--and-finality)
 - [Webhook signature verification](#webhook-signature-verification)
 - [Idempotent webhook processing](#idempotent-webhook-processing)
-- [IP allowlisting behind a proxy](#ip-allowlisting-behind-a-proxy)
-- [CSRF exemption for callback routes](#csrf-exemption-for-callback-routes)
+- [Callback route hardening](#callback-route-hardening)
 - [The conversion buffer](#the-conversion-buffer)
 - [Reconciliation fields](#reconciliation-fields)
 - [Crediting: the amount waterfall](#crediting-the-amount-waterfall)
 - [Refunds and AML holds](#refunds-and-aml-holds)
 - [The test/live credential boundary](#the-testlive-credential-boundary)
-- [Local development](#local-development)
-- [Test matrix](#test-matrix)
+- [Local development and the test matrix](#local-development-and-the-test-matrix)
 - [Security checklist](#security-checklist)
 - [Common pitfalls](#common-pitfalls)
 
@@ -192,46 +190,17 @@ the read.
 
 ---
 
-## IP allowlisting behind a proxy
+## Callback route hardening
 
-Signature verification is the real gate; the allowlist is defence in depth and
-cheap. It is also the single most common cause of "webhooks stopped working
-after we moved to a load balancer".
+Two things about the *request* rather than about the money in it, and each one is the
+usual cause of "webhooks stopped working after we moved to a load balancer": reading the
+caller IP from the proxy hop you actually own instead of `x-forwarded-for[0]`, and
+exempting the **one** callback path from CSRF by exact match rather than by prefix — a
+prefix on `/api/payments` exempts the checkout endpoint too, which is where the money is.
 
-```ts
-function callerIp(req): string | null {
-  // Trust ONLY the hop your own infrastructure appends.
-  const xff = req.headers['x-forwarded-for'];
-  if (typeof xff === 'string') {
-    const hops = xff.split(',').map((s) => s.trim());
-    return hops[hops.length - TRUSTED_PROXY_COUNT] ?? null;
-  }
-  return req.socket.remoteAddress ?? null;
-}
-```
-
-Taking `xff[0]` trusts a header the client controls — anyone can claim to be the
-gateway. Count from the right by the number of proxies you actually run, and
-keep that number in configuration, because it changes when infrastructure does.
-
-Allowlist the provider's published callback IPs, log a rejection with the
-observed IP, and **never** fall back to "allow if the header is missing".
-
----
-
-## CSRF exemption for callback routes
-
-A gateway cannot present your CSRF token. Exempt the callback path explicitly
-and narrowly:
-
-```ts
-// middleware.ts (Next.js)
-export const config = { matcher: ['/((?!api/payments/webhook).*)'] };
-```
-
-Exempt the **one** path, by exact match, and make it the only route in your app
-that skips CSRF. A prefix match on `/api/payments` exempts the checkout endpoint
-too, which is where the money is.
+Both, with the code:
+[`references/callback-route-hardening.md`](references/callback-route-hardening.md).
+Signature verification above is the real gate; these are defence in depth.
 
 ---
 
@@ -374,45 +343,13 @@ boundary* and *Residual exposure*.
 
 ---
 
-## Local development
-
-Two paths, and you want both:
-
-**Skip the gateway.** A `SKIP_BILLING=true` branch that credits immediately and
-logs loudly. Everyone building a feature that merely *touches* checkout should
-use this. Make it impossible in production: assert `NODE_ENV !== 'production'`
-at the branch, not just in config.
-
-**Real gateway, tunnelled callback.** Callbacks cannot reach `localhost`:
-
-```bash
-cloudflared tunnel --url http://localhost:3000
-# → https://random-name.trycloudflare.com  →  set as the callback base URL, restart the app
-```
-
-Then keep a **signed mock callback** in your test tooling — a script that builds
-a real payload, signs it with the dev key and POSTs it. This is what makes the
-sad paths (`wrong_amount`, `refund_fail`, `locked`) testable at all; you cannot
-ask a gateway to underpay you on demand.
-
----
-
-## Test matrix
-
-Cover these, and plant a defect against each before believing the green:
+## Local development and the test matrix
 
-| Case | What it catches |
-|---|---|
-| valid signature | the happy path |
-| tampered signature | constant-time compare, 403 not 500 |
-| signature over a payload containing a URL | the escaping trap |
-| duplicate delivery of a settling status | idempotency guard |
-| `paid_over` | crediting the received amount, not the invoiced |
-| `wrong_amount` | no full credit on a partial payment |
-| out-of-order delivery (final, then earlier) | the `notIn` guard, not timestamps |
-| callback from a non-allowlisted IP | proxy-aware extraction |
-| `refund_process` then `refund_fail` | refund is a state machine |
-| `locked` | no credit, no auto-cancel |
+Two development paths you want both of — a `SKIP_BILLING=true` branch that is impossible
+in production, and a real gateway behind a tunnel with a signed mock callback for the sad
+paths a provider will not produce on demand — plus the ten cases to cover before believing
+a green suite, each with the defect it catches:
+[`references/testing-and-local-dev.md`](references/testing-and-local-dev.md).
 
 ---
 

package/plugins/sheleg-dev/skills/crypto-payments/references/callback-route-hardening.md

@@ -0,0 +1,55 @@
+# Callback route hardening — the proxy hop and the CSRF hole
+
+Split out of `SKILL.md` on 2026-08-20, when its body measured ~4894 tokens against the
+house working limit of 4750. Both sections below are web plumbing rather than payment
+logic — they are about the request that carries a callback, not about the money in it —
+which is why they are the seam. Signature verification (`SKILL.md`, *Webhook signature
+verification*) is the real gate; these two are defence in depth, and each has a failure
+mode that looks like "webhooks stopped working" rather than like a security event.
+
+---
+
+## IP allowlisting behind a proxy
+
+Signature verification is the real gate; the allowlist is defence in depth and
+cheap. It is also the single most common cause of "webhooks stopped working
+after we moved to a load balancer".
+
+```ts
+function callerIp(req): string | null {
+  // Trust ONLY the hop your own infrastructure appends.
+  const xff = req.headers['x-forwarded-for'];
+  if (typeof xff === 'string') {
+    const hops = xff.split(',').map((s) => s.trim());
+    return hops[hops.length - TRUSTED_PROXY_COUNT] ?? null;
+  }
+  return req.socket.remoteAddress ?? null;
+}
+```
+
+Taking `xff[0]` trusts a header the client controls — anyone can claim to be the
+gateway. Count from the right by the number of proxies you actually run, and
+keep that number in configuration, because it changes when infrastructure does.
+
+Allowlist the provider's published callback IPs, log a rejection with the
+observed IP, and **never** fall back to "allow if the header is missing".
+
+## CSRF exemption for callback routes
+
+A gateway cannot present your CSRF token. Exempt the callback path explicitly
+and narrowly:
+
+```ts
+// middleware.ts (Next.js)
+export const config = { matcher: ['/((?!api/payments/webhook).*)'] };
+```
+
+Exempt the **one** path, by exact match, and make it the only route in your app
+that skips CSRF. A prefix match on `/api/payments` exempts the checkout endpoint
+too, which is where the money is.
+
+---
+
+Back to [`SKILL.md`](../SKILL.md) — *Webhook signature verification* is the gate these two
+sit behind, and *Test matrix* in
+[`testing-and-local-dev.md`](testing-and-local-dev.md) carries the non-allowlisted-IP case.

package/plugins/sheleg-dev/skills/crypto-payments/references/testing-and-local-dev.md

@@ -0,0 +1,60 @@
+# Testing and local development
+
+Split out of `SKILL.md` on 2026-08-20 for the same reason as
+[`callback-route-hardening.md`](callback-route-hardening.md): the body was ~4894 tokens
+against a 4750 working limit, and the house answer at that point is a split rather than a
+trim. This is the operational half — how you run the thing on a laptop, and what you have
+to cover before believing a green suite.
+
+`stripe-billing` ships the same pair of subjects at
+[`../../stripe-billing/references/testing-and-local-dev.md`](../../stripe-billing/references/testing-and-local-dev.md),
+and its *Mutation testing* section is the argument this matrix assumes: plant a defect
+against every row before believing it.
+
+---
+
+## Local development
+
+Two paths, and you want both:
+
+**Skip the gateway.** A `SKIP_BILLING=true` branch that credits immediately and
+logs loudly. Everyone building a feature that merely *touches* checkout should
+use this. Make it impossible in production: assert `NODE_ENV !== 'production'`
+at the branch, not just in config.
+
+**Real gateway, tunnelled callback.** Callbacks cannot reach `localhost`:
+
+```bash
+cloudflared tunnel --url http://localhost:3000
+# → https://random-name.trycloudflare.com  →  set as the callback base URL, restart the app
+```
+
+Then keep a **signed mock callback** in your test tooling — a script that builds
+a real payload, signs it with the dev key and POSTs it. This is what makes the
+sad paths (`wrong_amount`, `refund_fail`, `locked`) testable at all; you cannot
+ask a gateway to underpay you on demand.
+
+---
+
+## Test matrix
+
+Cover these, and plant a defect against each before believing the green:
+
+| Case | What it catches |
+|---|---|
+| valid signature | the happy path |
+| tampered signature | constant-time compare, 403 not 500 |
+| signature over a payload containing a URL | the escaping trap |
+| duplicate delivery of a settling status | idempotency guard |
+| `paid_over` | crediting the received amount, not the invoiced |
+| `wrong_amount` | no full credit on a partial payment |
+| out-of-order delivery (final, then earlier) | the `notIn` guard, not timestamps |
+| callback from a non-allowlisted IP | proxy-aware extraction |
+| `refund_process` then `refund_fail` | refund is a state machine |
+| `locked` | no credit, no auto-cancel |
+
+---
+
+Back to [`SKILL.md`](../SKILL.md). The provider-specific half — one credential, no sandbox
+host, and what "test mode" actually toggles — is
+[`heleket-provider.md`](heleket-provider.md), *The test/live boundary*.

package/plugins/sheleg-dev/skills/stripe-billing/fixtures/README.md

@@ -2,14 +2,15 @@
 
 **Copy this whole directory into your repository.** It is the executable half of what
 `SKILL.md` and `references/webhook-events.md` state in prose: nine real Stripe event
-bodies, twelve assertions a correct webhook handler must pass, and a self-test that
-breaks the handler one rule at a time so you can watch every assertion fail.
+bodies, twelve invariants a correct webhook handler must hold — 45 assertions between
+them — and a self-test that breaks the handler one rule at a time so you can watch each
+assertion fail on its own.
 
 Two commands, no dependencies, no network, no key:
 
 ```bash
-node assert-money-invariants.mjs              # 12 assertions against the reference handler
-node assert-money-invariants.mjs --self-test  # break one rule at a time; every assertion must go red
+node assert-money-invariants.mjs              # 12 invariants / 45 assertions
+node assert-money-invariants.mjs --self-test  # break one rule at a time; EACH ASSERTION must go red
 ```
 
 Point it at **your** handler by replacing the two imports at the top of

package/plugins/sheleg-dev/skills/stripe-billing/fixtures/assert-money-invariants.mjs

@@ -72,14 +72,20 @@ export const INVARIANTS = [
     fixtures: [CYCLE_JAN],
     states: 'a paid renewal becomes exactly one grant, and the mirror carries its period',
     breaks: ['grant-on-renewal'],
-    async run({ store, handler }) {
+    async run({ store, handler, assert }) {
       const event = fixture(CYCLE_JAN);
       const response = await handler.deliver(event);
-      assert.equal(response.status, 200);
-      assert.deepEqual(response.body, { received: true });
+      // `unmutated`: no rule in RULES makes this route answer anything but 200 with that
+      // body, so neither assertion has ever been watched failing. They pin the envelope a
+      // reader copies; they are not evidence, and the verdict line counts them apart.
+      assert.unmutated.equal(response.status, 200);
+      assert.unmutated.deepEqual(response.body, { received: true });
       assert.equal(store.grants.length, 1, 'a paid renewal granted nothing');
       assert.equal(store.credits.get('usr_PLACEHOLDER_alice'), CREDITS_PER_PERIOD);
-      const mirror = store.subscriptions.get('sub_PLACEHOLDER_alice');
+      // `|| {}` on purpose: with no mirror row at all these two assertions must FAIL
+      // rather than throw a TypeError on the line above them. A throw aborts the run, and
+      // an assertion the runner never reached is one no mutant has been watched breaking.
+      const mirror = store.subscriptions.get('sub_PLACEHOLDER_alice') || {};
       assert.equal(mirror.periodStart, 1767225600);
       assert.equal(mirror.periodEnd, 1769904000, 'the period is not the line period');
     },
@@ -89,10 +95,11 @@ export const INVARIANTS = [
     fixtures: [CYCLE_JAN, PRORATION],
     states: 'billing_reason subscription_update is a $40 proration, not a month of product',
     breaks: ['billing-reason', 'grant-on-renewal'],
-    async run({ store, handler }) {
+    async run({ store, handler, assert }) {
       await handler.deliver(fixture(CYCLE_JAN));
       const response = await handler.deliver(fixture(PRORATION));
-      assert.equal(response.status, 200, 'a proration invoice must not fail the endpoint');
+      // unmutated: nothing in RULES makes the endpoint answer 500 for a proration.
+      assert.unmutated.equal(response.status, 200, 'a proration invoice must not fail the endpoint');
       assert.equal(store.grants.length, 1,
         'the proration granted a second period — a user who adds and removes a seat '
         + 'four times has been given four months of product');
@@ -107,10 +114,10 @@ export const INVARIANTS = [
     fixtures: [CYCLE_JAN, CYCLE_JAN_REDELIVERY],
     states: 'the same evt_ delivered twice grants once AND runs its side effects once',
     breaks: ['claim', 'grant-on-renewal'],
-    async run({ store, handler }) {
+    async run({ store, handler, assert }) {
       const first = await handler.deliver(fixture(CYCLE_JAN));
       const second = await handler.deliver(fixture(CYCLE_JAN_REDELIVERY));
-      assert.deepEqual(first.body, { received: true });
+      assert.unmutated.deepEqual(first.body, { received: true }); // the envelope, again
       assert.deepEqual(second.body, { received: true, duplicate: true },
         'the second delivery was not recognised as a duplicate');
       assert.equal(store.grants.length, 1, 'the redelivery granted a second time');
@@ -124,7 +131,7 @@ export const INVARIANTS = [
     fixtures: [CYCLE_JAN, CYCLE_JAN_REDELIVERY],
     states: 'two deliveries in flight at once grant once — the claim is an INSERT, not a SELECT',
     breaks: ['claim', 'grant-on-renewal'],
-    async run({ store, handler }) {
+    async run({ store, handler, assert }) {
       // 40 ms apart in production; here, both before either has finished its first read.
       // This is the fixture that separates the event claim from the grant marker: the
       // marker reads before it writes, and a read is a round trip.
@@ -146,7 +153,7 @@ export const INVARIANTS = [
     fixtures: [CYCLE_JAN],
     states: 'the nightly repair reuses the webhook marker — a nightly job is not a nightly gift',
     breaks: ['grant-marker', 'grant-on-renewal'],
-    async run({ store, handler }) {
+    async run({ store, handler, assert }) {
       const event = fixture(CYCLE_JAN);
       await handler.deliver(event);
       const subId = subscriptionIdOf(event.data.object);
@@ -163,11 +170,11 @@ export const INVARIANTS = [
     fixtures: [CYCLE_FEB, CYCLE_JAN],
     states: 'February delivered before January leaves February in the mirror, and grants both',
     breaks: ['ordering', 'grant-on-renewal'],
-    async run({ store, handler }) {
+    async run({ store, handler, assert }) {
       await handler.deliver(fixture(CYCLE_FEB)); // arrives first
       await handler.deliver(fixture(CYCLE_JAN)); // the earlier period, delivered late
       assert.equal(store.grants.length, 2, 'both periods were paid, so both are owed');
-      const mirror = store.subscriptions.get('sub_PLACEHOLDER_alice');
+      const mirror = store.subscriptions.get('sub_PLACEHOLDER_alice') || {};
       assert.equal(mirror.periodStart, 1769904000,
         'the mirror was rewound to the older period — state derived from arrival order');
       assert.equal(mirror.periodEnd, 1772323200,
@@ -179,7 +186,7 @@ export const INVARIANTS = [
     fixtures: [REFUND_PARTIAL, REFUND_REMAINDER],
     states: 'amount_refunded is the total so far: two partials claw back $90, not $130',
     breaks: ['cumulative-refund'],
-    async run({ store, handler }) {
+    async run({ store, handler, assert }) {
       seedOneOffPurchase(store);
       await handler.deliver(fixture(REFUND_PARTIAL));
       await handler.deliver(fixture(REFUND_REMAINDER));
@@ -201,7 +208,7 @@ export const INVARIANTS = [
     // and the claim still refuses the second delivery. A suite that judged a redelivery by
     // its grant count alone would ship with no idempotency and stay green.
     breaks: [['claim', 'grant-marker'], 'grant-on-renewal'],
-    async run({ store, handler }) {
+    async run({ store, handler, assert }) {
       await handler.deliver(fixture(CYCLE_JAN));
       await handler.deliver(fixture(CYCLE_JAN_REDELIVERY));
       assert.equal(store.grants.length, 1, 'the redelivery granted a second time');
@@ -216,7 +223,7 @@ export const INVARIANTS = [
     // `increment <= 0` catches a sequential replay by itself, and the claim catches it
     // without the swap. Neither is tested by this fixture alone.
     breaks: [['claim', 'cumulative-refund']],
-    async run({ store, handler }) {
+    async run({ store, handler, assert }) {
       seedOneOffPurchase(store);
       await handler.deliver(fixture(REFUND_PARTIAL));
       await handler.deliver(fixture(REFUND_PARTIAL));
@@ -229,16 +236,20 @@ export const INVARIANTS = [
     fixtures: [SESSION_UNPAID, SESSION_FAILED],
     states: 'the redirect proves a browser: an unpaid async session grants and converts nothing',
     breaks: ['async-gate'],
-    async run({ store, handler }) {
+    async run({ store, handler, assert }) {
       const completed = await handler.deliver(fixture(SESSION_UNPAID));
-      assert.equal(completed.status, 200, 'an unpaid session must still answer 200');
+      // unmutated: the envelope. Removing `async-gate` grants the session and still answers 200.
+      assert.unmutated.equal(completed.status, 200, 'an unpaid session must still answer 200');
       assert.equal(store.grants.length, 0,
         'a session whose payment_status is unpaid was granted — the money has not moved');
-      assert.equal(store.conversions.length, 0,
+      // unmutated, and the reason is a gap worth seeing: this handler emits conversions on
+      // `invoice.paid` only, so no rule here can make a checkout session report one. The
+      // assertion states the rule for a reader whose handler DOES emit from a session.
+      assert.unmutated.equal(store.conversions.length, 0,
         'a purchase conversion was reported for a charge that has not cleared');
       await handler.deliver(fixture(SESSION_FAILED));
       assert.equal(store.grants.length, 0, 'the failed async payment still granted');
-      assert.equal(store.conversions.length, 0);
+      assert.unmutated.equal(store.conversions.length, 0); // same gap as above
       assert.equal(store.credits.get('usr_PLACEHOLDER_bob'), undefined);
     },
   },
@@ -249,9 +260,9 @@ export const INVARIANTS = [
     // Without it, a handler that refuses every checkout session satisfies the assertion
     // above and this pack would have taught the opposite defect.
     breaks: ['grant-on-checkout'],
-    async run({ store, handler }) {
+    async run({ store, handler, assert }) {
       const response = await handler.deliver(fixture(SESSION_PAID));
-      assert.deepEqual(response.body, { received: true });
+      assert.unmutated.deepEqual(response.body, { received: true }); // the envelope
       assert.equal(store.grants.length, 1, 'a cleared card session granted nothing');
       assert.equal(store.credits.get('usr_PLACEHOLDER_carol'), CREDITS_PER_PERIOD);
       assert.ok(store.subscriptions.has('sub_PLACEHOLDER_carol'));
@@ -262,10 +273,10 @@ export const INVARIANTS = [
     fixtures: [CYCLE_JAN],
     states: 'the conversion id comes from subscription metadata, so browser and server share it',
     breaks: ['conversion-id-from-metadata', 'grant-on-renewal'],
-    async run({ store, handler }) {
+    async run({ store, handler, assert }) {
       await handler.deliver(fixture(CYCLE_JAN));
       assert.equal(store.conversions.length, 1);
-      const [conversion] = store.conversions;
+      const [conversion = {}] = store.conversions;
       assert.equal(conversion.eventId, 'evtid_PLACEHOLDER_purchase_jan',
         'the server generated its own id — nothing will ever deduplicate against the pixel');
       assert.equal(conversion.eventName, 'Purchase', 'the event name is not byte-equal');
@@ -276,34 +287,131 @@ export const INVARIANTS = [
   },
 ];
 
+// ------------------------------------------------- one assertion, one measurement
+//
+// Why the assertions are not called straight through `node:assert`. Until 2026-08-20 the
+// runner returned on the FIRST throw and the matrix compared one row per invariant, so an
+// invariant was measured as a single unit: any assertion that was not the sole
+// discriminator could be replaced by `assert.ok(true)` and nothing went red. Measured that
+// day — three neutered assertions (the `clawbacks.map` deepEqual, the `mirror.periodEnd`
+// equality, and the `response.body` deepEqual) left `--self-test` at exit 0 still printing
+// *"12 assertions, each watched failing"*, and `npm test` at 0 with them.
+//
+// So the `assert` an invariant receives is a RECORDER: same API, but a failure is
+// remembered instead of thrown and the assertions after it still run. Each call site is one
+// assertion with its own identity — its line in this file — and `--self-test` asks the
+// question per assertion rather than per invariant.
+//
+// Two kinds, and the difference is declared at the call site rather than in a table:
+//
+//   assert.equal(...)        a DISCRIMINATING assertion. At least one mutant must turn it
+//                            red, or it is not evidence of anything.
+//   assert.unmutated.equal() an assertion NO mutant in this pack varies. It pins the
+//                            envelope or a field the rules do not touch, so it has never
+//                            been watched failing and the verdict line counts it apart
+//                            rather than as evidence. Measured, not asserted: the self-test
+//                            fails if a mutant does break one, because that is a
+//                            discriminator hiding in the wrong list.
+//
+// A reader pointing this at their own handler keeps writing `assert.equal`; the recorder is
+// API-compatible with `node:assert/strict` for the methods below.
+
+const SELF = import.meta.url;
+const METHODS = ['equal', 'notEqual', 'deepEqual', 'notDeepEqual', 'ok', 'match', 'doesNotMatch'];
+
+/**
+ * The line in THIS file that called the recorder.
+ *
+ * `captureStackTrace(holder, boundary)` drops `boundary` and everything above it, so the
+ * top frame is the assertion's own line — no frame counting, which is what makes the
+ * identity survive a refactor of the recorder itself.
+ */
+function siteOf(boundary) {
+  const holder = {};
+  Error.captureStackTrace(holder, boundary);
+  const frame = (holder.stack || '').split('\n').slice(1).find((f) => f.includes(SELF));
+  const m = frame && frame.match(/:(\d+):\d+\)?\s*$/);
+  return m ? Number(m[1]) : 0;
+}
+
+function recorder() {
+  const seen = new Map(); // line -> { site, unmutated, ok, why }
+
+  function record(site, unmutated, name, args) {
+    let ok = true;
+    let why = null;
+    try {
+      assert[name](...args);
+    } catch (error) {
+      ok = false;
+      why = error.message.split('\n')[0];
+    }
+    const prev = seen.get(site);
+    if (prev) {
+      prev.ok = prev.ok && ok;
+      prev.why = prev.why || why;
+    } else {
+      seen.set(site, { site, unmutated, ok, why });
+    }
+  }
+
+  const bind = (unmutated) => {
+    const api = {};
+    for (const name of METHODS) {
+      const call = (...args) => record(siteOf(call), unmutated, name, args);
+      api[name] = call;
+    }
+    return api;
+  };
+
+  const api = bind(false);
+  api.unmutated = bind(true);
+  return { api, seen };
+}
+
 // ------------------------------------------------------------------------- runners
 
 async function runOne(invariant, without) {
-  const context = harness(without);
+  const { api, seen } = recorder();
+  const { store, handler } = harness(without);
+  let threw = null;
   try {
-    await invariant.run(context);
-    return null;
+    await invariant.run({ store, handler, assert: api });
   } catch (error) {
-    return error.message.split('\n')[0];
+    // A real error — a `TypeError` on a row the mutant never wrote, say. It aborts the
+    // remaining assertions, and it is still the invariant going red.
+    threw = error.message.split('\n')[0];
   }
+  const sites = [...seen.values()];
+  return {
+    threw,
+    sites,
+    failed: sites.filter((s) => !s.ok),
+    broke: Boolean(threw) || sites.some((s) => !s.ok),
+  };
 }
 
 async function runAll() {
   let failed = 0;
+  let asserted = 0;
   for (const invariant of INVARIANTS) {
-    const why = await runOne(invariant, []);
-    if (why) {
+    const result = await runOne(invariant, []);
+    asserted += result.sites.length;
+    if (result.broke) {
       failed += 1;
-      console.error(`FAIL ${invariant.id}\n     ${why}`);
+      console.error(`FAIL ${invariant.id}`);
+      for (const s of result.failed) console.error(`     :${s.site} ${s.why}`);
+      if (result.threw) console.error(`     threw: ${result.threw}`);
     } else {
-      console.log(`pass ${invariant.id} — ${invariant.states}`);
+      console.log(`pass ${invariant.id} (${result.sites.length} assertions) — ${invariant.states}`);
     }
   }
   if (failed) {
     console.error(`\n${failed} of ${INVARIANTS.length} money invariants failed`);
     return 1;
   }
-  console.log(`\nOK: ${INVARIANTS.length} money invariants hold against the handler`);
+  console.log(`\nOK: ${INVARIANTS.length} money invariants hold against the handler `
+    + `(${asserted} assertions)`);
   return 0;
 }
 
@@ -333,21 +441,49 @@ async function selfTest() {
   const mutants = [...RULES.map((rule) => [rule]), ...combos];
 
   const matrix = [];
+  const coverage = []; // one row per ASSERTION: which mutants turn that call site red
   for (const invariant of INVARIANTS) {
+    // The clean run is the census: it names every assertion this invariant executes, and
+    // whether each is declared discriminating or shape. An invariant that records nothing
+    // is one whose `run` never took the recorder — the failure mode of the injection.
+    const clean = await runOne(invariant, []);
+    if (clean.broke) {
+      problems.push(`${invariant.id}: fails against the unmutated handler `
+        + `(${(clean.failed[0] && `:${clean.failed[0].site} ${clean.failed[0].why}`) || clean.threw})`);
+    }
+    if (!clean.sites.length) {
+      problems.push(`${invariant.id}: recorded no assertion — its run() does not take the `
+        + '`assert` the runner passes it, so nothing about it is measured');
+    }
+    const broken = new Map(clean.sites.map((s) => [s.site, []]));
+
     const singles = [];
     for (const rule of RULES) {
-      if (await runOne(invariant, [rule])) singles.push(rule);
+      const r = await runOne(invariant, [rule]);
+      if (r.broke) singles.push(rule);
+      for (const s of r.failed) if (broken.has(s.site)) broken.get(s.site).push(rule);
     }
     // Minimal mutants only: a combination containing a rule that already breaks the
     // assertion on its own says nothing new.
     const minimalCombos = [];
     for (const combo of combos) {
       if (combo.some((rule) => singles.includes(rule))) continue;
-      if (await runOne(invariant, combo)) minimalCombos.push(combo);
+      const r = await runOne(invariant, combo);
+      if (r.broke) minimalCombos.push(combo);
+      for (const s of r.failed) if (broken.has(s.site)) broken.get(s.site).push(key(combo));
     }
     const broke = [...singles.map((r) => [r]), ...minimalCombos];
     matrix.push({ id: invariant.id, broke, singles });
 
+    for (const site of clean.sites) {
+      coverage.push({
+        invariant: invariant.id,
+        site: site.site,
+        unmutated: site.unmutated,
+        by: broken.get(site.site) || [],
+      });
+    }
+
     const expected = invariant.breaks
       .map((b) => key(Array.isArray(b) ? b : [b])).sort().join(', ');
     const measured = broke.map(key).sort().join(', ');
@@ -368,6 +504,27 @@ async function selfTest() {
     console.log(`  ${row.id.padEnd(width)}  ${row.broke.map(key).join(', ') || '(nothing)'}`);
   }
 
+  // The per-ASSERTION half, and the one the per-invariant table above cannot give: an
+  // invariant goes red as a unit, so a dead assertion inside a live one is invisible there.
+  console.log('\nassertion x mutant — every call site, and what turns IT red\n');
+  for (const row of coverage) {
+    const label = `${row.invariant}:${row.site}`.padEnd(width + 6);
+    if (row.unmutated) {
+      console.log(`  ${label}  unmutated — no rule varies what it checks`);
+      if (row.by.length) {
+        problems.push(`${row.invariant} :${row.site} is declared assert.unmutated and `
+          + `[${row.by.join(', ')}] breaks it — it discriminates, so drop the .unmutated`);
+      }
+    } else {
+      console.log(`  ${label}  ${row.by.join(', ') || '(nothing)'}`);
+      if (!row.by.length) {
+        problems.push(`${row.invariant} :${row.site} is broken by no mutant — the assertion `
+          + 'cannot fail. Either it is not testing anything, or no rule varies what it '
+          + 'checks and it belongs on assert.unmutated, which the verdict counts apart');
+      }
+    }
+  }
+
   console.log('\nisolation — the fixture that separates each rule from every other\n');
   for (const rule of RULES) {
     const isolating = matrix.filter((row) => {
@@ -392,7 +549,10 @@ async function selfTest() {
     for (const p of problems) console.error(`  - ${p}`);
     return 1;
   }
-  console.log(`\nOK: ${INVARIANTS.length} assertions, each watched failing; `
+  const pinned = coverage.filter((r) => r.unmutated).length;
+  console.log(`\nOK: ${INVARIANTS.length} invariants over ${coverage.length} assertions — `
+    + `${coverage.length - pinned} watched failing ONE CALL SITE AT A TIME against `
+    + `${mutants.length} mutants; ${pinned} declared unmutated and measured unbreakable; `
     + `${RULES.length} rules, each isolated by a fixture`);
   return 0;
 }

package/plugins/sheleg-dev/skills/stripe-billing/references/testing-and-local-dev.md

@@ -158,12 +158,13 @@ the helper works and says nothing about the route Stripe posts to.
 ## The shipped fixtures and the assertion pack
 
 Everything above tells you what to write. `fixtures/` is that suite already written:
-nine Stripe event bodies, twelve assertions, and the mutants that prove each assertion can
-fail. Copy the directory into your repository and run it.
+nine Stripe event bodies, twelve invariants over 45 assertions, and the mutants that prove
+each assertion can fail — per call site, not per invariant, which is a distinction this
+pack got wrong until 2026-08-20. Copy the directory into your repository and run it.
 
 ```bash
 node fixtures/assert-money-invariants.mjs              # the assertions
-node fixtures/assert-money-invariants.mjs --self-test  # every one of them, watched failing
+node fixtures/assert-money-invariants.mjs --self-test  # each ASSERTION, watched failing
 ```
 
 Point it at your handler by replacing the two imports at the top of