@windyroad/itil 0.47.12-preview.598 → 0.47.12-preview.617

package/skills/work-problems/test/work-problems-step-5-is-error-transient-halt.bats

@@ -0,0 +1,278 @@
+#!/usr/bin/env bats
+# tdd-review: structural-permitted (justification: the doc-lint slice below
+# asserts SKILL.md / ADR-032 prose contract — SKILL.md is the contract
+# document per ADR-037 Permitted Exception; these guards catch prose drift
+# away from the behavioural HALT-with-advisory contract exercised above. The
+# load-bearing core of this fixture is behavioural per ADR-052. harness-gap P012)
+#
+# Behavioural test: work-problems Step 5 exit-code semantics — the
+# is_error:true TRANSIENT-API-ERROR HALT branch (P214). When an iter
+# subprocess returns `is_error: true` with `total_cost_usd: 0` AND no staged
+# work in the tree (the 529 Overloaded / 429 rate-limit / 401 auth-expired
+# shape — the API call never landed; nothing was done; metadata records the
+# failure), the orchestrator MUST halt the loop with a class-appropriate
+# advisory line in the final summary — NOT silently treat exit-0 as success
+# and try to parse a missing ITERATION_SUMMARY block.
+#
+# This is the HALT counterpart to the existing P261 SALVAGE branch (covered
+# by work-problems-step-5-stream-timeout-salvage.bats):
+#   - SALVAGE: is_error:true + staged work + bats green (stream-timeout class)
+#   - HALT:    is_error:true + nothing staged (transient-API-error class — P214)
+# Both branches require the orchestrator to read `is_error` BEFORE the
+# Exit-0 → parse-ITERATION_SUMMARY path; without the explicit check-order
+# the loop silently miscounts and may spawn further subprocesses that fail
+# identically (the AFK-promise-breaking shape P214 reports).
+#
+# The fake-shim below re-creates the production 529 Overloaded shape:
+# is_error:true, total_cost_usd:0, no staged work, .result carrying the
+# upstream error string. The harness re-implements the orchestrator's
+# ordered-check decision contract (faithful to SKILL.md Step 5) and asserts
+# the HALT routing + class-appropriate advisory for each transient class.
+#
+# @problem P214
+# @jtbd JTBD-006
+#
+# Cross-reference:
+#   P214 (work-problems Step 5 exit-code rule doesn't handle is_error:true
+#     transient API failures) — driver ticket
+#   P261 (is_error:true stream-timeout salvage carve-out) — sibling SALVAGE
+#     branch; this fixture covers the HALT counterpart
+#   ADR-032 (governance skill invocation patterns — is_error:true class
+#     taxonomy: SALVAGE = stream-timeout; HALT = transient-API-error) — the
+#     amended contract this fixture pins
+#   ADR-013 Rule 6 (AFK fail-safe — HALT routing is non-interactive; no
+#     AskUserQuestion) — invariant honoured
+#   ADR-037 / ADR-052 (skill testing strategy — behavioural default; doc-lint
+#     contract assertion is the Permitted Exception, marked above)
+
+setup() {
+  TEST_TMP="$(mktemp -d)"
+  FAKE_BIN="${TEST_TMP}/bin"
+  mkdir -p "$FAKE_BIN"
+
+  # Fake `claude` binary simulating the transient-API-error shape: exits 0,
+  # emits an is_error:true JSON envelope with total_cost_usd:0 and the
+  # transient-class error string in `.result`. No staged work — the API call
+  # never landed; nothing was done.
+  cat > "$FAKE_BIN/claude" <<'FAKE_EOF'
+#!/usr/bin/env bash
+# Test fake for work-problems Step 5 P214 transient-API-error halt fixture.
+# Emits is_error:true with total_cost_usd:0 and a class-specific .result string.
+# FAKE_ERROR_CLASS selects the transient class: overloaded | rate-limit | auth-expired
+case "${FAKE_ERROR_CLASS:-overloaded}" in
+  overloaded)
+    RESULT='API Error (529): Overloaded'
+    ;;
+  rate-limit)
+    RESULT='API Error (429): Rate limit exceeded'
+    ;;
+  auth-expired)
+    RESULT='API Error (401): Authentication expired'
+    ;;
+  *)
+    RESULT='API Error: Unknown'
+    ;;
+esac
+printf '%s\n' "{\"is_error\":true,\"result\":\"${RESULT}\",\"total_cost_usd\":0,\"duration_ms\":1500,\"usage\":{\"input_tokens\":0,\"output_tokens\":0,\"cache_creation_input_tokens\":0,\"cache_read_input_tokens\":0}}"
+FAKE_EOF
+  chmod +x "$FAKE_BIN/claude"
+  export PATH="$FAKE_BIN:$PATH"
+
+  # A throwaway git repo so staged-work detection is real (and empty — no
+  # staged work is the load-bearing characteristic of this class).
+  REPO="${TEST_TMP}/repo"
+  mkdir -p "$REPO"
+  git -C "$REPO" init -q
+  git -C "$REPO" config user.email "test@example.com"
+  git -C "$REPO" config user.name "Test"
+  git -C "$REPO" commit -q --allow-empty -m "root"
+
+  SKILL_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/.." && pwd)"
+  SKILL_FILE="${SKILL_DIR}/SKILL.md"
+  ADR_FILE="$(cd "${SKILL_DIR}/../../../.." && pwd)/docs/decisions/032-governance-skill-invocation-patterns.proposed.md"
+}
+
+teardown() {
+  if [ -n "${TEST_TMP:-}" ] && [ -d "$TEST_TMP" ]; then
+    rm -rf "$TEST_TMP"
+  fi
+}
+
+# Faithful re-implementation of SKILL.md Step 5's ORDERED-CHECK decision
+# contract (P214 amendment to the P261 carve-out). The orchestrator reads
+# (1) exit code, (2) is_error, (3) ITERATION_SUMMARY — in that order. On
+# is_error:true + nothing staged, emit a class-appropriate advisory.
+ordered_check_decision() {
+  local exit_code="$1"
+  local json="$2"
+  local repo="$3"
+
+  # (1) Non-zero exit → halt per the exit-code contract.
+  if [ "$exit_code" -ne 0 ]; then
+    printf 'DECISION=HALT reason=non-zero-exit\n'
+    return 0
+  fi
+
+  # (2) Parse is_error BEFORE attempting to parse ITERATION_SUMMARY (the
+  # ordered-check rule P214 amends in).
+  local is_error result
+  is_error=$(printf '%s' "$json" | python3 -c 'import json,sys; print(str(json.load(sys.stdin).get("is_error")).lower())')
+  result=$(printf '%s' "$json" | python3 -c 'import json,sys; print(json.load(sys.stdin).get("result",""))')
+
+  if [ "$is_error" = "true" ]; then
+    # is_error:true with staged work → defer to existing P261 SALVAGE branch
+    # (covered by sibling fixture work-problems-step-5-stream-timeout-salvage.bats).
+    local staged
+    staged=$(git -C "$repo" diff --cached --name-only)
+    if [ -n "$staged" ]; then
+      printf 'DECISION=DEFER_TO_SALVAGE_BRANCH\n'
+      return 0
+    fi
+
+    # is_error:true with NO staged work → HALT with class-appropriate advisory.
+    local advisory
+    case "$result" in
+      *"529"*|*"Overloaded"*|*"overloaded"*)
+        advisory='API overloaded; retry when service recovers'
+        ;;
+      *"429"*|*"Rate limit"*|*"rate limit"*|*"rate-limit"*)
+        advisory='API rate-limited; retry when limit window resets'
+        ;;
+      *"401"*|*"Authentication"*|*"auth"*)
+        advisory='API auth expired; refresh credentials before resuming'
+        ;;
+      *)
+        advisory='transient API error; inspect .result and resume manually'
+        ;;
+    esac
+    printf 'DECISION=HALT reason=is-error-transient advisory=%s\n' "$advisory"
+    return 0
+  fi
+
+  # (3) Exit 0 AND is_error:false → parse ITERATION_SUMMARY.
+  printf 'DECISION=PARSE_SUMMARY\n'
+  return 0
+}
+
+# ---------------------------------------------------------------------------
+# Behavioural cases (the load-bearing core per ADR-052).
+# ---------------------------------------------------------------------------
+
+@test "P214: is_error:true + 529 Overloaded + no staged work -> HALT with API-overloaded advisory" {
+  export FAKE_ERROR_CLASS=overloaded
+  local json
+  json=$( cd "$REPO" && claude -p --output-format json "TEST" < /dev/null )
+  run ordered_check_decision 0 "$json" "$REPO"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"DECISION=HALT"* ]]
+  [[ "$output" == *"reason=is-error-transient"* ]]
+  [[ "$output" == *"API overloaded"* ]]
+  [[ "$output" == *"retry when service recovers"* ]]
+}
+
+@test "P214: is_error:true + 429 rate-limit + no staged work -> HALT with rate-limited advisory" {
+  export FAKE_ERROR_CLASS=rate-limit
+  local json
+  json=$( cd "$REPO" && claude -p --output-format json "TEST" < /dev/null )
+  run ordered_check_decision 0 "$json" "$REPO"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"DECISION=HALT"* ]]
+  [[ "$output" == *"reason=is-error-transient"* ]]
+  [[ "$output" == *"rate-limited"* ]]
+}
+
+@test "P214: is_error:true + 401 auth-expired + no staged work -> HALT with refresh-credentials advisory" {
+  export FAKE_ERROR_CLASS=auth-expired
+  local json
+  json=$( cd "$REPO" && claude -p --output-format json "TEST" < /dev/null )
+  run ordered_check_decision 0 "$json" "$REPO"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"DECISION=HALT"* ]]
+  [[ "$output" == *"reason=is-error-transient"* ]]
+  [[ "$output" == *"auth expired"* ]]
+  [[ "$output" == *"refresh credentials"* ]]
+}
+
+@test "P214: is_error MUST be checked BEFORE ITERATION_SUMMARY parse on Exit 0 (ordered-check invariant)" {
+  # The load-bearing P214 invariant: when exit 0 AND is_error:true, the
+  # decision is HALT, NOT PARSE_SUMMARY. Without the ordered-check rule the
+  # loop would silently route to PARSE_SUMMARY and miss the failure.
+  export FAKE_ERROR_CLASS=overloaded
+  local json
+  json=$( cd "$REPO" && claude -p --output-format json "TEST" < /dev/null )
+  run ordered_check_decision 0 "$json" "$REPO"
+  [ "$status" -eq 0 ]
+  [[ "$output" != *"DECISION=PARSE_SUMMARY"* ]]
+  [[ "$output" == *"DECISION=HALT"* ]]
+}
+
+@test "P214: non-zero exit takes precedence over is_error check (HALT routing)" {
+  # Non-zero exit halts regardless of is_error value — the exit-code rule
+  # is check (1) in the ordered sequence.
+  export FAKE_ERROR_CLASS=overloaded
+  local json
+  json=$( cd "$REPO" && claude -p --output-format json "TEST" < /dev/null )
+  run ordered_check_decision 1 "$json" "$REPO"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"DECISION=HALT"* ]]
+  [[ "$output" == *"reason=non-zero-exit"* ]]
+}
+
+@test "P214: is_error:true + staged work -> defers to existing P261 SALVAGE branch (no double-handling)" {
+  # When staged work exists, the transient-API-error HALT branch must NOT
+  # fire — it MUST defer to the P261 SALVAGE branch. This guards against
+  # the new branch swallowing salvage-eligible work.
+  export FAKE_ERROR_CLASS=overloaded
+  printf 'salvageable work\n' > "$REPO/salvage-me.txt"
+  git -C "$REPO" add salvage-me.txt
+  local json
+  json=$( cd "$REPO" && claude -p --output-format json "TEST" < /dev/null )
+  run ordered_check_decision 0 "$json" "$REPO"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"DECISION=DEFER_TO_SALVAGE_BRANCH"* ]]
+}
+
+# ---------------------------------------------------------------------------
+# Doc-lint contract assertions (Permitted Exception per ADR-037; structural
+# slice marked at top of file per ADR-052 Surface 2). These guard the SKILL.md
+# / ADR-032 prose against drift away from the behavioural contract above.
+# ---------------------------------------------------------------------------
+
+@test "P214: SKILL.md Step 5 documents the ORDERED check sequence (exit-code, is_error, ITERATION_SUMMARY)" {
+  # The ordered-check rule must be explicit in the prose so an implementer
+  # reading Step 5 routes is_error:true to HALT before attempting to parse
+  # a missing ITERATION_SUMMARY block.
+  run grep -niE "(check|read|parse).{0,40}is_error.{0,80}before.{0,80}(ITERATION_SUMMARY|parse|\.result)|ordered check|check.order" "$SKILL_FILE"
+  [ "$status" -eq 0 ]
+}
+
+@test "P214: SKILL.md Step 5 names the transient-API-error classes (overloaded / rate-limit / auth-expired)" {
+  # The HALT advisory must enumerate the known transient classes so the
+  # final summary carries an actionable message rather than a generic
+  # "loop halted" line.
+  run grep -niE "529|Overloaded|overload" "$SKILL_FILE"
+  [ "$status" -eq 0 ]
+  run grep -niE "429|rate.?limit" "$SKILL_FILE"
+  [ "$status" -eq 0 ]
+  run grep -niE "401|auth.?expired|auth.*expir" "$SKILL_FILE"
+  [ "$status" -eq 0 ]
+}
+
+@test "P214: SKILL.md Step 5 cites P214 as the driver of the transient-API-error HALT branch" {
+  run grep -nE "P214" "$SKILL_FILE"
+  [ "$status" -eq 0 ]
+}
+
+@test "P214: SKILL.md HALT branch distinguishes the transient-API-error class from the P261 stream-timeout SALVAGE class" {
+  # The two is_error:true branches (SALVAGE vs HALT) must be cross-referenced
+  # so adopters reading either branch see the other.
+  run grep -niE "P261.{0,200}(transient|HALT|overload|class)|transient.{0,200}P261|salvage.{0,200}(transient|class)" "$SKILL_FILE"
+  [ "$status" -eq 0 ]
+}
+
+@test "P214: ADR-032 P261 section names the is_error:true class taxonomy (SALVAGE = stream-timeout; HALT = transient-API-error)" {
+  # ADR-032's P261 amendment should be extended with the broader class
+  # taxonomy so the SKILL prose and the ADR contract stay in sync.
+  run grep -niE "P214|transient.?(API.?)?error|class taxonomy|(overload|rate.?limit|auth.?expired).{0,80}HALT|HALT.{0,80}(overload|rate.?limit|auth.?expired)" "$ADR_FILE"
+  [ "$status" -eq 0 ]
+}

package/skills/work-problems/test/work-problems-step-6-5-postrelease-kv-callback.bats

@@ -0,0 +1,209 @@
+#!/usr/bin/env bats
+# Step 6.5 Post-release K→V auto-transition callback (P228) — behavioural.
+#
+# Driver: ADR-022 prescribes K→V transition on release, but until P228
+# there was no auto-fire surface to back-fill the transition once a fix
+# ships. The post-release callback enumerator
+# (`packages/itil/lib/enumerate-postrelease-kv-candidates.sh`) is the
+# data source: it walks `docs/problems/known-error/*.md`, invokes the
+# derive-release-vehicle helper per ticket, and emits one
+# `KV_CANDIDATE: P<NNN> | <changeset>` line per ticket whose changeset
+# has shipped (derive exit 0).
+#
+# The 2026-06-08 P220 witness — `## Fix Released` populated but K→V
+# deferred citing a misapplied P143 amendment — is the empirical bug
+# this enumerator wires the surface to close.
+#
+# Cases covered (behavioural — exercise the helper, assert observable
+# output; structural ban per ADR-005 / P081):
+#   1. known-error/ dir absent           → KV_CANDIDATES_SUMMARY: total=0
+#   2. known-error/ dir empty            → KV_CANDIDATES_SUMMARY: total=0
+#   3. ticket present, derive exit 0     → KV_CANDIDATE emitted; total=1
+#   4. ticket present, derive exit 2     → skipped silently; total=0
+#      (no `.changeset/<name>.md` ref in body — legacy ticket)
+#   5. ticket present, derive exit 3     → skipped silently; total=0
+#      (changeset still in working tree — unreleased)
+#   6. mixed cohort (3 tickets: shipped + legacy + unreleased)
+#                                        → only the shipped one emitted
+#   7. README.md inside known-error/ is excluded from the enumeration
+#   8. unknown derive exit code          → stderr warning + skip; total=0
+#
+# Cross-references:
+#   @problem P228 (K→V auto-transition gap)
+#   @adr ADR-022 (Verifying lifecycle)
+#   @adr ADR-018 (release-cadence host of the callback)
+#   @adr ADR-005 (behavioural bats per P081)
+#   @jtbd JTBD-006 (Progress the Backlog While I'm Away — primary driver)
+
+setup() {
+  REPO_ROOT="$(cd "$(dirname "$BATS_TEST_FILENAME")/../../../../.." && pwd)"
+  HELPER="$REPO_ROOT/packages/itil/lib/enumerate-postrelease-kv-candidates.sh"
+
+  FIXTURE="$(mktemp -d)"
+  mkdir -p "$FIXTURE/docs/problems"
+
+  STUB_DIR="$(mktemp -d)"
+}
+
+teardown() {
+  rm -rf "$FIXTURE" "$STUB_DIR"
+}
+
+# Helper — write a stub derive-release-vehicle command that returns a
+# canned exit code (per ticket-id-to-exit-code map encoded in $STUB_MAP).
+# $STUB_MAP shape: `<NNN>:<exit>:<changeset>;<NNN>:<exit>:<changeset>;...`
+# The third field is consumed only when exit=0 (emitted in the RELEASE_VEHICLE
+# block the lib greps for changeset path).
+write_stub_derive() {
+  local stub="$STUB_DIR/wr-itil-derive-release-vehicle"
+  cat > "$stub" <<'STUB'
+#!/usr/bin/env bash
+# Stub derive-release-vehicle for the enumerator behavioural test. Reads
+# $STUB_MAP from the environment, returns canned exit codes per ticket.
+nnn="$1"
+nnn_norm="$(printf '%03d' "$((10#$nnn))")"
+IFS=';' read -ra entries <<< "${STUB_MAP:-}"
+for entry in "${entries[@]}"; do
+  [ -z "$entry" ] && continue
+  IFS=':' read -r id ex cs <<< "$entry"
+  id_norm="$(printf '%03d' "$((10#$id))")"
+  if [ "$id_norm" = "$nnn_norm" ]; then
+    if [ "$ex" -eq 0 ]; then
+      cat <<EOF
+RELEASE_VEHICLE:
+  changeset: $cs
+  version-packages-commit: deadbeefdeadbeefdeadbeefdeadbeefdeadbeef
+  pr: #999
+  merge-commit: deadbeefdeadbeefdeadbeefdeadbeefdeadbeef
+  release-date: 2026-06-08
+EOF
+    fi
+    exit "$ex"
+  fi
+done
+# Default: no entry for this ticket → exit 1 (not found)
+exit 1
+STUB
+  chmod +x "$stub"
+}
+
+# Helper — write a known-error ticket fixture (body content is opaque to
+# the enumerator; only the filename's leading NNN matters since the
+# derive helper is stubbed).
+write_ke_ticket() {
+  local nnn="$1"
+  local slug="$2"
+  mkdir -p "$FIXTURE/docs/problems/known-error"
+  cat > "$FIXTURE/docs/problems/known-error/${nnn}-${slug}.md" <<EOF
+# Problem ${nnn}: ${slug}
+
+**Status**: Known Error
+
+## Description
+
+Test fixture for the enumerator behavioural bats.
+EOF
+}
+
+# Source the lib once for all tests.
+load_lib() {
+  # shellcheck source=/dev/null
+  source "$HELPER"
+}
+
+@test "helper file exists and is sourceable" {
+  [ -f "$HELPER" ]
+  load_lib
+}
+
+@test "case 1: known-error/ dir absent → total=0" {
+  load_lib
+  rm -rf "$FIXTURE/docs/problems/known-error"
+  run enumerate_postrelease_kv_candidates "$FIXTURE/docs/problems"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"KV_CANDIDATES_SUMMARY: total=0"* ]]
+  [[ "$output" != *"KV_CANDIDATE:"* ]]
+}
+
+@test "case 2: known-error/ dir empty → total=0" {
+  load_lib
+  mkdir -p "$FIXTURE/docs/problems/known-error"
+  run enumerate_postrelease_kv_candidates "$FIXTURE/docs/problems"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"KV_CANDIDATES_SUMMARY: total=0"* ]]
+  [[ "$output" != *"KV_CANDIDATE:"* ]]
+}
+
+@test "case 3: ticket present + derive exit 0 → KV_CANDIDATE emitted, total=1" {
+  load_lib
+  write_stub_derive
+  write_ke_ticket "228" "adr-022-known-error-to-verifying-transition"
+  PATH="$STUB_DIR:$PATH" STUB_MAP="228:0:.changeset/p228-fix.md" \
+    run enumerate_postrelease_kv_candidates "$FIXTURE/docs/problems"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"KV_CANDIDATE: P228 | .changeset/p228-fix.md"* ]]
+  [[ "$output" == *"KV_CANDIDATES_SUMMARY: total=1"* ]]
+}
+
+@test "case 4: ticket present + derive exit 2 (no vehicle ref) → skipped silently, total=0" {
+  load_lib
+  write_stub_derive
+  write_ke_ticket "100" "legacy-pre-p330-no-vehicle"
+  PATH="$STUB_DIR:$PATH" STUB_MAP="100:2:" \
+    run enumerate_postrelease_kv_candidates "$FIXTURE/docs/problems"
+  [ "$status" -eq 0 ]
+  [[ "$output" != *"KV_CANDIDATE:"* ]]
+  [[ "$output" == *"KV_CANDIDATES_SUMMARY: total=0"* ]]
+}
+
+@test "case 5: ticket present + derive exit 3 (unreleased) → skipped silently, total=0" {
+  load_lib
+  write_stub_derive
+  write_ke_ticket "200" "changeset-still-in-tree"
+  PATH="$STUB_DIR:$PATH" STUB_MAP="200:3:" \
+    run enumerate_postrelease_kv_candidates "$FIXTURE/docs/problems"
+  [ "$status" -eq 0 ]
+  [[ "$output" != *"KV_CANDIDATE:"* ]]
+  [[ "$output" == *"KV_CANDIDATES_SUMMARY: total=0"* ]]
+}
+
+@test "case 6: mixed cohort — only the shipped ticket is emitted, total=1" {
+  load_lib
+  write_stub_derive
+  write_ke_ticket "228" "shipped"
+  write_ke_ticket "100" "legacy-no-vehicle"
+  write_ke_ticket "200" "changeset-in-tree"
+  PATH="$STUB_DIR:$PATH" \
+    STUB_MAP="228:0:.changeset/p228-fix.md;100:2:;200:3:" \
+    run enumerate_postrelease_kv_candidates "$FIXTURE/docs/problems"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"KV_CANDIDATE: P228 | .changeset/p228-fix.md"* ]]
+  [[ "$output" != *"KV_CANDIDATE: P100"* ]]
+  [[ "$output" != *"KV_CANDIDATE: P200"* ]]
+  [[ "$output" == *"KV_CANDIDATES_SUMMARY: total=1"* ]]
+}
+
+@test "case 7: README.md inside known-error/ is excluded from the enumeration" {
+  load_lib
+  write_stub_derive
+  mkdir -p "$FIXTURE/docs/problems/known-error"
+  printf '# Known Error Tickets\n' > "$FIXTURE/docs/problems/known-error/README.md"
+  PATH="$STUB_DIR:$PATH" STUB_MAP="" \
+    run enumerate_postrelease_kv_candidates "$FIXTURE/docs/problems"
+  [ "$status" -eq 0 ]
+  [[ "$output" != *"KV_CANDIDATE:"* ]]
+  [[ "$output" == *"KV_CANDIDATES_SUMMARY: total=0"* ]]
+}
+
+@test "case 8: unknown derive exit code → stderr warning + skip, total=0" {
+  load_lib
+  write_stub_derive
+  write_ke_ticket "999" "weird-exit"
+  PATH="$STUB_DIR:$PATH" STUB_MAP="999:42:" \
+    run enumerate_postrelease_kv_candidates "$FIXTURE/docs/problems"
+  [ "$status" -eq 0 ]
+  [[ "$output" != *"KV_CANDIDATE:"* ]]
+  [[ "$output" == *"KV_CANDIDATES_SUMMARY: total=0"* ]]
+  # Stderr warning is captured into $output when bats merges stderr; the
+  # contract here is "skip silently AND don't lose audit signal".
+}