clearotron 0.3.0-beta.2 → 0.3.0-beta.3

package/scripts/e2e.mjs

@@ -1002,11 +1002,59 @@ export function doorUnavailableLabel(a, { max = 90 } = {}) {
   return "no status and no reason recorded";
 }
 
-export function doorAsymmetry(answers) {
+/**
+ * ── THE ASYMMETRY RULE IS WRITTEN FOR A CASE BOTH DOORS SHOULD REFUSE ───────────────────────────
+ *
+ * "The one that ACCEPTED is the defect" rests on a premise nobody wrote down: that the case EXPECTS a
+ * refusal. Eight of R0's nine cases do, so the premise held by accident for as long as the ninth could
+ * not be measured.
+ *
+ * R0e is the one admit case. Its own `expect.terminal` is `"delivered"` and it asserts the run resolves
+ * to `generic`. On 2026-09-10, the first round in which both doors actually ANSWERED it, the cli door
+ * accepted and delivered `profileKey: "generic"` — the case's whole contract, met — and the ops-mcp door
+ * refused at `assertScopedProfileKey`, a deliberate cross-customer bypass gate doing its job for an
+ * accounts-scoped session. Both doors were right. The rule named the one that behaved.
+ *
+ * The three earlier rounds hid it: the ops-mcp door was lost to the transport every time, so the case
+ * never reached this comparison as two real answers.
+ *
+ * SO THE POLARITY IS NOT INVERTED HERE, and that matters. "On an admit case the door that REFUSED is the
+ * defect" would blame a security gate for holding. What is wrong is the VERDICT, not its direction: on an
+ * admit case this comparison does not know which door is at fault, and it says so instead of guessing.
+ * A case that declares which doors can admit it (`doors`) stops the guess entirely.
+ */
+export function doorAsymmetry(answers, { expectTerminal = null } = {}) {
   const compared = answers.filter((a) => doorAnswerClass(a) === DOOR_ANSWER.ANSWERED);
   const unavailable = answers.filter((a) => doorAnswerClass(a) === DOOR_ANSWER.INFRA_UNAVAILABLE);
   const agreed = compared.length < 2 ? true : compared.every((a) => a.ok === compared[0].ok);
-  return { agreed, compared, unavailable, reducedCoverage: unavailable.length > 0 };
+  return { agreed, compared, unavailable, reducedCoverage: unavailable.length > 0, admit: isAdmitCase(expectTerminal) };
+}
+
+/** A case whose own contract is that a door ACCEPTS. `delivered` and `duplicate` both admit; the rest refuse. */
+export function isAdmitCase(expectTerminal) {
+  const t = String(expectTerminal ?? "").trim().toLowerCase();
+  return t === "delivered" || t === "duplicate";
+}
+
+/**
+ * The sentence a disagreement gets — ONE author, because the run printed it and the report pushed it into
+ * `toInvestigate` from two separate literals, and a fix to either would have left the other saying the
+ * old thing.
+ *
+ * `accepted`/`refused` read `ok` at run time and `accepted` on the receipt; both spellings are the same
+ * fact and one formatter has to serve both surfaces or they drift.
+ */
+export function doorDisagreementLine(caseId, answers, { expectTerminal = null } = {}) {
+  const took = (a) => (a?.ok ?? a?.accepted) === true;
+  const accepted = answers.filter(took).map((a) => a.door);
+  const refused = answers.filter((a) => !took(a)).map((a) => a.door);
+  const both = `accepted by ${accepted.join(", ") || "(none)"}, refused by ${refused.join(", ") || "(none)"}`;
+  if (!isAdmitCase(expectTerminal))
+    return `${caseId}: THE DOORS DISAGREE — ${both}; the door that ACCEPTED is the defect`;
+  return `${caseId}: THE DOORS DISAGREE on a case whose own expect.terminal ADMITS — ${both}. `
+    + `The accepting door met this case's stated contract; the refusing door answered a question the case did not ask. `
+    + `WHICH IS AT FAULT IS NOT DECIDED HERE — a door may refuse for a reason this case cannot satisfy at that door, `
+    + `and naming the accepter would blame the door that behaved. Declare \`doors\` on the case to say which doors can admit it.`;
 }
 
 const enqueue = (job, door) =>
@@ -1115,6 +1163,46 @@ const OPS = {
   length: (v, want) => ({ ok: Array.isArray(v) && v.length === want, saw: Array.isArray(v) ? `${v.length}` : JSON.stringify(v) }),
 };
 
+/**
+ * The file `delivery-settled` reads, and the ONLY one it reads.
+ *
+ * Named rather than inlined because two places have to agree about it: the op itself, and the check that
+ * asks every scenario whether the path it declared for an op is one that op can read. A literal in both
+ * is the shape that produced the defect this constant exists to prevent.
+ */
+export const DELIVERY_STATUS_FILE = "status.json";
+
+/**
+ * Which ops read a FIXED file rather than the path the scenario declares, and what that file is.
+ *
+ * DERIVED CHECKS NEED THIS TABLE, not a hand-written list of known-bad scenarios: a scenario nobody
+ * thought to add is exactly the one that goes unnoticed, and R13 went unnoticed for four rounds.
+ */
+export const FIXED_FILE_OPS = Object.freeze({ "delivery-settled": DELIVERY_STATUS_FILE });
+
+/**
+ * Every scenario case whose declared `path` names a file its `op` does not read.
+ *
+ * Not a pass/fail — the op reads the right file either way. It is a REPORT, so a scenario stating a wrong
+ * belief about an op is visible to whoever runs it. Built from the scenario set, never from a list of
+ * names: the point is to find the next one.
+ */
+export function pathsAnOpDoesNotRead(scenarios) {
+  const out = [];
+  for (const s of scenarios ?? []) {
+    const cases = s?.cases ?? (s?.expect ? [{ id: s.id, expect: s.expect }] : []);
+    for (const c of cases) {
+      for (const a of c?.expect?.assert ?? []) {
+        const fixed = FIXED_FILE_OPS[a?.op];
+        if (!fixed) continue;
+        const declared = String(a?.path ?? "").split(":")[0];
+        if (declared && declared !== fixed) out.push({ scenario: s.id, case: c.id ?? s.id, op: a.op, declared, reads: fixed });
+      }
+    }
+  }
+  return out;
+}
+
 function evalAssertion(a, runDir) {
   const [file, field] = String(a.path ?? "").split(":");
   const full = join(runDir, file || "");
@@ -1335,8 +1423,21 @@ function evalAssertion(a, runDir) {
   // exist. A run that flipped sendPending without writing one would have passed the old assertion and
   // fails this one.
   if (a.op === "delivery-settled") {
-    const st = readJson(full);
-    if (!st) return { ok: false, saw: "status.json absent or unparseable" };
+    // — THIS OP READS `status.json`, WHATEVER PATH THE SCENARIO DECLARED, and the error text three
+    // lines below always said so while the read above it took `full`. R13 declared `_driver/delivery.json`,
+    // which parses cleanly and carries no `sendPending`, so the assertion read `undefined`, failed a run
+    // that had delivered correctly, and pushed a product defect that did not exist into `INVESTIGATE`.
+    // It went unseen for four rounds because R13 had been REPORTED once.
+    //
+    // Reading the run's own status is not a correction of the scenario — it is what the op has always
+    // meant. The scenario's `path` is still ANSWERED FOR rather than ignored: `declaredPathNote` says so
+    // in the line, so a scenario stating a belief about this op that is wrong is visible to the reader
+    // who runs it, not only to whoever next reads this function.
+    const st = readJson(join(runDir, DELIVERY_STATUS_FILE));
+    const declaredPathNote = (file && file !== DELIVERY_STATUS_FILE)
+      ? ` — NOTE: this scenario declares \`path: "${file}"\` for \`delivery-settled\`, which reads \`${DELIVERY_STATUS_FILE}\` and nothing else. The declared path was not read.`
+      : "";
+    if (!st) return { ok: false, saw: `${DELIVERY_STATUS_FILE} absent or unparseable${declaredPathNote}` };
     // — THERE IS NO MODE TO READ ANY MORE, and this is the one place where that mattered rather
     // than being a comment fix. This used to open `process.env.CLEAROTRON_DELIVERY || "email"` and take a
     // `sendPending === false` branch for anything that was not `handoff`. With the variable deleted that
@@ -1392,7 +1493,7 @@ function evalAssertion(a, runDir) {
     const { packets, unreadable } = outboxPackets({ runIds: runIdForms(st, runDir) });
     return { ok: st.sendPending === true && packets.length > 0,
       saw: `mode=handoff sendPending=${JSON.stringify(st.sendPending)} packet=${
-        packets.length ? packets.join(", ") : unreadable ? `NOT LOOKED FOR — ${unreadable}` : "NONE WRITTEN"}` };
+        packets.length ? packets.join(", ") : unreadable ? `NOT LOOKED FOR — ${unreadable}` : "NONE WRITTEN"}${declaredPathNote}` };
   }
 
   // `absent` — the file must NOT exist, and its absence is the asserted state, not a silent pass.
@@ -1811,7 +1912,7 @@ async function cmdRun(id) {
   // ever wants the launch to stop.
   printPreviousRoundNotice(s);
 
-  const jobs = s.job ? [{ id: s.id, job: s.job }] : (s.cases ?? []).map((c) => ({ id: c.id, job: c.job, what: c.what, oneMatterAcrossDoors: c.oneMatterAcrossDoors === true }));
+  const jobs = s.job ? [{ id: s.id, job: s.job }] : (s.cases ?? []).map((c) => ({ id: c.id, job: c.job, what: c.what, oneMatterAcrossDoors: c.oneMatterAcrossDoors === true, expectTerminal: (c.expect ?? {}).terminal ?? null }));
 
   // door: "all" is the point of R0 — a rule enforced in one door and not another is exactly the #98
   // asymmetry. Every case goes through EVERY drivable door and the answers are compared. runner.mjs's
@@ -1827,7 +1928,7 @@ async function cmdRun(id) {
   // over whatever was there, so the second run of a pair destroyed the first round's token and the
   // first half became unreportable with nothing saying so.
   const round = { token: RUN_TOKEN, startedAt: new Date().toISOString(), startedAtSource: "run", doors, cases: [] };
-  for (const { id: caseId, job, what, oneMatterAcrossDoors } of jobs) {
+  for (const { id: caseId, job, what, oneMatterAcrossDoors, expectTerminal } of jobs) {
     // The round token goes on the BASE ref, so the door suffix (and R0d's opt-out from it) still decides
     // whether the doors are one matter or two. See refForRun and refForDoor.
     const roundRef = refForRun(job.ref);
@@ -1857,7 +1958,7 @@ async function cmdRun(id) {
         console.log(`      [${a.door}] ${a.ok ? "accepted" : "refused"}: ${a.out.split("\n").slice(0, 2).join(" ").slice(0, 200)}`);
       }
     }
-    if (!agreed) console.log(`      ⚠ THE DOORS DISAGREE on this case — the one that ACCEPTED is the defect`);
+    if (!agreed) console.log(`      ⚠ ${doorDisagreementLine(caseId, answers, { expectTerminal })}`);
     // — named, never silent. A door lost to the transport costs this case a share of its door
     // coverage, and that is a fact about the ROUND, not about the product. Saying nothing here is how
     // the R0e 429 cost a third of a scenario's coverage without appearing anywhere.
@@ -3083,9 +3184,13 @@ async function cmdReport(id, { round: requestedToken = null } = {}) {
         .filter((x) => x.out.length);
       console.log(`\ndoors: ${rec.doors.join(", ") || "(not recorded)"} — ${rec.cases.length} case(s), ${dis.length} disagreement(s), ${unavailable.length} case(s) with reduced door coverage`);
       for (const c of dis) {
+        // — the RECEIPT does not carry the case's contract, so it is joined back to the scenario by
+        // id. A receipt written before this field existed reads null and gets the old sentence, which is
+        // the right reading for it rather than a retrospective one.
+        const expectTerminal = ((s.cases ?? []).find((x) => x.id === c.id)?.expect ?? {}).terminal ?? null;
         const accepted = c.answers.filter((a) => a.accepted).map((a) => a.door);
         console.log(`  ⚠ ${c.id}: accepted by ${accepted.join(", ") || "(none)"}, refused by ${c.answers.filter((a) => !a.accepted).map((a) => a.door).join(", ") || "(none)"}`);
-        toInvestigate.push(`${c.id}: THE DOORS DISAGREE — accepted by ${accepted.join(", ")}; the door that ACCEPTED is the defect`);
+        toInvestigate.push(doorDisagreementLine(c.id, c.answers, { expectTerminal }));
       }
       for (const { c, out } of unavailable) {
         const who = out.map((a) => `${a.door} (${doorUnavailableLabel(a)})`).join(", ");

package/scripts/revisit-render-check.mjs

@@ -221,14 +221,31 @@ const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
 // the truncation as a lower request count — the failure mode that would make this whole check lie in the
 // safe-looking direction. Wait until the server has been silent for `quiet` ms, capped so a screen that
 // requests forever fails loudly instead of hanging.
-const settle = async ({ quiet = 900, cap = 12000 } = {}) => {
+//
+// SILENCE BEFORE THE FIRST REQUEST IS NOT QUIET, WHERE A REQUEST IS OWED. `Page.navigate` returns as soon
+// as the navigation is committed, long before the app's bundle has run, so the quiet clock above used to
+// start while the server had heard nothing at all — and a first fetch that arrived later than `quiet`
+// closed the window empty. Every request that followed was then counted into the NEXT window, so the
+// whole drive read one bucket late: visit 1 empty, the revisit holding what boot had asked for. On a warm
+// machine the bundle runs in well under a second and it never showed; on a slow runner it failed nine
+// assertions about a product that was behaving. Reproduced by delaying the bundle 1.5s at this fixture.
+//
+// `expectTraffic` is for a window that follows a FULL NAVIGATION — the shell's boot and the Result
+// screen's first visit, the two places this drive calls `Page.navigate`. Each reloads the bundle, so each
+// has the same gap between the navigation committing and the app's first fetch. A client-side visit runs
+// on the bundle already loaded and has no such gap, which is why it is not the default: a revisit is
+// allowed to ask for nothing, and that is the very thing this file measures, so a window there must still
+// be able to close on silence.
+const settle = async ({ quiet = 900, cap = 12000, expectTraffic = false } = {}) => {
   const started = Date.now()
+  const before = hits.length
   let last = hits.length
   let lastChange = Date.now()
   for (;;) {
     await sleep(100)
     if (hits.length !== last) { last = hits.length; lastChange = Date.now() }
-    if (Date.now() - lastChange >= quiet) return true
+    const heard = hits.length > before
+    if ((heard || !expectTraffic) && Date.now() - lastChange >= quiet) return true
     if (Date.now() - started >= cap) return false
   }
 }
@@ -290,7 +307,8 @@ const record = {}
 // The shell, once. Everything after this is client-side.
 epoch = 'boot'
 await navigateOrRefuse(cmd, `${origin}/portal/home`, { what: 'revisit-render-check' })
-if (!(await settle())) say(false, 'the shell never went quiet within 12s — it is still requesting')
+if (!(await settle({ expectTraffic: true })))
+  say(false, 'the shell did not finish loading within 12s — it never reached the fixture server, or never stopped requesting')
 const bootPath = await where()
 say(bootPath === '/portal/home', `the shell loaded on /portal/home (got ${bootPath})`)
 
@@ -384,7 +402,7 @@ await twice('clearances', () => clickNav('Clearances'), '/portal/clearances')
 // runs AppShell's popstate listener rather than its click funnel.
 epoch = 'result:1'
 await navigateOrRefuse(cmd, `${origin}/portal/result/${RUN_ID}`, { what: 'revisit-render-check' })
-const rq1 = await settle()
+const rq1 = await settle({ expectTraffic: true })   // a full navigation, like boot
 const rp1 = await where()
 const rt1 = await screenText()
 say(rp1 === `/portal/result/${RUN_ID}`, `result: visit 1 landed on the run (got ${rp1})`)

package/scripts/travelling-predicates.mjs

@@ -101,7 +101,7 @@ function isPlumbing(node, child) {
   // A ternary BRANCH is plumbing; a ternary TEST is a decision, and classify() handles that separately.
   // This was the whole of the unresolved bucket — three sites, all one shape:
   //
-  //     const wrote   = files.length ? files.some(…) : null;              gateway.mjs:1407
+  //     const wrote   = files.length ? files.some(…) : null;              gateway.mjs (by name)
   //     const inScope = scope.size   ? tokens.some(…) : (…);              reasoning-tripwires.mjs:82
   //     const reached = b.layer === "national" ? (…) : regions.some(…);   register-plan.mjs:318
   //

package/shared/store-in-repo.mjs

@@ -142,7 +142,7 @@ export function storeOutsideRepoMessage({ storeVar, storeDir, repoVar, repoRoot
 // knows both. So the appender returns a path only when that path is committable, and the core commits
 // what it is handed.
 
-import { appendFileSync } from "node:fs";
+import { appendFileSync, rmSync } from "node:fs";
 
 /**
  * A repo root is a PATH, and every helper below interpolates it into a git invocation. Anything else
@@ -289,6 +289,39 @@ import { execFileSync } from "node:child_process";
 export const isTransientGitFault = (detail) =>
   /index\.lock|another git process seems to be running|Unable to create/i.test(String(detail ?? ""));
 
+/**
+ * Why a commit into `repoRoot` would be refused, asked BEFORE anything is written; null when it would not
+ * be. Read-only: `rev-parse` and `git var` change nothing. `{ code, detail, message }`, where `message` names
+ * the store and the command that clears it, in terms an operator acts on rather than git's own words:
+ *
+ *   not-a-repository — the store is not inside a git repository this process can use;
+ *   no-identity      — git has no committer identity here. That is the default state of any machine where
+ *                      nobody ran `git config user.email`, a fresh Windows install among them. A save names
+ *                      its author; the COMMITTER is the machine's, and git refuses a commit it cannot name
+ *                      one for. `git -c user.email=…` on a one-off seed commit does not help: `-c` configures
+ *                      that invocation, not the repository, so every save after it fails the same way.
+ */
+export function storeCommitRefusal(repoRoot, { env = process.env } = {}) {
+  requireRepoRootPath(repoRoot, "storeCommitRefusal");
+  const ask = (...args) => execFileSync("git", ["-C", repoRoot, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env });
+  const said = (e) => String(e?.stderr || e?.message || e).trim().split("\n").filter(Boolean);
+  try { ask("rev-parse", "--git-dir"); }
+  catch (e) {
+    const detail = said(e)[0]?.slice(0, 200) ?? "";
+    const fix = /dubious ownership/i.test(detail)
+      ? `run \`git config --global --add safe.directory ${repoRoot}\` as the account the service runs as`
+      : `run \`git init\` in ${repoRoot}, or point PROFILE_REPO_ROOT at the repository that holds the store`;
+    return { code: "not-a-repository", detail, message: `the store at ${repoRoot} is not a git repository this install can record into (${detail}) — ${fix}` };
+  }
+  try { ask("var", "GIT_COMMITTER_IDENT"); }
+  catch (e) {
+    return { code: "no-identity", detail: said(e).pop()?.slice(0, 200) ?? "",
+      message: `the store at ${repoRoot} has no git identity, so nothing saved to it can be recorded — run `
+        + `\`git -C ${repoRoot} config user.email "you@example.com"\` and \`git -C ${repoRoot} config user.name "Your Name"\`` };
+  }
+  return null;
+}
+
 export function makeStoreCommit({ repoRoot, log = () => {}, what = "store", retries = 3, waitMs = 50 }) {
   requireRepoRootPath(repoRoot, "makeStoreCommit");
   const git = (...args) => execFileSync("git", ["-C", repoRoot, ...args], { encoding: "utf8" }).toString().trim();
@@ -309,7 +342,7 @@ export function makeStoreCommit({ repoRoot, log = () => {}, what = "store", retr
   const napping = (ms) => { try { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms); } catch { /* best effort */ } };
   const detailOf = (e) => String(e?.stderr ?? e?.message ?? e);
 
-  return ({ files, message, author }) => {
+  const commit = ({ files, message, author }) => {
     // Asked BEFORE anything composes a diff, so the caller gets the refusal rather than a fallback-mode
     // parse error. Throwing here also means the write is never followed by a silent half-save: the
     // caller's own catch is what turns this into a failed save.
@@ -350,6 +383,21 @@ export function makeStoreCommit({ repoRoot, log = () => {}, what = "store", retr
       }
     }
   };
+  // ── TWO MORE ANSWERS, FOR A CREATE, WHICH IS REFUSED RATHER THAN LEFT HALF-MADE ──────────────────────
+  //
+  // A save of something that already exists stays as above: live, staged, completed by the next save.
+  // A CREATE is different, because "before" exists: the paths it wrote were absent. So a create asks
+  // `refusal()` first and writes nothing when the store cannot record it, and when the commit fails anyway
+  // (a hook, a full disk), `withdraw(files)` returns those paths to absent: out of the index, so the next
+  // save's completion step cannot commit a company that does not exist, and off the disk. Nothing else is
+  // touched, and the audit row the create staged stays staged, because it records what happened.
+  commit.refusal = () => storeCommitRefusal(repoRoot);
+  commit.withdraw = (files) => {
+    const paths = (files ?? []).map((f) => resolve(repoRoot, f));
+    if (paths.length) git("rm", "--cached", "--quiet", "--ignore-unmatch", "--", ...paths);
+    for (const p of paths) rmSync(p, { force: true });
+  };
+  return commit;
 }
 
 export function resolveStoreRepoRoot({ names, fallback = null, env = process.env } = {}) {