paperlint 11.0.0 → 11.1.0

package/src/adapters/hotcrp/cassette/get-searchcompletion.json

@@ -0,0 +1,100 @@
+{
+  "ok": true,
+  "searchcompletion": [
+    "has:submission",
+    "has:abstract",
+    "abstract:{text}",
+    "has:response",
+    "has:draftresponse",
+    "topic:\"DS/ML/AI Technique\"",
+    "topic:\"DS/ML/AI Technique: Classical machine learning (e.g., regression, SVMs, nearest neighbour, decision trees, PCA, naive Bayes classifier, and k-means clustering)\"",
+    "topic:\"DS/ML/AI Technique: Convolutional neural networks\"",
+    "topic:\"DS/ML/AI Technique: LLM or other foundation models (e.g., large vision model)\"",
+    "topic:\"DS/ML/AI Technique: Reinforcement learning\"",
+    "topic:\"DS/ML/AI Technique: Transformers\"",
+    "topic:\"Performance analysis and testing\"",
+    "topic:\"Research Method\"",
+    "topic:\"Research Method: Controlled experiments with human subjects (e.g., A/B tests, lab studies)\"",
+    "topic:\"Research Method: Qualitative analysis (e.g., thematic analysis, grounded theory)\"",
+    "topic:\"Research Method: Statistical analysis and modelling\"",
+    "topic:\"Research Method: Survey design and analysis\"",
+    "topic:\"SE Topic\"",
+    "topic:\"SE Topic: AI for software engineering\"",
+    "topic:\"SE Topic: API design and evolution\"",
+    "topic:\"SE Topic: App store analysis\"",
+    "topic:\"SE Topic: Cloud-based and distributed systems\"",
+    "topic:\"SE Topic: Debugging, fault localization, and fault prediction\"",
+    "topic:\"SE Topic: DevOps and release engineering\"",
+    "topic:\"SE Topic: Distributed and collaborative software engineering\"",
+    "topic:\"SE Topic: Energy profiling\"",
+    "topic:\"SE Topic: Ethical concerns (bias, fairness, explainability, etc.)\"",
+    "topic:\"SE Topic: Human aspects\"",
+    "topic:\"SE Topic: Legal aspects (licenses, copyright, etc.)\"",
+    "topic:\"SE Topic: Privacy and security\"",
+    "topic:\"SE Topic: Program comprehension\"",
+    "topic:\"SE Topic: Recommender systems\"",
+    "topic:\"SE Topic: Software development processes\"",
+    "topic:\"SE Topic: Software ecosystems\"",
+    "topic:\"SE Topic: Software engineering for AI\"",
+    "topic:\"SE Topic: Software maintenance and evolution\"",
+    "topic:\"SE Topic: Software measurement and analytics\"",
+    "topic:\"SE Topic: Software quality assurance\"",
+    "topic:\"SE Topic: Source / test code\"",
+    "topic:\"SE Topic: Version control history logs\"",
+    "topic:\"Software repository\"",
+    "topic:\"Software repository: App stores\"",
+    "topic:\"Software repository: Archived communications (mailing lists, Gitter/Slack/Discord channels, etc.)\"",
+    "topic:\"Software repository: Build / CI logs\"",
+    "topic:\"Software repository: Code reviews\"",
+    "topic:\"Software repository: Execution traces and logs\"",
+    "topic:\"Software repository: Human interaction data\"",
+    "topic:\"Software repository: Issue trackers / defect repositories\"",
+    "topic:\"Software repository: Package registries / software releases\"",
+    "topic:\"Software repository: Q&A websites\"",
+    "show:({formula})",
+    "hide:({formula})",
+    "show:abstract",
+    "hide:abstract",
+    "show:ACMCorAut",
+    "hide:ACMCorAut",
+    "show:acmpagecount",
+    "hide:acmpagecount",
+    "show:authors",
+    "hide:authors",
+    "show:commenters",
+    "hide:commenters",
+    "show:conflict",
+    "hide:conflict",
+    "show:conflict:{user}",
+    "hide:conflict:{user}",
+    "show:decision",
+    "hide:decision",
+    "show:graph({formula})",
+    "hide:graph({formula})",
+    "show:id",
+    "hide:id",
+    "show:options",
+    "hide:options",
+    "show:pagecount",
+    "hide:pagecount",
+    "show:pcconf",
+    "hide:pcconf",
+    "show:revtype",
+    "hide:revtype",
+    "show:shuffle",
+    "hide:shuffle",
+    "show:status",
+    "hide:status",
+    "show:timestamp",
+    "hide:timestamp",
+    "show:title",
+    "hide:title",
+    "show:topics",
+    "hide:topics",
+    "show:wordcount",
+    "hide:wordcount",
+    "show:facets",
+    "show:statistics",
+    "show:rownumbers"
+  ]
+}

package/src/adapters/hotcrp/index.ts

@@ -11,6 +11,7 @@ export {
 } from "./portal.io.ts";
 export {
   parseCreate,
+  parseOptions,
   parseShow,
   parseUpdate,
   sha256OfHash,

package/src/adapters/hotcrp/portal.io.ts

@@ -12,7 +12,15 @@
  * Create: the same `POST`, with `p=new` and `"pid": "new"` in the object — «Setting `p=new` will
  * create a new submission; the response will contain the chosen submission ID»
  * (`devel/apidoc/submissions.md`, `post /paper`, in kohler/hotcrp). The object carries the title, the
- * abstract, the authors and the PDF; nothing else is sent.
+ * abstract, the authors and the PDF, and the venue's own fields the paper answers.
+ *
+ * Fields: a change and a creation carry the paper's `fields` as submission-object keys, as checked
+ * against the venue preset's `submission_fields` (`topics`: a list of `"Group: Topic"`; measured
+ * 2026-10-20, a bare `"Topic"` is dropped without a word).
+ *
+ * Options: `GET /api/searchcompletion` — the search box's completions, which an author's token may
+ * read; they name every topic as `topic:"<name>"`. (`/api/settings`, which describes the form,
+ * answers "Permission error" to an author.)
  *
  * 🔴 THE TOKEN goes in the `Authorization` header and nowhere else: not into a URL, a message, or an
  * error. A failure is described by HTTP status, HotCRP's own messages, or the network error's text.
@@ -26,7 +34,12 @@ import type {
   SubmissionChange,
 } from "../../domain/submission.ts";
 import type { SubmissionPortal } from "../../ports/submission-portal.ts";
-import { parseCreate, parseShow, parseUpdate } from "./response.ts";
+import {
+  parseCreate,
+  parseOptions,
+  parseShow,
+  parseUpdate,
+} from "./response.ts";
 
 /**
  * The form field the PDF travels in, and the name the `json` object's `content_file` refers to it
@@ -91,6 +104,7 @@ export function changeObject(
     ...(c.pdf === null ? {} : { submission: { content_file: CONTENT_FIELD } }),
     ...(c.abstract === null ? {} : { abstract: c.abstract }),
     ...(c.submit ? { status: "submitted" } : {}),
+    ...c.fields,
   };
 }
 
@@ -112,6 +126,7 @@ export function createObject(
     abstract: p.abstract,
     authors: p.authors.map(authorObject),
     submission: { content_file: CONTENT_FIELD },
+    ...p.fields,
   };
 }
 
@@ -170,5 +185,10 @@ export function hotcrpPortal(o: HotcrpOptions): SubmissionPortal {
       const a = await post(o, { p: "new", object, pdf: paper.pdf, save });
       return a.ok ? parseCreate(a.value.status, a.value.body) : a;
     },
+    async options() {
+      const url = `${o.url}/api/searchcompletion`;
+      const a = await call(url, { method: "GET" }, o.token, READ_TIMEOUT_MS);
+      return a.ok ? parseOptions(a.value.status, a.value.body) : a;
+    },
   };
 }

package/src/adapters/hotcrp/portal.test.ts

@@ -24,6 +24,7 @@ import {
   createObject,
   hotcrpPortal,
   parseCreate,
+  parseOptions,
   parseShow,
   parseUpdate,
   sha256OfHash,
@@ -79,7 +80,12 @@ const server = createServer((req: IncomingMessage, res: ServerResponse) => {
  */
 /** A recorded HotCRP answer (`cassette/README.md`), as the text it was sent as. */
 function cassette(
-  name: "get-paper" | "get-noauth" | "post-dot" | "post-ok",
+  name:
+    | "get-paper"
+    | "get-noauth"
+    | "post-dot"
+    | "post-ok"
+    | "get-searchcompletion",
 ): string {
   return readFileSync(
     new URL(`./cassette/${name}.json`, import.meta.url),
@@ -165,6 +171,17 @@ function partsOf(s: Seen): ReadonlyMap<string, Part> {
   );
 }
 
+test("options: GET /api/searchcompletion with the bearer token → the topics", async () => {
+  seen.length = 0;
+  reply = { status: 200, body: cassette("get-searchcompletion") };
+  const r = await portal().options();
+  const s = last();
+  assert.equal(s.method, "GET");
+  assert.equal(s.url.pathname, "/api/searchcompletion");
+  assert.equal(s.headers.authorization, `bearer ${TOKEN}`);
+  assert.ok(r.ok && r.value.topics.length === 41);
+});
+
 test("show: GET /api/paper?p=<id>&word_limit=hard with the bearer token, parsed whole", async () => {
   seen.length = 0;
   reply = { status: 200, body: cassette("get-paper") };
@@ -263,6 +280,7 @@ const CHANGE: SubmissionChange = {
   pdf: { name: "paper.pdf", bytes: PDF },
   abstract: "new abstract",
   submit: true,
+  fields: {},
 };
 
 test("update: a dry run by default — dry_run=1, the json field, the PDF under its content_file name", async () => {
@@ -359,6 +377,7 @@ const NEW: NewSubmission = {
     { name: "Bob", email: "bob@example.org", affiliation: null },
   ],
   pdf: { name: "paper.pdf", bytes: PDF },
+  fields: {},
 };
 
 test("create: a dry run by default — p=new, dry_run=1, title/abstract/authors and the PDF; no id", async () => {
@@ -545,6 +564,7 @@ test("a portal that does not answer is unreachable, with the network's words", a
     await down.show(7),
     await down.update(7, CHANGE, { save: false }),
     await down.create(NEW, { save: false }),
+    await down.options(),
   ]) {
     assert.equal(!r.ok && r.error.kind, "unreachable");
     assert.ok(!r.ok && r.error.kind === "unreachable" && r.error.detail !== "");
@@ -553,11 +573,92 @@ test("a portal that does not answer is unreachable, with the network's words", a
 
 test("changeObject: only what changes is sent", () => {
   assert.deepEqual(
-    changeObject(7, { pdf: null, abstract: null, submit: false }),
+    changeObject(7, { pdf: null, abstract: null, submit: false, fields: {} }),
     { object: "paper", pid: 7 },
   );
 });
 
+test("changeObject and createObject: the venue's fields go in as submission-object keys", () => {
+  const fields = {
+    topics: ["SE Topic: AI for software engineering"],
+    pc_conflicts: { "pc@example.org": "collaborator" },
+    ACMCorAut: "ada@example.org",
+  };
+  assert.deepEqual(
+    changeObject(7, { pdf: null, abstract: null, submit: false, fields }),
+    { object: "paper", pid: 7, ...fields },
+  );
+  const created = createObject({ ...NEW, fields });
+  assert.deepEqual(
+    [created["topics"], created["pc_conflicts"], created["ACMCorAut"]],
+    [fields.topics, fields.pc_conflicts, fields.ACMCorAut],
+  );
+});
+
+test("🔴 parseOptions: the recorded msr2027 completions → its 41 topics, the 4 group names left out", () => {
+  const r = parseOptions(200, parsed("get-searchcompletion"));
+  assert.ok(r.ok);
+  assert.equal(r.value.topics.length, 41);
+  assert.ok(r.value.topics.includes("SE Topic: AI for software engineering"));
+  assert.ok(r.value.topics.includes("Performance analysis and testing"));
+  assert.ok(!r.value.topics.includes("SE Topic"));
+  // A completion that is no string is no topic.
+  assert.deepEqual(
+    parseOptions(200, {
+      ok: true,
+      searchcompletion: [{ q: "x" }, 'topic:"Only"'],
+    }),
+    { ok: true, value: { topics: ["Only"] } },
+  );
+  // A quote or backslash inside the quoted name comes escaped; the topic is the decoded name.
+  assert.deepEqual(
+    parseOptions(200, {
+      ok: true,
+      searchcompletion: ['topic:"C++ \\"modern\\" a\\\\b"'],
+    }),
+    { ok: true, value: { topics: ['C++ "modern" a\\b'] } },
+  );
+  assert.deepEqual(parseOptions(401, parsed("get-noauth")), {
+    ok: false,
+    error: {
+      kind: "refused",
+      httpStatus: 401,
+      messages: [{ message: "Missing credentials", field: null, status: 2 }],
+    },
+  });
+  assert.deepEqual(parseOptions(200, { ok: true }), {
+    ok: false,
+    error: {
+      kind: "malformed",
+      httpStatus: 200,
+      detail: "the answer has no `searchcompletion`",
+    },
+  });
+});
+
+test("🔴 an HTML message (<5>) is printed as its text, the tags dropped; a plain one (<0>) as it is", () => {
+  const r = parseUpdate(200, {
+    valid: true,
+    message_list: [
+      {
+        status: 1,
+        field: "pc_conflicts",
+        message:
+          '<5>You may have missed conflicts of interest with <a href="#pcconf:1">A B</a>.',
+      },
+      { status: 2, field: "topics", message: "<0>Use <b> sparingly" },
+    ],
+  });
+  assert.ok(r.ok);
+  assert.deepEqual(
+    r.value.messages.map((m) => m.message),
+    [
+      "You may have missed conflicts of interest with A B.",
+      "Use <b> sparingly",
+    ],
+  );
+});
+
 test("sha256OfHash: sha2-<hex> is a sha256; any other hash is not claimed to be one", () => {
   assert.equal(sha256OfHash(`sha2-${HEX}`), HEX);
   assert.equal(sha256OfHash("da39a3ee5e6b4b0d3255bfef95601890afd80709"), null);

package/src/adapters/hotcrp/response.ts

@@ -4,7 +4,8 @@
  * Only the fields the command uses are read; every other key HotCRP sends is dropped here. The field
  * names are HotCRP's (`devel/openapi.json` and `devel/apidoc/submissions.md` in kohler/hotcrp):
  * `GET /api/paper` answers `{ ok, paper, message_list? }`, `POST /api/paper` answers
- * `{ ok, valid, change_list, message_list, dry_run?, pid }`. A document's `hash` is
+ * `{ ok, valid, change_list, message_list, dry_run?, pid }`, `GET /api/searchcompletion` answers
+ * `{ ok, searchcompletion: [<completion>, …] }`. A document's `hash` is
  * `sha2-<64 hex>` when HotCRP stored a sha256; timestamps are Unix seconds.
  */
 import { z } from "zod";
@@ -15,6 +16,7 @@ import type {
   PortalDocument,
   PortalFailure,
   PortalMessage,
+  PortalOptions,
   SubmissionView,
   UpdateOutcome,
 } from "../../domain/submission.ts";
@@ -70,9 +72,15 @@ export function sha256OfHash(hash: string): Sha256 | null {
   return hex === undefined ? null : parseSha256(hex);
 }
 
-/** HotCRP prefixes a message with its format (`<0>` plain text, `<5>` HTML); the text is the rest. */
-const textOf = (message: string | undefined): string =>
-  (message ?? "").replace(/^<\d+>/, "").trim();
+/**
+ * HotCRP prefixes a message with its format (`<0>` plain text, `<5>` HTML); the text is the rest,
+ * an HTML one's tags dropped («You may have missed conflicts of interest with <a href=…>…</a>»).
+ */
+function textOf(message: string | undefined): string {
+  const m = /^<(\d+)>/.exec(message ?? "");
+  const rest = (message ?? "").slice(m?.[0].length ?? 0);
+  return (m?.[1] === "5" ? rest.replace(/<[^>]*>/g, "") : rest).trim();
+}
 
 /** The messages that say something: HotCRP also sends entries with no text, which print as blanks. */
 const messagesOf = (
@@ -200,3 +208,36 @@ export function parseCreate(
     id: saved && typeof pid === "number" ? pid : null,
   });
 }
+
+const OptionsBody = z.object({
+  ok: z.literal(true),
+  searchcompletion: z.array(z.unknown()),
+});
+
+const TOPIC = /^topic:"(.+)"$/s;
+
+/** A quoted search operand with its backslash escapes undone: the name as the form spells it. */
+const unquoted = (quoted: string): string => quoted.replace(/\\(.)/gs, "$1");
+
+/**
+ * `GET /api/searchcompletion` → the topics an author can choose. A completion `topic:"<name>"` names
+ * a topic; a name that only groups others (`SE Topic`, beside `SE Topic: Human aspects`) is not one
+ * a submission can carry — measured 2026-10-20, HotCRP drops it — so it is left out.
+ */
+export function parseOptions(
+  httpStatus: number,
+  body: unknown,
+): Result<PortalOptions, PortalFailure> {
+  const status = statusOf(httpStatus, body);
+  const b = OptionsBody.safeParse(body);
+  if (!b.success || !is2xx(status))
+    return err(refusal(status, body, "the answer has no `searchcompletion`"));
+  const names = b.data.searchcompletion
+    .map((c) => (typeof c === "string" ? TOPIC.exec(c)?.[1] : undefined))
+    .filter((n) => n !== undefined)
+    .map(unquoted);
+  const groups = new Set(
+    names.filter((n) => names.some((x) => x.startsWith(`${n}: `))),
+  );
+  return ok({ topics: names.filter((n) => !groups.has(n)) });
+}

package/src/adapters/hotcrp/site.ts

@@ -1,7 +1,7 @@
 /**
  * A HotCRP site before any token, as the `PortalSite` port: the variable its token is read from,
  * where on the site an author makes one and with which scopes, what `submission new` leaves to the
- * site, a submission's page — and the API, once there is a token. Every word here is HotCRP's.
+ * site (what the venue preset records no field for), a submission's page — and the API, once there is a token. Every word here is HotCRP's.
  */
 import type { PortalSite } from "../../ports/submission-portal.ts";
 import { hotcrpPortal } from "./portal.io.ts";
@@ -25,8 +25,7 @@ export const hotcrpSite = (url: string): PortalSite => ({
       "submeta:read and document:read (show), submeta:write and document:write (update, new) — tick all four to use every subcommand",
   },
   siteOnly: [
-    "PC conflicts (HotCRP's API takes them as pc_conflicts; paperlint does not send them)",
-    "topics, and every field the venue adds (paper type, artifact, consent boxes …)",
+    'every field of the form the venue preset does not record in "submission_fields" (with none recorded: the topics, the PC conflicts, a paper type, consent boxes …)',
   ],
   submissionPage: (id) =>
     `${url}/paper/${id === null ? "<its number>" : String(id)}`,

package/src/cli.ts

@@ -247,6 +247,9 @@ const USAGE = `paperlint — machine-checkable gates for a paper kept in git
                                       send the PDF (default: the paper's own), an abstract, or
                                       "submitted". A DRY RUN unless --save: the portal checks the
                                       change and keeps nothing
+  npx paperlint submission topics [paper]
+                                      the topics the venue's portal offers, against the ones its
+                                      preset records; exit 1 when they differ
   npx paperlint studies new <paper-dir> "<title>" [--kind <kind>]
                                       register a study: the next id in repro/studies.json, the folder
                                       repro/<id>-<slug>/ with its README.md and plan.json (a template),
@@ -291,7 +294,9 @@ studies:
 submission:
   The venue preset declares the portal — "portal": { "kind": "hotcrp", "url": "<site>" } — and the
   paper's paperlint.json its submission there — "submission": { "id": <number> }, written by new
-  — and, for new, its "authors": [{ "name", "email", "affiliation"? }]. The token comes only from
+  — and, for new, its "authors": [{ "name", "email", "affiliation"? }]. Its "fields" answer the
+  form's own fields the preset records in "submission_fields" ({ "topics": [...], "pc_conflicts":
+  { "<pc email>": "<type>" }, … }); new and update send them, checked first. The token comes only from
   the environment, one variable per site: HOTCRP_TOKEN_<subdomain> on *.hotcrp.com, else
   HOTCRP_TOKEN_<host and path> — e.g. HOTCRP_TOKEN_MSR2027 for msr2027.hotcrp.com,
   HOTCRP_TOKEN_AIDC_SUBMIT_ACSAC_ORG for aidc.submit.acsac.org (HotCRP: Account settings →

package/src/domain/submission-fields.test.ts

@@ -0,0 +1,183 @@
+/** A paper's answers to its venue's own form fields: checked against the preset's kinds before anything is sent. */
+import assert from "node:assert/strict";
+import { expect, test } from "vitest";
+import {
+  droppedFields,
+  parsePaperFields,
+  type VenueFields,
+} from "./submission-fields.ts";
+
+/** The fields of an edition's form, as a preset records them (the topics of msr2027, two of them). */
+const VENUE: VenueFields = {
+  source: "portal",
+  url: "https://example.org/api/searchcompletion",
+  read: "2026-10-20",
+  fields: {
+    topics: {
+      kind: "checkboxes",
+      required: true,
+      label: null,
+      options: [
+        "SE Topic: AI for software engineering",
+        "Performance analysis and testing",
+      ],
+    },
+    pc_conflicts: {
+      kind: "pc_conflicts",
+      required: false,
+      label: null,
+      options: [],
+    },
+    ACMCorAut: {
+      kind: "email",
+      required: false,
+      label: "ACM corresponding author",
+      options: [],
+    },
+    note: { kind: "text", required: false, label: null, options: [] },
+  },
+};
+
+test("parsePaperFields: absent on a venue that records no fields → nothing to send; every kind's value passes as given", () => {
+  assert.deepEqual(parsePaperFields(null, null, "msr.jsonc"), {
+    ok: true,
+    value: {},
+  });
+  const fields = {
+    topics: ["SE Topic: AI for software engineering"],
+    pc_conflicts: {
+      "pc@example.org": "collaborator",
+      "chair@example.org": true,
+    },
+    ACMCorAut: "author@example.org",
+    note: "free text",
+  };
+  assert.deepEqual(parsePaperFields(fields, VENUE, "msr.jsonc"), {
+    ok: true,
+    value: fields,
+  });
+});
+
+test("🔴 parsePaperFields: a topic the form does not offer is refused, naming what it offers — before any request", () => {
+  assert.deepEqual(
+    parsePaperFields(
+      { topics: ["AI for software engineering"] },
+      VENUE,
+      "msr.jsonc",
+    ),
+    {
+      ok: false,
+      error:
+        '"fields".topics[0]: "AI for software engineering" is not one of the form\'s options — the form offers: "SE Topic: AI for software engineering", "Performance analysis and testing"',
+    },
+  );
+});
+
+test("🔴 parsePaperFields: each other wrong answer is refused by key", () => {
+  const refused = (v: unknown): string => {
+    const r = parsePaperFields(v, VENUE, "msr.jsonc");
+    return r.ok ? "accepted" : r.error;
+  };
+  assert.equal(
+    refused({ topics: [] }),
+    '"fields".topics: the form requires at least one — the form offers: "SE Topic: AI for software engineering", "Performance analysis and testing"',
+  );
+  assert.equal(
+    refused({
+      topics: [
+        "Performance analysis and testing",
+        "Performance analysis and testing",
+      ],
+    }),
+    '"fields".topics: an option is given twice — the form offers: "SE Topic: AI for software engineering", "Performance analysis and testing"',
+  );
+  assert.equal(
+    refused({ topics: ["Performance analysis and testing"], paper_type: "x" }),
+    '"fields" has "paper_type", which the venue\'s form does not ask (it asks: topics, pc_conflicts, ACMCorAut, note)',
+  );
+  assert.match(
+    refused({
+      topics: ["Performance analysis and testing"],
+      ACMCorAut: "Erdni Zergetaev",
+    }),
+    /^"fields"\.ACMCorAut: /,
+  );
+  assert.match(
+    refused({
+      topics: ["Performance analysis and testing"],
+      pc_conflicts: { "pc@example.org": "" },
+    }),
+    /^"fields"\.pc_conflicts\.pc@example\.org: /,
+  );
+  assert.match(refused({}), /^"fields"\.topics: /);
+  assert.match(refused([]), /^"fields": /);
+});
+
+test("🔴 parsePaperFields: no fields at all, on a venue whose form requires one — refused, not sent empty", () => {
+  const r = parsePaperFields(null, VENUE, "msr.jsonc");
+  expect(r.ok ? "accepted" : r.error).toMatch(/^"fields"\.topics: /);
+});
+
+test("parsePaperFields: an optional checkbox list may be empty; a required text may not", () => {
+  const venue: VenueFields = {
+    ...VENUE,
+    fields: {
+      tags: {
+        kind: "checkboxes",
+        required: false,
+        label: null,
+        options: ["x"],
+      },
+      title2: { kind: "text", required: true, label: null, options: [] },
+    },
+  };
+  expect(parsePaperFields({ tags: [], title2: "t" }, venue, "v")).toStrictEqual(
+    { ok: true, value: { tags: [], title2: "t" } },
+  );
+  const r = parsePaperFields({ title2: "  " }, venue, "v");
+  expect(r.ok ? "accepted" : r.error).toMatch(/^"fields"\.title2: /);
+});
+
+test("🔴 parsePaperFields: fields on a venue whose preset records none — refused, naming where it looked", () => {
+  assert.deepEqual(parsePaperFields({ topics: ["x"] }, null, "msr.jsonc"), {
+    ok: false,
+    error:
+      '"fields" is set, but the venue preset records no "submission_fields" (read: msr.jsonc) — record the form\'s fields in the venue\'s preset first, or drop "fields"',
+  });
+});
+
+test("🔴 droppedFields: a checkbox list sent, missing from the changes and named by the portal — dropped; otherwise not", () => {
+  const sent = { topics: ["Performance analysis and testing"], note: "x" };
+  // Measured on HotCRP 2026-10-20: an unknown topic → `change_list` without `topics`, and
+  // «topics: At least one selection required».
+  assert.deepEqual(
+    droppedFields(sent, VENUE, {
+      changes: [],
+      messageFields: ["topics", "pc_conflicts"],
+    }),
+    ["topics"],
+  );
+  assert.deepEqual(
+    droppedFields(sent, VENUE, {
+      changes: ["topics"],
+      messageFields: ["topics"],
+    }),
+    [],
+  );
+  // The same topics as the portal already holds: no change, and nothing said about them.
+  assert.deepEqual(
+    droppedFields(sent, VENUE, { changes: [], messageFields: [null] }),
+    [],
+  );
+  assert.deepEqual(
+    droppedFields({ topics: [] }, VENUE, {
+      changes: [],
+      messageFields: ["topics"],
+    }),
+    [],
+  );
+  assert.deepEqual(
+    droppedFields(sent, null, { changes: [], messageFields: ["topics"] }),
+    [],
+  );
+});