paperlint 3.1.0 → 3.1.2

package/skills/verify-citations/scripts/bib-authors.check.test.mjs

@@ -0,0 +1,274 @@
+/**
+ * bib-authors.mjs's comparison (`checkAuthors`) and its reading of DBLP's answer (`dblpHits`).
+ *
+ * `checkAuthors` takes its lookup and its pause as parameters for exactly this: the buckets it
+ * sorts entries into — finding, matched, not applicable, NOT CHECKED — are our logic, and each is
+ * driven here with a lookup that answers on purpose. `dblpHits` is our parser of DBLP's search
+ * JSON; it is fed that documented shape (`result.hits.hit[].info`), which pins how WE read it,
+ * not how DBLP behaves — the colocated bib-authors.test.mjs keeps the live service out of tests.
+ */
+import assert from "node:assert/strict";
+import { afterEach, test, vi } from "vitest";
+import {
+  checkAuthors,
+  claimsPublished,
+  dblpHits,
+  parseBib,
+  surnames,
+} from "./bib-authors.mjs";
+
+afterEach(() => vi.unstubAllGlobals());
+
+const entry = (key, author, title, booktitle = "Proc. X") => ({
+  type: "inproceedings",
+  key,
+  author,
+  title,
+  booktitle,
+  journal: "",
+});
+const hit = (
+  title,
+  authors,
+  venue = "X",
+  type = "Conference and Workshop Papers",
+) => ({
+  title,
+  authors,
+  venue,
+  year: "2024",
+  type,
+});
+
+test("checkAuthors sorts every kind of entry into its bucket", async () => {
+  const parsed = [
+    entry("same", "Ada Lovelace and Alan Turing", "Same Paper"),
+    entry("dropped", "Ada Lovelace", "Dropped Author"),
+    entry("order", "Alan Turing and Ada Lovelace", "Order Swapped"),
+    entry("pre", "Ada Lovelace", "A Preprint", "arXiv preprint"),
+    entry("etal", "Ada Lovelace and others", "Truncated"),
+    entry("nomatch", "Ada Lovelace", "Nobody Has This"),
+    entry("onlycorr", "Ada Lovelace", "Only On CoRR"),
+    entry("down", "Ada Lovelace", "Service Down"),
+    {
+      type: "mdref",
+      key: "sw",
+      unparsed: true,
+      author: "",
+      title: "",
+      booktitle: "",
+      journal: "",
+    },
+  ];
+  const answers = {
+    "Same Paper": [hit("Same Paper.", ["Ada Lovelace", "Alan Turing"])],
+    "Dropped Author": [hit("Dropped Author", ["Ada Lovelace", "Alan Turing"])],
+    "Order Swapped": [hit("Order Swapped", ["Ada Lovelace", "Alan Turing"])],
+    "Nobody Has This": [hit("Something Else", ["X"])],
+    "Only On CoRR": [
+      hit("Only On CoRR", ["Ada Lovelace"], "CoRR", "Informal Publications"),
+    ],
+  };
+  const pauses = [];
+  const result = await checkAuthors(parsed, {
+    lookup: async (title) => {
+      if (title === "Service Down") throw new Error("DBLP 500");
+      return answers[title];
+    },
+    pause: (ms) => pauses.push(ms),
+  });
+  assert.deepEqual(
+    { ...result, pauses },
+    {
+      findings: [
+        {
+          key: "dropped",
+          venue: "X 2024",
+          ours: ["lovelace"],
+          theirs: ["lovelace", "turing"],
+          missing: ["turing"],
+          extra: [],
+          orderDiffers: false,
+        },
+        {
+          key: "order",
+          venue: "X 2024",
+          ours: ["turing", "lovelace"],
+          theirs: ["lovelace", "turing"],
+          missing: [],
+          extra: [],
+          orderDiffers: true,
+        },
+      ],
+      skipped: [
+        {
+          key: "sw",
+          why: "no author/title — a reference to software or a dataset, DBLP does not apply",
+        },
+        {
+          key: "etal",
+          why: "author list ends in `and others` — completeness not checkable",
+        },
+        { key: "nomatch", why: "no DBLP title match" },
+        { key: "onlycorr", why: "only a preprint record on DBLP" },
+      ],
+      unchecked: [{ key: "down", why: "DBLP lookup failed: DBLP 500" }],
+      matched: ["same"],
+      // 900 ms after each compared entry; 1500 and 3000 between the three failed attempts.
+      pauses: [900, 900, 900, 1500, 3000],
+    },
+  );
+});
+
+test("a lookup that fails once and then answers is retried, not reported", async () => {
+  let calls = 0;
+  const result = await checkAuthors([entry("k", "Ada Lovelace", "Flaky")], {
+    lookup: async () => {
+      if (calls++ === 0)
+        throw Object.assign(new Error("DBLP 429"), { retryable: true });
+      return [hit("Flaky", ["Ada Lovelace"])];
+    },
+    pause: () => {},
+  });
+  assert.deepEqual(result, {
+    findings: [],
+    skipped: [],
+    unchecked: [],
+    matched: ["k"],
+  });
+});
+
+test("the default pause really waits", async () => {
+  vi.useFakeTimers();
+  try {
+    const done = checkAuthors([entry("k", "Ada Lovelace", "T")], {
+      lookup: async () => [hit("T", ["Ada Lovelace"])],
+    });
+    await vi.advanceTimersByTimeAsync(900);
+    assert.deepEqual((await done).matched, ["k"]);
+  } finally {
+    vi.useRealTimers();
+  }
+});
+
+/** A stubbed fetch that answers every request with `status` and `body`, recording the URLs. */
+function fakeDblp(status, body) {
+  const urls = [];
+  vi.stubGlobal("fetch", async (url) => {
+    urls.push(url);
+    return new Response(body === undefined ? null : JSON.stringify(body), {
+      status,
+    });
+  });
+  return urls;
+}
+
+test("dblpHits reads DBLP's hit list: one author or several, the disambiguation number dropped", async () => {
+  const urls = fakeDblp(200, {
+    result: {
+      hits: {
+        hit: [
+          {
+            info: {
+              title: "One",
+              venue: "ICSE",
+              year: "2024",
+              type: "Conference and Workshop Papers",
+              authors: { author: { text: "Ada Lovelace 0001" } },
+            },
+          },
+          {
+            info: {
+              title: "Two",
+              authors: { author: [{ text: "A B" }, { text: "C D" }] },
+            },
+          },
+          { info: {} },
+          {},
+        ],
+      },
+    },
+  });
+  assert.deepEqual(
+    { hits: await dblpHits("a title"), urls },
+    {
+      hits: [
+        {
+          venue: "ICSE",
+          year: "2024",
+          type: "Conference and Workshop Papers",
+          title: "One",
+          authors: ["Ada Lovelace"],
+        },
+        {
+          venue: "",
+          year: "",
+          type: "",
+          title: "Two",
+          authors: ["A B", "C D"],
+        },
+        { venue: "", year: "", type: "", title: "", authors: [] },
+        { venue: "", year: "", type: "", title: "", authors: [] },
+      ],
+      urls: ["https://dblp.org/search/publ/api/?q=a%20title&format=json&h=6"],
+    },
+  );
+});
+
+test("dblpHits: no hits is an empty list; 429 is retryable; other errors are not", async () => {
+  fakeDblp(200, {});
+  const none = await dblpHits("x");
+  fakeDblp(429);
+  const limited = await dblpHits("x").catch((e) => [e.message, e.retryable]);
+  fakeDblp(500);
+  const down = await dblpHits("x").catch((e) => [e.message, e.retryable]);
+  assert.deepEqual(
+    [none, limited, down],
+    [[], ["DBLP 429", true], ["DBLP 500", undefined]],
+  );
+});
+
+test("parseBib reads quoted and bare field values, and a field that is absent", () => {
+  assert.deepEqual(
+    parseBib(
+      '@article{k, author = "Ada Lovelace", title = {T}, journal = J, }',
+    ),
+    [
+      {
+        type: "article",
+        key: "k",
+        author: "Ada Lovelace",
+        title: "T",
+        booktitle: "",
+        journal: "J",
+      },
+    ],
+  );
+});
+
+test("parseBib: braces nested inside a value, and a bare last value with no comma after it", () => {
+  assert.deepEqual(
+    parseBib("@article{k, title = {The {BERT} Model}, journal = J}"),
+    [
+      {
+        type: "article",
+        key: "k",
+        author: "",
+        title: "The {BERT} Model",
+        booktitle: "",
+        journal: "J",
+      },
+    ],
+  );
+});
+
+test("surnames of nothing is nothing; a name with an empty family part contributes nothing", () => {
+  assert.deepEqual(
+    [surnames(""), surnames(", Ada and Lovelace")],
+    [[], ["lovelace"]],
+  );
+});
+
+test("an entry naming no venue at all does not claim to be published", () => {
+  assert.equal(claimsPublished({ booktitle: "", journal: "" }), false);
+});

package/skills/verify-citations/scripts/bib-authors.cli.test.mjs

@@ -0,0 +1,178 @@
+/**
+ * bib-authors.mjs as a process: which file it picks from a paper directory, the three
+ * bibliography sources it reads (.bib, a .tex's filecontents or its sibling refs.bib, a markdown
+ * reference list), and the report and exit code for each outcome. DBLP is a preload that answers
+ * by title from a table (the documented `result.hits.hit[].info` shape) — no network.
+ */
+import assert from "node:assert/strict";
+import { join } from "node:path";
+import { dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { test } from "vitest";
+import { runNode, useTempDir, writeTree } from "../../../test/support.mjs";
+
+const SCRIPT = join(dirname(fileURLToPath(import.meta.url)), "bib-authors.mjs");
+const root = useTempDir("bib-authors-cli-");
+
+const DBLP_ANSWERS = {
+  "Dropped Author": [["Ada Lovelace", "Alan Turing"]],
+  "Swapped Order": [["Ada Lovelace", "Alan Turing"]],
+  "All Good": [["Ada Lovelace"]],
+};
+const bib = (key, author, title, venue = "booktitle = {Proc. X}") =>
+  `@inproceedings{${key}, author = {${author}}, title = {${title}}, ${venue}}\n`;
+
+writeTree(root, {
+  // The retry backoff (1.5 s, then 3 s) and the 900 ms courtesy pause are real sleeps in the
+  // script. Under CPU load they made "DBLP down" take 11.7 s once and time out. The preload
+  // stands in for the clock too: every timer fires at once, so no test here depends on time.
+  "dblp.mjs":
+    "const realSetTimeout = globalThis.setTimeout;\n" +
+    "globalThis.setTimeout = (fn, _ms, ...args) => realSetTimeout(fn, 0, ...args);\n" +
+    `const answers = ${JSON.stringify(DBLP_ANSWERS)};\n` +
+    "globalThis.fetch = async (url) => {\n" +
+    "  const q = new URL(url).searchParams.get('q');\n" +
+    "  if (q === 'Service Down') return new Response(null, { status: 500 });\n" +
+    "  const hit = (answers[q] ?? []).map((authors) => ({ info: { title: q, venue: 'X', year: '2024',\n" +
+    "    type: 'Conference and Workshop Papers', authors: { author: authors.map((text) => ({ text })) } } }));\n" +
+    "  return new Response(JSON.stringify({ result: { hits: { hit } } }), { status: 200 });\n};\n",
+  "findings/paper.bib":
+    bib("dropped", "Ada Lovelace and Grace Hopper", "Dropped Author") +
+    bib("order", "Alan Turing and Ada Lovelace", "Swapped Order"),
+  "findings/other.bib": bib("never", "X", "Never Read"),
+  "twotex/b.tex": "\\documentclass{article}\n",
+  "twotex/a.tex":
+    "\\begin{filecontents*}{refs.bib}\n" +
+    bib("pre", "Ada Lovelace", "A Preprint", "journal = {arXiv preprint}") +
+    "\\end{filecontents*}\n",
+  "sibling/paper.tex": "\\documentclass{article}\n",
+  "sibling/refs.bib": bib("good", "Ada Lovelace", "All Good"),
+  "nobib/paper.tex": "\\documentclass{article}\n",
+  "md/paper.md":
+    "# P\n\n## References\n\n1. A. Lovelace. *All Good.* Proc. X, 2024.\n2. some-npm-package, https://npm.example\n",
+  "down/refs.bib": bib("down", "Ada Lovelace", "Service Down"),
+  "empty/.keep": "",
+});
+
+const run = (...args) => {
+  const r = runNode(SCRIPT, args, {
+    nodeArgs: ["--import", join(root, "dblp.mjs")],
+  });
+  return {
+    ...r,
+    stdout: r.stdout.replaceAll(root, "<root>"),
+    stderr: r.stderr.replaceAll(root, "<root>"),
+  };
+};
+
+test("refusals: no argument, no such path, a directory with nothing to read, a .tex with no bibliography", () => {
+  assert.deepEqual(
+    [
+      run(),
+      run(join(root, "nope")),
+      run(join(root, "empty")),
+      run(join(root, "nobib", "paper.tex")),
+    ].map(({ status, stdout, stderr }) => ({ status, stdout, stderr })),
+    [
+      {
+        status: 2,
+        stdout: "",
+        stderr:
+          "bib-authors: usage: bib-authors.mjs <paper-dir|file.bib|file.tex> [--json]\n",
+      },
+      {
+        status: 2,
+        stdout: "",
+        stderr: "bib-authors: no such path: <root>/nope\n",
+      },
+      {
+        status: 2,
+        stdout: "",
+        stderr: "bib-authors: no .bib, .tex or paper.md in <root>/empty\n",
+      },
+      {
+        status: 2,
+        stdout: "",
+        stderr:
+          "bib-authors: no bibliography found in <root>/nobib/paper.tex (no filecontents block, no refs.bib beside it)\n",
+      },
+    ],
+  );
+});
+
+test("a paper directory: the canonical paper.bib is read, and each difference is printed — FAIL, exit 1", () => {
+  assert.deepEqual(run(join(root, "findings")), {
+    status: 1,
+    stderr: "",
+    stdout: [
+      "== bib-authors: <root>/findings/paper.bib ==",
+      "",
+      "  🔴 dropped  (DBLP: X 2024)",
+      "     MISSING from ours : turing",
+      "     EXTRA in ours     : hopper",
+      "",
+      "  🔴 order  (DBLP: X 2024)",
+      "     ORDER differs",
+      "       ours : turing > lovelace",
+      "       DBLP : lovelace > turing",
+      "",
+      "-- 2 entries · 2 difference(s) · 0 not applicable · 0 NOT CHECKED",
+      "FAIL: our author list disagrees with the version we claim to cite.",
+      "",
+    ].join("\n"),
+  });
+});
+
+test("two .tex files and no paper.tex: the first by name, said out loud; its filecontents is read", () => {
+  const r = run(join(root, "twotex"), "--json");
+  assert.deepEqual(
+    { status: r.status, stderr: r.stderr, report: JSON.parse(r.stdout) },
+    {
+      status: 0,
+      stderr:
+        "⚠️ <root>/twotex holds several .tex files and no canonical paper.tex: a.tex, b.tex — took a.tex. If that is the wrong one, name the file explicitly.\n",
+      report: {
+        file: "<root>/twotex/a.tex",
+        entries: 1,
+        findings: [],
+        skipped: [],
+        unchecked: [],
+      },
+    },
+  );
+});
+
+test("a .tex with no filecontents reads the refs.bib beside it — PASS, exit 0", () => {
+  const r = run(join(root, "sibling", "paper.tex"));
+  assert.deepEqual(r, {
+    status: 0,
+    stderr: "",
+    stdout:
+      "== bib-authors: <root>/sibling/refs.bib ==\n\n-- 1 entries · 0 difference(s) · 0 not applicable · 0 NOT CHECKED\nPASS: no author-list disagreement.\n",
+  });
+});
+
+test("a markdown reference list: a software entry is not applicable, not dropped", () => {
+  const r = run(join(root, "md"));
+  assert.deepEqual(r, {
+    status: 0,
+    stderr: "",
+    stdout:
+      "== bib-authors: <root>/md/paper.md ==\n" +
+      "  · n/a ref2 — no author/title — a reference to software or a dataset, DBLP does not apply\n\n" +
+      "-- 1 entries · 0 difference(s) · 1 not applicable · 0 NOT CHECKED\nPASS: no author-list disagreement.\n",
+  });
+});
+
+test("DBLP down: NOT CHECKED, PARTIAL, exit 2 — never a pass", () => {
+  const r = run(join(root, "down"));
+  assert.deepEqual(r, {
+    status: 2,
+    stderr: "",
+    stdout:
+      "== bib-authors: <root>/down/refs.bib ==\n" +
+      "  ⚠️ NOT CHECKED down — DBLP lookup failed: DBLP 500\n\n" +
+      "-- 1 entries · 0 difference(s) · 0 not applicable · 1 NOT CHECKED\n" +
+      "PARTIAL: no disagreement among the entries reached, but 1 could not be checked — this is NOT a pass.\n",
+  });
+});

package/skills/verify-citations/scripts/bib-authors.mjs

@@ -28,11 +28,10 @@
  *
  * ⚠️ Discovery credit and a deliberate NON-dependency: this class was found by running
  * `rebiber` (yuchenlin/rebiber), which rewrites bib entries to their DBLP records. We do
- * NOT depend on it here. Two reasons, both practical: its install needs a Python toolchain
- * that fights modern setuptools (bibtexparser wheel fails with `AttributeError:
- * install_layout`; the workaround is vendoring a tarball), and its output REPLACES entries
- * with DBLP's very long official booktitles, which is wrong for a page-limited paper. What
- * we actually needed was the comparison, and that is one HTTPS call with no dependencies.
+ * NOT depend on it here. Re-measured 2026-09-27 on 1.4.0 (GitHub b917e36): it installs cleanly
+ * now but carries 409 MB of venue data, its bundled data still misses entries live DBLP finds,
+ * and what it does is REWRITE an entry — we need the comparison of an author list against the
+ * published record, and that is one HTTPS call with no dependencies.
  *
  * 🔴 The normalisation below is load-bearing, not tidiness. A first cut of this comparison
  * reported 13 mismatches on our bibliography, of which ELEVEN were "Last, First" vs
@@ -278,7 +277,8 @@ export function surnames(authorField) {
     .filter((s) => s && s !== "others");
 }
 
-const truncated = (authorField) => /\band\s+others\b/i.test(authorField || "");
+// Only called for an entry that has an author (checkAuthors filters on it first).
+export const truncated = (authorField) => /\band\s+others\b/i.test(authorField);
 
 /** Is the entry claiming a PUBLISHED venue (as opposed to a preprint)? */
 export function claimsPublished(e) {

package/skills/verify-citations/scripts/verify-cites.cli.test.mjs

@@ -0,0 +1,160 @@
+/**
+ * verify-cites.mjs as a process — the way the verify-citations skill runs it, which is THROUGH A
+ * SYMLINK (`.claude/skills/verify-citations -> …/skills/verify-citations`, made by `paperlint
+ * init`). Only `--offline` runs here: the online resolvers are driven in-process with a fake
+ * `fetch` (verify-cites.net.test.mjs), because a test must not depend on four live APIs.
+ */
+import assert from "node:assert/strict";
+import { readFileSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { test } from "vitest";
+import { runNode, useTempDir, writeTree } from "../../../test/support.mjs";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const root = useTempDir("verify-cites-cli-");
+// The skill's own address for the script: a link to the skill directory, as `paperlint init` makes.
+symlinkSync(join(HERE, ".."), join(root, "verify-citations"));
+const LINKED = join(root, "verify-citations", "scripts", "verify-cites.mjs");
+
+test("run through the skill's symlink, the CLI runs at all (--help prints the usage)", () => {
+  assert.deepEqual(runNode(LINKED, ["--help"]), {
+    status: 0,
+    stdout: "",
+    stderr: "usage: verify-cites.mjs <cites.json | refs.bib | -> [--offline]\n",
+  });
+});
+
+const SCRIPT = join(HERE, "verify-cites.mjs");
+const CACHE = join(root, "cache.json");
+const env = { VERIFY_CITES_CACHE: CACHE };
+writeTree(root, {
+  "cites.json": JSON.stringify([
+    { id: "a", doi: "10.1/x", title: "A Title Of Some Length" },
+    { title: "no id at all" },
+    { id: "h", title: "Hygiene", commit: "abc123" },
+  ]),
+  "one.json": JSON.stringify({ id: "solo", title: "Just One Citation" }),
+  "refs.bib": "@article{k, title={A Bib Title}, doi={10.2/y}, year={2020}}\n",
+  "bad.json": "{ not json",
+  // Loaded with --import before the script: every registry answers 404, so a DOI the authority
+  // does not know is FALSE — the one verdict that fails the run.
+  "fetch-404.mjs":
+    "globalThis.fetch = async () => new Response(null, { status: 404 });\n",
+  // Prints the User-Agent of every request, then answers 404.
+  "fetch-ua.mjs":
+    "globalThis.fetch = async (url, init) => {\n" +
+    "  process.stderr.write(`UA ${init.headers['User-Agent']}\\n`);\n" +
+    "  return new Response(null, { status: 404 });\n};\n",
+  "consumer/paperlint.json": JSON.stringify({ contactEmail: "me@example.org" }),
+});
+const offline = (args, opts = {}) =>
+  runNode(SCRIPT, [...args, "--offline"], { env, ...opts });
+const parsed = (r) => ({ ...r, stdout: JSON.parse(r.stdout) });
+const SUMMARY_PASS = (n, t, u, flagged) =>
+  `\nverify-cites: ${n} citation(s) — ${t} true, 0 false (fabrication), ${u} unresolvable` +
+  (flagged ? `, ${flagged} with hygiene flag(s)` : "") +
+  "\nPASS — no fabrication (unresolvable is advisory)\n";
+
+test("-h is --help", () => {
+  assert.equal(
+    runNode(SCRIPT, ["-h"]).stderr,
+    runNode(SCRIPT, ["--help"]).stderr,
+  );
+});
+
+test("an input that cannot be read: exit 2, named", () => {
+  const r = offline([join(root, "bad.json")]);
+  assert.deepEqual(
+    { status: r.status, stdout: r.stdout, stderr: r.stderr.split(" — ")[0] },
+    { status: 2, stdout: "", stderr: "error: could not read input" },
+  );
+});
+
+test("offline over a JSON list: a citation with no id is unresolvable by name, a short SHA is flagged", () => {
+  const r = parsed(offline([join(root, "cites.json")]));
+  assert.deepEqual(
+    {
+      status: r.status,
+      ids: r.stdout.map((x) => [x.id, x.verdict, x.flags?.length ?? 0]),
+      stderr: r.stderr,
+    },
+    {
+      status: 0,
+      ids: [
+        ["a", "unresolvable", 0],
+        [null, "unresolvable", 0],
+        ["h", "unresolvable", 1],
+      ],
+      stderr: SUMMARY_PASS(3, 0, 3, 1),
+    },
+  );
+});
+
+test("one JSON object on stdin, with `-` and with no path at all", () => {
+  const input = readFileSync(join(root, "one.json"), "utf8");
+  const dash = parsed(offline(["-"], { input }));
+  const bare = parsed(offline([], { input }));
+  assert.deepEqual(
+    [dash.stdout.map((x) => x.id), bare.stdout.map((x) => x.id), dash.status],
+    [["solo"], ["solo"], 0],
+  );
+});
+
+test("a .bib file is parsed into citations", () => {
+  const r = parsed(offline([join(root, "refs.bib")]));
+  assert.deepEqual(
+    r.stdout.map((x) => x.id),
+    ["k"],
+  );
+});
+
+test("online, a DOI the authority does not know is FALSE: FAIL, exit 1, and the cache is written", () => {
+  rmSync(CACHE, { force: true });
+  const r = runNode(SCRIPT, [join(root, "refs.bib")], {
+    env,
+    nodeArgs: ["--import", join(root, "fetch-404.mjs")],
+  });
+  assert.deepEqual(
+    {
+      status: r.status,
+      verdicts: JSON.parse(r.stdout).map((x) => x.verdict),
+      tail: r.stderr.trim().split("\n").pop(),
+      cached: Object.keys(JSON.parse(readFileSync(CACHE, "utf8"))).sort(),
+    },
+    {
+      status: 1,
+      verdicts: ["false"],
+      tail: "FAIL — fabrication(s) found (exit 1)",
+      // 404s are successful transports, so they are cached; the authority's 100 is not.
+      cached: [
+        "crossref:doi:10.2/y",
+        "openalex:doi:10.2/y",
+        "semantic_scholar:doi:10.2/y",
+      ],
+    },
+  );
+});
+
+test("a corrupt cache is ignored, and a cache that cannot be written does not fail the run", () => {
+  writeFileSync(CACHE, "{ corrupt");
+  const corrupt = offline([join(root, "one.json")]);
+  const unwritable = runNode(SCRIPT, [join(root, "one.json"), "--offline"], {
+    env: { VERIFY_CITES_CACHE: root }, // a directory: reading and writing both fail
+  });
+  assert.deepEqual([corrupt.status, unwritable.status], [0, 0]);
+});
+
+test("the consumer's declared contact reaches every request's User-Agent (Crossref's polite pool)", () => {
+  const r = runNode(SCRIPT, [join(root, "refs.bib")], {
+    env: { ...env, CLAUDE_PROJECT_DIR: join(root, "consumer") },
+    nodeArgs: ["--import", join(root, "fetch-ua.mjs")],
+  });
+  const agents = new Set(
+    r.stderr.split("\n").filter((l) => l.startsWith("UA ")),
+  );
+  assert.deepEqual(
+    [...agents],
+    ["UA verify-cites/1.0 (citation gate; mailto:me@example.org)"],
+  );
+});