Skip to content

test(gate-acceptance): a sibling finding in the SAME file satisfies the subject too - #409

Merged
rubenvdlinde merged 3 commits into
mainfrom
fix/gate-acceptance-partial-revert-round2
Aug 12, 2026
Merged

test(gate-acceptance): a sibling finding in the SAME file satisfies the subject too#409
rubenvdlinde merged 3 commits into
mainfrom
fix/gate-acceptance-partial-revert-round2

Conversation

@rubenvdlinde

Copy link
Copy Markdown
Contributor

Revert-audits the last two acceptance bundles nobody had ever tested. #404 closed by asking for exactly this, on the grounds that #380's remedy — one mechanism per named file — is necessary but not sufficient.

debug-and-conflict — sound, unchanged

Four independent partial reverts, four predictions written before their runs, four matched on count and on the identity of the failing assertion. Dropping the whitespace tolerance from the call pattern reddens the Debugger.php row alone; narrowing the construct rule so it can no longer see a bare die; reddens the Terminator.php row alone. Those two lose disjoint findings, which is what proves the rows separable rather than merely both present. Exempting all Markdown reddens conflicted.md; reverting the setext discriminator reddens the clean arm instead — so both over-correction and regression are covered. No fixture change.

a11y-noise — was blind to the regression it exists to pin

FacesCamel.vue was authored to hold only the spellings the old word-boundary noun list could not see. But avatarUrl and avatar_url are two code paths, not one: camelCase splitting versus punctuation splitting. Reverting camelCase splitting alone left avatar_url firing, which kept the file in the log, which satisfied the fixed-string subject match — nine findings became five and the suite stayed green. Two more of the same shape were also green: dropping plain unbound src support, and dropping single-quoted tabindex.

Every full revert was caught. Full-revert-red is the test anybody actually runs, and it is why this survived three audits.

The invariant, one turn further

#404's defect was substring containment between subjects. This one is sibling findings inside one subject. The subject is a file path, and a file path is satisfied by every finding in that file. The construction that is safe by definition is a named file carrying exactly one finding: any mechanism that finding depends on empties the file when lost. Where one finding cannot state the claim, every finding in the file must ride the same code path — and "same code path" means reading the checker, not the fixture's comment.

a11y-noise goes from four rows to seven, with the corpus unchanged — the same nine and three findings, redistributed, so detection is bought without trading away a true positive. All three formerly-green probes now redden exactly one row each and name it, so which row fails tells you which mechanism was lost.

The planted files were renamed because Faces.vue is a prefix of FacesCamel.vue, and only the .vue extension separated the two subjects. Relying on an extension as the terminator is relying on an accident. Pairwise containment is now checked against the real log text, positive-controlled on #404's own corpus first, because a fixed-string search that cannot match reports "no containment" for free.

Two corrections

A sentence in debug-and-conflict/expect.conf claimed a regression would be caught "on the count". The driver never reads a count. This is the same wrong sentence #404 corrected in auth-guards — now found in two bundles written by two authors, so it is a recurring mental model rather than a typo. Fixed in place rather than deleted, because it was load-bearing for somebody's confidence.

COVERED-ELSEWHERE.md credits coverage by gate number while naming the providing suite in prose, and nothing ever resolved that name to a file — even though those rows feed the headline count of fixtured gates. All nineteen named suites exist today, so this check pins a true state rather than reporting a backlog, which is the cheapest moment to pin a registry. Built fail-closed: if fewer than ten names are extracted the check fails rather than reporting success over an empty list, because a check over zero names passes for free — which is the defect it exists to catch. Proven able to fail by renaming one credited suite.

Method

Thirteen probes, thirteen predictions written first, thirteen matched. Every revert quoted its actual changed line from the diff before running; Edit only, no scripted rewriting. The checkers and the runner were restored after every probe and are byte-identical to main — this branch touches only the acceptance fixtures, their expectation files, and the acceptance driver.

Assertions go from 121 to 131, none failing.

Findings: fleet-board/findings/bundle-audit-round2.md.

Conduction Release Bot added 3 commits August 12, 2026 23:54
…he subject too

Revert-audits the last two bundles nobody had ever tested. #404 closed asking
for exactly this, on the grounds that #380's remedy -- one mechanism per named
file -- is necessary but not sufficient.

debug-and-conflict is SOUND and is not changed. Four independent reverts, four
predictions written first, four matched: dropping \s* from _CALL_RX reddens the
Debugger.php row alone (120/1); narrowing _CONSTRUCT_RX to (?=[(]) reddens the
Terminator.php row alone (120/1) -- disjoint findings, which is what proves the
two rows separable; exempting all Markdown reddens conflicted.md (120/1); and
reverting the setext discriminator reddens the CLEAN arm instead (119/2), so
both directions are covered.

a11y-noise was NOT. It went green over the exact regression it exists to pin.
FacesCamel.vue was authored to hold "ONLY the forms the \b-anchored noun list
could NOT see", but avatarUrl and avatar_url are TWO code paths, not one:
_CAMEL_1/_CAMEL_2 versus _NON_ALNUM. Reverting camelCase splitting alone left
avatar_url firing, which kept the file in the log, which satisfied grep -qF:
9 findings -> 5 and the suite printed ALL PASS. Two more of the same shape --
dropping plain `src` support (9 -> 8) and single-quoted tabindex (3 -> 2) --
were also green. Every FULL revert was caught, which is the test anybody runs,
and is why this survived three audits.

The invariant needs one more turn. #404's defect was substring containment
BETWEEN subjects; this one is sibling findings INSIDE one subject. The subject
is a file path, and a file path is satisfied by every finding in that file. The
construction that is safe by definition is a named file carrying exactly ONE
finding: any mechanism it depends on empties the file when lost. Where one
finding cannot state the claim, every finding must ride the same code path --
and "same code path" means read the checker, not the fixture's comment.

  a11y-noise  4 -> 7 rows, corpus UNCHANGED (still 9 + 3 findings, redistributed)
    NounsCamel.vue    camelCase only        NounsSnake.vue    avatar_url only
    NounsPlain.vue    the \b-visible nouns  NounsLiteral.vue  the literal src only
    FocusDouble.vue   tabindex="5"          FocusSingle.vue   tabindex='12'

All three formerly-green probes now redden exactly one row each, naming it, so
which row fails tells you which mechanism was lost. render-helpers.js verified
independently: removing js/ts from gate-36's find reddens that row alone.

The planted files were renamed because Faces.vue IS a prefix of FacesCamel.vue
and only the .vue extension separated the two subjects -- relying on an
extension as the terminator is relying on an accident. Pairwise containment is
now checked against the real log text, positive-controlled on #404's own corpus
first, since a grep -qF that cannot match reports "no containment" for free.

Also corrects a false sentence in debug-and-conflict/expect.conf claiming a
regression "fails here on the COUNT". The driver never reads a count. Same
wrong sentence #404 corrected in auth-guards -- found now in two bundles by two
authors, so it is a recurring mental model, not a typo. Fixed in place because
it was load-bearing for somebody's confidence.

And closes the registry class #405 identified: COVERED-ELSEWHERE.md credits
coverage by gate NUMBER while naming the providing suite in PROSE, and nothing
ever resolved that name to a file -- though those rows feed "58 of 65 gates
fixtured". All 19 named suites exist today, so the check pins a true state
rather than reporting a backlog. Built fail-closed: fewer than 10 extracted
names FAILS rather than reporting success over an empty list, because a check
over zero names passes for free, which is the defect it exists to catch.
Proven able to fail by renaming one credited suite -> 130/1.

Thirteen probes, thirteen predictions written first, thirteen matched on count
AND on the identity of every failing assertion. Every revert quoted its actual
changed line from git diff -U0; Edit only, no sed/awk/perl/python. Checkers and
runner restored after every probe and byte-identical to main.

  assertions 121 -> 131 passed / 0 failed
…ktick ShellCheck reads as a substitution

Two corrections to the COVERED-ELSEWHERE.md resolution check, both found by CI
rather than by me.

ShellCheck flagged SC2016 on the extraction pattern. The pattern anchored on
the backticks the suite names are written in, and a backtick inside a
single-quoted string reads to ShellCheck as a command substitution. Dropped the
anchor. That is also more correct: some rows carry a scripts/lib/ prefix INSIDE
the backticks, which a backtick-anchored pattern would have missed.

⚠️ The first ShellCheck run had FAILED WITHOUT RUNNING -- the action could not
unpack its download ("does not look like a tar archive") -- so it never saw
this. A peer PR hit the identical transient failure eleven minutes earlier and
went green on re-run. Re-running it here surfaced a REAL finding in my own file
that the infrastructure failure had masked. A red that is the harness and a red
that is the code are worth telling apart in both directions.

Then the broadened pattern counted 21 suites where 20 are credited: the intro
prose names this driver itself. Scoped to table rows, which is where the credit
is actually granted, so the number the check reports means what it says. The
negative control was RE-RUN against the changed extraction rather than inherited
from the earlier version -- renaming a credited suite still reddens exactly one
assertion (130/1).

Merges main, which moved twice under this branch and touched the same driver
(#401's verdict-shape matcher) and the same registry (gates 47 and 48).

  60 of 65 gates fixtured -- 131 passed / 0 failed
@rubenvdlinde
rubenvdlinde merged commit e3da410 into main Aug 12, 2026
34 checks passed
@rubenvdlinde
rubenvdlinde deleted the fix/gate-acceptance-partial-revert-round2 branch August 12, 2026 22:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant