3926 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
timothy	4ba56848f6	Merge pull request 'fix(931): a missing semgrep fails the security-scan release gate' (#933) from 931-scan-semgrep-fail into main	2026-10-29 23:52:54 +00:00
timothyandClaude Opus 5.5	f71e2fd0d0	docs(931): a failing setup command's exit is its own status, and the Hosts row names no excluded host ... The exit list gave "any other code" to a set -e setup failure, but `docker pull` usually exits 1, which collides with the ZAP FAIL code; it now says such a failure exits with that command's own status. The jazz Hosts row said the scan runs "not [on] this one", which would stay wrong once jazz gets semgrep; it now says any docker host that meets the requirements. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: f9ce6bc6-5b36-491a-8d72-89c1f70dd3e1	2026-10-30 00:03:24 +01:00
timothyandClaude Opus 5.5	0e64328ca2	docs(931): state the scan host's requirement instead of naming hosts, and every script exit ... Round-3 review: the Security scanning section named bumblebee (has semgrep) and jazz (needs it) with no date or source, the Exit-code contract still said the script exits 0 for clean/WARN and 1 for FAIL, the exit-2 sentence said only the SAST half, and the --selftest sentence claimed more main-path coverage than it pinned. - Security scanning drops host names: the requirement is a docker host with registry access, a checkout of the commit under test (semgrep scans the checkout the script lives in), and semgrep on the non-interactive PATH, or the opt-out plus a separate SAST run. - The Exit-code contract lists 0/1/2/other; 2 is "a scanner half did not run" (semgrep missing or erroring, or docker missing). The --selftest sentence names exactly the cases it pins, now including the main-path ones. - The Hosts table and release step 2 sent the scan to jazz. That dates from d6aec6de7 (2026-07-20), which moved it there with the transcoders, but the scan boots its own throwaway target from the registry and needs nothing jazz-local. Step 2 now states the requirement, with the one measured host dated and sourced (bumblebee, 2026-10-27, server-management#1072). jazz had no semgrep when measured 2026-10-27, so following the old step would fail the gate with exit 2. - Edited prose rewrapped to the section's ~105 columns. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: f9ce6bc6-5b36-491a-8d72-89c1f70dd3e1	2026-10-30 00:03:24 +01:00
timothyandClaude Opus 5.5	2e4de81309	fix(931): pin the main-path semgrep block in --selftest and state every exit the script produces ... Round-3 review found two clause mutants of the main path surviving the selftest: the sg_rc check forced true (M9) and the main-path opt-out widened to any non-empty value (M10). The present case was pinned only through require_semgrep, and no full shimmed run used a semgrep that succeeds. --selftest now runs the script end to end with shimmed docker/curl/timeout (ZAP clean) and a semgrep shim that records each call: succeeding (unset and =0) -> exit 0 with semgrep run; failing -> exit 2; explicit opt-out with semgrep present -> exit 0 with semgrep not run. Witnessed red: M9 fails two cases, M10 fails the skip=0 case, and forcing the main-path skip off (`if false`) fails the opt-out case; M1-M8 stay red. The header's exit contract claimed exit 2 always meant the SAST half did not run, but a missing docker also exits 2. It now lists 0/1/2/other, with 2 as "a scanner half did not run", and the host line states the requirement instead of naming bumblebee. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: f9ce6bc6-5b36-491a-8d72-89c1f70dd3e1	2026-10-30 00:03:24 +01:00
timothyandClaude Opus 5.5	e04f75e9ec	docs(931): name the host that can pass the SAST gate and the script's own exit 2 ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: f9ce6bc6-5b36-491a-8d72-89c1f70dd3e1	2026-10-30 00:03:24 +01:00
timothyandClaude Opus 5.5	3f7febf656	fix(931): pin the script's own exit in --selftest and fail the gate on a semgrep that errors ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: f9ce6bc6-5b36-491a-8d72-89c1f70dd3e1	2026-10-30 00:03:24 +01:00
timothyandClaude Opus 5.5	f21dc121d3	fix(931): a missing semgrep fails the security-scan release gate instead of warning and exiting 0 ... The SAST half is now required: require_semgrep exits 2 naming the tool before the image pull; ETV_SCAN_SKIP_SEMGREP=1 stays the only skip. --selftest pins absent, opt-out and present. docs/ci-cd.md states the invariant, not the stale host claim. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: f9ce6bc6-5b36-491a-8d72-89c1f70dd3e1	2026-10-30 00:03:24 +01:00
timothy	bcf6f7e04d	Merge pull request 'fix(935): script-tests jq tripwire accepts {1.6, 1.7} until server-management#1080' (#938) from 935-jq-repin-17 into main	2026-10-29 23:03:05 +00:00
timothyandClaude Opus 5.5	403bf011c1	fix(935): repoint the superseded jq key, re-wrap the preflight header, reword the floor note ... ci.jq-version-contract is archived; verdict-write-retarget-fence.md and defect-shapes-773.md now name its successor ci.jq-accepted-version-set. jq-preflight.sh: the two ragged header paragraphs are re-wrapped, and the MIN_VERSION note names the runner fleet and server-management#1080 instead of a single CI runner. Decisions-Edit: yes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: f9ce6bc6-5b36-491a-8d72-89c1f70dd3e1	2026-10-29 22:57:52 +01:00
timothyandClaude Opus 5.5	00424bf090	fix(935): pin the run: key in the wiring test, drop a dangling record key, reword a stale runner claim ... Decisions-Edit: yes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: f9ce6bc6-5b36-491a-8d72-89c1f70dd3e1	2026-10-29 22:45:02 +01:00
timothyandClaude Opus 5.5	8acba80a1a	fix(935): state the measured fact (both hosts 1.7 on 2026-10-28), not an unmeasured mixed fleet ... The fleet is uniform on jq 1.7 per the job logs; 1.6 stays in the set only because the image tag is unpinned. Real-jq 1.6 coverage is currently absent, and the shims cover only the empty-input -e quirk, not the NUL or parse-error ones. Measurement dated by the job date. Remaining "runner's jq 1.6" comments reworded. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: f9ce6bc6-5b36-491a-8d72-89c1f70dd3e1	2026-10-29 22:26:09 +01:00
timothyandClaude Opus 5.5	41d604f0ae	fix(935): script-tests jq tripwire accepts exactly {1.6, 1.7} until server-management#1080 pins the fleet ... jq-preflight.sh --expect takes a comma-separated set (validated whole, exact major.minor membership); pr-checks.yml passes 1.6,1.7. Both small runners float on runner-images:ubuntu-latest, so the fleet's jq is a function of pull history (1.7 measured on PR #933 job 12347 and PR #934 job 12360, 2026-10-29). New record ci.jq-accepted-version-set supersedes ci.jq-version-contract (archived); docs/ci-cd.md, the script header and runner-ships-1.6 comments now state the dated invariant. review-verdict.yml stays floor-only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: f9ce6bc6-5b36-491a-8d72-89c1f70dd3e1	2026-10-29 21:38:38 +01:00
timothy	e919b925f8	Merge pull request 'docs(release): record the v26.16.0 release notes' (#930) from release/v26.16.0-notes into main	2026-10-27 19:39:48 +00:00
timothyandClaude Opus 5.5	e61bbb63b5	docs(ci-cd): the security scan names its real host, and a skipped semgrep pass is not a passed one ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: 99d1dedb-f027-4e05-baab-2111f3a7d951	2026-10-27 20:07:02 +01:00
timothyandClaude Opus 5.5	e458630f48	docs(release): v26.16.0 notes record the .NET 10.0.14 runtime and the release scan ... The tag build picked up MCR's 10.0.14 aspnet/sdk images (published 2026-10-26), measured inside :26.16.0. ZAP and semgrep results are recorded as triaged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: 99d1dedb-f027-4e05-baab-2111f3a7d951	2026-10-27 20:06:42 +01:00
timothyandClaude Opus 5.5	bdd4ed7bad	docs(release): the v26.16.0 cut verifies the positive half of the v* tag protection ... release.tag-protection-v-star deferred its positive verification to the next real cut. The v26.16.0 tag push as `timothy` succeeded on 2026-10-27, and GET tag_protections the same day showed rule id 1 unchanged since 2026-09-04, so the push ran with the rule in force. The record and both ci-cd.md caveats now say so. That a renovate push is refused remains unverified. Decisions-Edit: yes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: 99d1dedb-f027-4e05-baab-2111f3a7d951	2026-10-27 19:30:36 +01:00
timothyandClaude Opus 5.5	02aa05d75b	docs(release): record the v26.16.0 release notes ... Range 736649b3b..1f7b763a7 (v26.15.0 was cut at 736649b3b, not at main's head, because of #887). Headline: Jellyfin music videos play again (#924/#928). Also carries the #880 recurrence fix that slipped from v26.15.0, and the #887 image-build fix. No migrations and no dependency bumps. Two advisories published after v26.15.0 are carried unchanged and tracked in #929. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: 99d1dedb-f027-4e05-baab-2111f3a7d951	2026-10-22 08:25:09 +02:00
timothyandClaude Opus 5.5	1f7b763a7b	fix(924): media-server music videos read their statistics from the server's playback info (#928) ... Jellyfin's library-items projection builds every music video's MediaVersion with Streams = [] and no width/height; the server reports those only through per-item PlaybackInfo. MediaServerMusicVideoLibraryScanner.UpdateStatistics wrote that empty projection straight through (also removing any streams a stored row already had), so every Jellyfin music video was stored without streams and FFmpegStreamSelector.SelectVideoStream threw "Sequence contains no matching element" on play. Prod 2026-10-21: the Jellyfin "Music Videos" library (id 16), 1520/1520 versions with zero MediaStream rows. - UpdateStatistics mirrors the movie scanner: on deep scan, new item, changed etag or no stored streams it asks the abstract GetMediaServerStatistics, and writes nothing when the server cannot answer. - JellyfinMusicVideoLibraryScanner implements it via GetPlaybackInfo; chapters come from the incoming projection. - SelectVideoStream fails with the version id, file and remediation (deep scan, or remove a file that has no video stream) instead of a bare First() throw. - Other-video and TV scanners checked: no such gap. - Record scan.mediaserver-statistics-from-server. Existing rows heal only on a DEEP scan (a regular scan skips unchanged etags): POST /api/v1/libraries/16/scan?deep=true after deploy. fixes #924 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: 99d1dedb-f027-4e05-baab-2111f3a7d951 Co-authored-by: Timothy <timothy@noreply.gitea.tblindustries.be> v26.16.0	2026-10-22 06:24:18 +00:00
timothyandClaude Fable 5.1	b8ea62bfa0	fix(568): reject unknown channel graphicsElementIds with 422 and discriminate builtIn by the seeded path, not the filename (#922) ... fixes #568 refs #74, #917, #921 Decisions-Edit: yes Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 20:52:18 +00:00
timothyandClaude Fable 5.1	fcdc381246	docs(568): the rule the branch establishes gets a record, and every row the fix moved is re-measured ... api-conventions.md now says which half of an id-list validator a sibling field may gate (existence, never the raw-count cap) and that a lost-race recovery re-asks the whole validator set rather than the fields whoever wrote the catch remembered. Those, with the bound and the field-named 422, are one convention with residuals, so they get a record -- api.top-level-id-list-validation -- and a task-signal row. The record states what #568 does NOT settle: three validators on two DTOs is a per-field constant, not the repo-wide rule #917 owns, and it says to expect #917 to replace the mechanism. graphics-elements.md: rows 35-44 re-measured against the whole ErsatzTV.Tests project on this tree, because the fix moved five of their red sets -- Validate is now also what the recovery path re-runs, so removing a validator from it reddens that handler's race test too. Rows 45-47 are new and measured the same way. The "redden more than one test" figure is recounted from the table (21 -> 24); the cross-fixture set is unchanged at five. The negative discriminator rows now carry a stated seeding rule: vary one half of the identity and hold the other at the seeded value. Varying both leaves the row rejected by the pre-#568 predicate as well, so a composite revert to it would pass every test at that site. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 21:35:15 +02:00
timothyandClaude Fable 5.1	9fc54fed87	fix(568): the raw-count cap is the request's bound, and a recovery path re-asks the whole validator set ... Two holes the review round found in the previous fix, both of the same shape: a guard that names its own fields instead of deriving them. The deco validators short-circuited the entire Validators.IdsMustExist call when the DecoMode does not consume the ids, which took the 512-item raw-count cap with it -- an arbitrarily large array under Inherit/Disable parsed and materialized with nothing bounding it. Only the EXISTENCE half is the apply path's business, so the mode predicate is now a required argument of the shared validator and gates that half alone; the cap runs under every mode. The channel recovery path rechecked GraphicsElementIdsMustExist alone, so a watermark deleted between validation and SaveChangesAsync still surfaced as the unhandled 500 the fix exists to remove -- WatermarkId, FFmpegProfileId, FallbackFillerId and MirrorSourceChannelId are all written by the same save and lose the same race. Both handlers now re-ask the whole of Validate on DbUpdateException, so a validator added later is covered without editing the recovery path. The API-site outside-folder discriminator test seeded an Image row, so the Kind conjunct rejected it whatever the path comparison did: a composite revert to Path.GetFileName(path) == filename && kind == Text passed every API test. It now carries the seeded Kind, mirroring the seeder-site twin, so only the path half can reject it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 21:35:15 +02:00
timothyandClaude Fable 5.1	3541683c99	docs(568): re-measure every mutation row the merged identity and the shared validator moved ... Nine rows of the mutation table in docs/graphics-elements.md name a clause that this branch's last commit moved, merged or gave new callers, and a red set is a measurement of the tree it ships in. All were re-taken against the whole ErsatzTV.Tests project (2139 tests, 6 skipped) on the code as it now stands, and four new rows added for the clauses the fix introduced. What moved and why the numbers changed: - Row 10 was the seeded-path filter alone. `Kind` now lives inside `IsOnNowNext`, so dropping the lookup's `Where` drops both halves at once and reddens four tests, not three. - Row 18 was the seeder's SQL `Kind == Text` filter and is now the `kind` conjunct of the shared predicate, so it reddens the API site too — a second cross-fixture row. - Rows 35-37 pick up the count-cap tests, since the cap rides in the validator they disarm. Rows 33, 34, 38, 39 re-measured unchanged. - Row 40's mutation text follows the API call's new two-argument shape; it reddens the new wrong-kind test as well. - Rows 41-44 are the new clauses: the raw-count cap (one clause, three call sites, which is what its red set shows), the diagnostic-id truncation, and the two lost-race catches. The two self-counted figures above the table were recounted from the table itself rather than adjusted: twenty-one multi-test rows and five cross-fixture ones (13, 18, 22, 33, 41). The deco lost-race test is renamed so no two rows cite the same test name. api-conventions.md gains the three rules the fix establishes for any write path with a top-level FK id list — bound the raw list, name the field, translate a lost check-then-write race — in the handler-hardening checklist where they belong rather than as a #568 anecdote. Refs #568 Decisions-Edit: yes Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 21:35:15 +02:00
timothyandClaude Fable 5.1	e7f794057d	fix(568): bound the client-supplied id lists, name their field, and make Kind part of the built-in identity ... Three of the four findings standing on the 2026-09-05 16:24 review verdict, which the branch had not answered. The count cap is the blocking one. The three id-list validators took whatever the request carried, so the only bound on `graphicsElementIds`/`watermarkIds` was the Kestrel body cap -- a transport limit, not a collection limit. The earlier disposition deferred it to #917 on the grounds that `ApplyUpdateRequest` reconciles the same list uncapped anyway; that is true and does not answer the ask, because the reconcile is downstream of a validator that can refuse the request outright. One shared `Validators.IdsMustExist` now carries the cap for all three, counted on the RAW list before `Distinct` (a million copies of one id costs the same to parse and materialize whatever the distinct count is) and before any database work. The same helper is where the field name and the diagnostic cap now live. The 422 said "Graphics element(s) do not exist: 999" without naming which request field carried the 999, and echoed every rejected id -- an oversized request answered with an oversized response. Both fixed once, in the shared place, so the three sites cannot drift. `Kind` moves into `GraphicsElementDefaults.IsOnNowNext`. The seeder required `Kind == Text` and the API's `builtIn` did not, so an Image row at the exact seeded path was `builtIn:true` on the wire while `GetBuiltInElementId` refused to treat it as the built-in element -- two sites disagreeing about one row, which is the shape #568 exists to close. Identity is now one predicate applied whole at both sites; the seeder's SQL `Kind` filter is gone rather than kept as a duplicate, since a duplicate guard would mask the predicate's own clause. Also the fourth finding, the check-then-write race: `RefreshGraphicsElements` can delete a validated element between `Validate` and `SaveChangesAsync`, handing the join insert the FK violation the validator exists to prevent. A transaction does not close it -- neither provider locks rows the validator merely read -- so both handlers catch `DbUpdateException`, re-ask the existence question on a fresh context, and return the validator's own 422 when an id has since gone; anything else keeps its own exception. Foreign keys are off in `InMemoryTvContext`, so the trigger is simulated by an armed save-failure interceptor while the recovery itself runs against real post-delete state. Refs #568 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 21:35:15 +02:00
timothyandClaude Fable 5.1	722f0057e8	docs(568): bound the "cannot fail" claim to the two rows that measure it ... The sentence explaining why the wrong-kind-and-wrong-folder case is not shipped said "no single-clause mutation can let it through" — an unbounded quantifier over a population nothing here measures. What is actually established is narrower and is established: rows 10 and 18 are the two clauses of `GetBuiltInElementId`, each measured, and dropping either leaves the other rejecting such a row. The claim now says that, and names those rows as its evidence. Refs #568 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 21:35:15 +02:00
timothyandClaude Fable 5.1	a8240aba72	docs(568): point the deco-validator aside at the carve-out that is above it, not below ... The §8 Channel-graphics aside cited the deep-FK-in-a-nested-list exception as "below"; that exception is §3b line 314 and the aside is line ~944, so the pointer sent the reader the wrong way. It now names the section (§3b above) rather than a direction alone, so a later reflow cannot invert it again. Re-wrapped the same passage so `deep-FK-in-a-nested-list` no longer straddles a soft line break — Markdown joins those with a space and the term rendered with a stray gap mid-word. Refs #568 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 21:35:15 +02:00
timothyandClaude Fable 5.1	7fa223a567	test(568): drop the different-kind case no single-clause mutation can redden, and measure the API-site clause ... `Ignores_A_Same_Named_Element_Of_A_Different_Kind` seeded an Image row at `/templates/image/on-now-next.yml` and asserted the backfill ignores it. Under the bare-filename lookup that row was rejected by the `Kind == Text` filter alone, which is what its comment described. Under the full-path predicate the path rejects it first, so neither clause is load-bearing for it: dropping the `Kind` filter reddens only `A_Row_Of_Another_Kind_At_The_Seeded_Path_Does_Not_Suppress_The_Built_In_Row` (row 18) and dropping `IsOnNowNext` reddens only the three tests of row 10. The test survived both and its comment claimed a mechanism it no longer exercised. Its scenario is the conjunction of two already-pinned negatives and is strictly weaker than `Ignores_A_Same_Named_Same_Kind_Element_Outside_The_Seeded_Folder`, so it is retired rather than reshaped, and graphics-elements.md now says why the combination is deliberately not shipped — otherwise the next reader re-adds it. Row 40 records the API-side half of the discriminator, which had a measured red and no row. Measured whole-project on this tree, `dotnet test ErsatzTV.Tests/ErsatzTV.Tests.csproj`: baseline `Failed: 0, Passed: 2123, Skipped: 6, Total: 2129`; with `BuiltIn = GraphicsElementDefaults.IsOnNowNext(e.Path)` reverted to `Path.GetFileName(e.Path) == GraphicsElementDefaults.OnNowNextFileName`, `Failed: 1, Passed: 2122`, the sole red being `GetAllGraphicsElementsForApi_Should_Not_Mark_Same_Filename_Outside_Seeded_Folder_As_BuiltIn`. The table's two self-counts were recounted from the table after adding the row and both still hold: sixteen rows redden more than one test, three of those span two fixture classes (13, 22, 33). Refs #568 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 21:35:15 +02:00
timothyandClaude Fable 5.1	9f0f21ec52	docs(568): measure the five validator mutation claims the tests assert in prose ... Five test comments asserted "reddens if <validator> alone is removed" with nothing binding the sentence to a measurement -- the shape testing.mutation-claims-are-executed refuses, and the shape whose CLAIMS half of the manifest cannot reach a .NET proof. The repo's record for those is the mutation table, so each claim got a row: all five mutated in turn against this tree with the whole ErsatzTV.Tests project re-run (the tuple-arity fix included, since a mutation that does not compile is not a result). 35 GraphicsElementIdsMustExist out of UpdateChannelHandler.Validate -> 2 red; 36/37 the deco graphics/watermark validators out of UpdateDecoHandler.Validate -> 1 red each; 38/39 the two Consumes* mode gates -> 1 red each. Sixteen rows now redden more than one test; three still span two fixture classes. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 21:35:15 +02:00
timothyandClaude Fable 5.1	c249ca4110	test(568): bind the test's mutation claim to the measured rows, not to itself ... The comment asserted an outcome ("also reddens if the Kind filter is dropped") with nothing tying it to a measurement -- the shape testing.mutation-claims-are- executed exists to refuse. Both clauses it covers are rows of the mutation table in docs/graphics-elements.md, measured against this tree; cite them. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 21:35:15 +02:00
timothyandClaude Fable 5.1	41fd1f64de	docs(568): re-measure the rows the seeder's lookup call moved, and recount the table's own claims ... The seeder now resolves the built-in row through GetBuiltInElementId, which puts that lookup on a second call path, so every row whose clause the new call can reach was re-run against this tree: 10 and 33 unchanged, 18 reinstated (the Kind == Text filter has a red now that a wrong-kind row at the seeded path can suppress the row the lookup needs), 21 unchanged, 22 gains a third red, and 34 is new (the existence check re-derived as SQL instead of asking the lookup). Two stale measurements went with it. The "known clauses with no red" bullet for the Kind filter quoted 2121 passed against a tree that produces 2123, having been taken before the branch's last two tests existed -- the whole bullet is gone now that the clause has a red. And the per-fixture-filter trap counted thirteen multi-test rows with two spanning two fixture classes, true on origin/main and false here since the branch added rows: fifteen and three, both recounted from the table, with a note that they are. Decisions-Edit: yes Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 21:35:15 +02:00
timothyandClaude Fable 5.1	74a6e01712	fix(568): the seeder asks the built-in lookup, instead of re-deriving it in SQL ... EnsureBuiltInElementRow decided whether the built-in row already existed with its own `AnyAsync(e => e.Path == target)` -- the one discriminator site left comparing in SQL after 28827a7d3 moved the rest in memory. Two ways it could answer differently from GetBuiltInElementId, each leaving the built-in element undiscoverable for the life of the install: string equality in SQL is the provider's collation to decide, so on MySQL's normally case-insensitive default a case-variant row satisfied the check and the canonical row was never created; and it ignored Kind, so a row of another kind at the seeded path suppressed the Text row the lookup resolves. Ask GetBuiltInElementId instead, so the existence question and the resolution question are the same code. The wrong-kind half is observable under SQLite and is now pinned; the collation half is not (BINARY and an ordinal comparison agree on every input) and stays held by keeping the comparison out of SQL. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 21:35:15 +02:00
timothyandClaude Fable 5.1	1149d96eff	test(568): the watermark mode-gate test starts from an actual attachment ... Its graphics twin seeds an element, attaches it, then saves with Inherit and an unknown id, so "the join is empty afterwards" distinguishes a cleared attachment from one that was never there. The watermark half asserted the same emptiness on a deco that had no watermarks to begin with -- true of the fixture regardless of what the handler did, which is a fixture that omits the field it means to test. Seed a ChannelWatermark, attach it under Override, then save with Disable and watermarkId 777. Re-measured 2026-09-05 with the ConsumesWatermarkIds guard removed alone from the committed tree: 1 failed / 4 passed, the failure being Should_Ignore_An_Unknown_WatermarkId_When_The_Mode_Does_Not_Consume_It. Whole project green with the guard in place: 2123 passed, 6 skipped, 0 failed. Refs #568 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 21:35:15 +02:00
timothyandClaude Fable 5.1	cb11116d4f	docs(568): stable row ids in the mutation table, and the case-sensitivity sign-off the issue's wording invites ... Two review findings, both about docs the branch already rewrote. The mutation-coverage table in docs/graphics-elements.md ended up with two rows numbered 24 -- the new IsOnNowNext row was inserted after 23 without checking what followed -- while 18 was vacated when the Kind-filter row moved to the "no red" list. The section's own prose cites rows by number ("the IsOnNowNext clause (row 10)"), so a duplicate id makes a citation ambiguous. The new row becomes 33, the next unused number, and the rule that made it 24 in the first place is now written down: a row number is an identity, not a position, so a new row takes the next unused number, nothing is renumbered, and a retired clause leaves its number vacant rather than having it reused under a new meaning. Both row claims were re-measured and are unchanged; only the id moves. #568's second half is titled "builtIn discriminator is filename-only, case-sensitive, folder-agnostic", and the branch removes the first and third while deliberately keeping case sensitivity -- which reads like two thirds of a done-when box. It is not: the remedy the same box prescribes, "full seeded relative path", is exactly as case-sensitive as the filename match it replaces, so the three adjectives describe one predicate rather than name three separable demands. Read the other way the box would be unsatisfiable by its own remedy. The reason case sensitivity is kept -- a case-INsensitive test hands the built-in identity to a user element differing from the seeded path only in case -- lived only in GraphicsElementDefaults.cs, where a reader arriving from the issue title would not find it. It is now in the active record that owns the discriminator. Refs #568 Decisions-Edit: yes Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 21:35:15 +02:00
timothyandClaude Fable 5.1	0e92c147a4	fix(568): a deco validator may only reject ids the apply path would consume ... Review found the new UpdateDecoHandler FK validators ran unconditionally while ApplyUpdateRequest reads either id list ONLY under DecoMode.Override or Merge -- under Inherit/Disable it Clear()s the join and ignores the field. So the branch turned a previously-succeeding save into a 422 over ids that were about to be discarded, and the SPA reaches that shape: DecosScreen's toReplaceRequest sends watermarkIds/graphicsElementIds from the draft whatever the mode selector says, while the picker itself is disabled off-Override. RefreshGraphicsElementsHandler deletes rows whose template file is gone (cascading the join away), so a stale editor draft could be locked out of saving a deco back to Inherit, with a 422 naming an element the disabled UI does not even show. Measured before the fix on the review's E2E instance: PUT /api/v1/decos/1 with graphicsElementsMode=Inherit and graphicsElementIds=[999] returned 422 "Graphics element(s) do not exist: 999". The mode predicate is now named once per collection -- ConsumesWatermarkIds / ConsumesGraphicsElementIds -- and read by both the apply path and its validator, rather than the apply path holding one copy and the validator implying another. A second copy is what let the two disagree in the first place. Two tests pin the gate, one per collection, each reddening when its guard alone is removed: Should_Ignore_An_Unknown_GraphicsElementId_When_The_Mode_Does_Not_Consume_It Should_Ignore_An_Unknown_WatermarkId_When_The_Mode_Does_Not_Consume_It Measured 2026-09-05, each guard removed alone from the committed tree: 1 failed / 4 passed, and the failure is exactly the test named for that guard. Both assert the apply-path outcome as well as the accept, so a validator that stopped rejecting for some other reason would not satisfy them. Refs #568 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 21:35:15 +02:00
timothyandClaude Fable 5.1	ae314aa5ea	docs(568): re-measure the built-in lookup's mutation rows against the code as it now stands ... The mutation-coverage table's claims were measured against an earlier shape of GetBuiltInElementId and are re-taken here, because the lookup changed twice on this branch (filename -> seeded path, then SQL -> in-memory IsOnNowNext) and a claim about which tests a mutation reddens does not survive either move on its own. Measured 2026-09-05, each mutation applied alone to the committed tree: - Row 10, the seeded-path filter removed: 3 red, not the 2 the row listed. Ignores_A_Case_Variant_Of_The_Seeded_Path joins the two already named, because without the filter every Text row resolves as the built-in one. - Row 24 is new: IsOnNowNext loosened from Ordinal to OrdinalIgnoreCase reddens exactly the two case-variant tests, 2 failed / 77 passed. One row covers both discriminator sites because they now share the predicate. - The Kind==Text filter's "no red" bullet is re-measured across the WHOLE ErsatzTV.Tests project -- 2121 passed, 6 skipped, 0 failed -- rather than the 11 tests of the one file that names GetBuiltInElementId. ChannelGraphicsDefaults reaches the lookup from the channel-create handlers as well, so the narrower population could not have seen a red there. The conclusion is unchanged; what changes is that it is now measured over the population that could falsify it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 21:35:14 +02:00
timothyandClaude Fable 5.1	131c63f7f4	fix(568): one ordinal identity predicate for the built-in element, applied in memory at both sites ... The branch moved the `builtIn` discriminator from a bare filename to the full seeded path, but split how the two sites evaluate it: the API handler compares in memory (ordinal) while GetBuiltInElementId's new `.Where(e => e.Path == OnNowNextSeededPath)` compares in SQL. GraphicsElement.Path takes no explicit collation -- TvContext.OnModelCreating pins one only on the listed name/title columns -- so SQLite answers that case-sensitively and MySQL uses the server default, which is normally case-INsensitive. On MySQL the two discriminators could therefore disagree about the same row: AttachOnNowNextByDefault would resolve a case-variant user element as the built-in one while the API reported builtIn:false for it. Collapse both onto GraphicsElementDefaults.IsOnNowNext, ordinal, applied in memory. GetBuiltInElementId goes back to loading the Text candidates and filtering in memory (the shape it had before this branch), keeping only the `Kind` enum filter in SQL. The prose claimed more than the code did. "A filename-only comparison is case-sensitive-by-accident" appeared in four places as a defect the full-path fix removed; a full-path comparison is exactly as case-sensitive, so the clause said nothing and implied a fix that had not happened. Case sensitivity is now deliberate and stated as such -- the built-in element is the exact file the seeder wrote, at the exact path it wrote it to -- and the reason the comparison is kept out of SQL is recorded where the predicate lives. docs/decisions/records/graphics/channel-level-attachment.md said BuiltIn was "computed by comparing the row's `Path` to GraphicsElementDefaults. OnNowNextFileName", which was true of neither the pre-#568 rule (filename to filename) nor the current one; an active record resolved by key now states the current predicate in its own sentence rather than in a parenthetical. Two tests pin the ordinal rule against a loosening to OrdinalIgnoreCase, one per site. Measured: OrdinalIgnoreCase reddens exactly GetAllGraphicsElementsForApi_Should_Not_Mark_A_Case_Variant_Of_The_Seeded_Path_As_BuiltIn and Ignores_A_Case_Variant_Of_The_Seeded_Path, 2 failed / 77 passed of the 79 graphics tests. They do NOT pin provider independence -- under SQLite's BINARY collation an equivalent SQL comparison answers identically, so no test in this suite can distinguish the two. That is stated at each site rather than left for a reader to assume the tests cover it. Decisions-Edit: yes Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 21:35:14 +02:00
timothyandClaude Fable 5.1	352305ade8	fix(568): sync docs/comments to the seeded-path builtIn discriminator, harden UpdateDecoHandler's twin FK ids ... Review round on #568 found the branch changed builtIn identity from a bare filename comparison to the full seeded path (GraphicsElementDefaults. OnNowNextSeededPath) but left several places still asserting the old rule: - docs/decisions/records/graphics/channel-level-attachment.md and on-now-next-on-by-default.md (both status: active) still described a filename-only match; corrected in place and cross-referenced. - docs/api-conventions.md §8 quoted the retired `Path.GetFileName(element.Path) == OnNowNextFileName` expression verbatim; replaced with the current OnNowNextSeededPath comparison and a note on the UpdateChannelHandler 422 hardening. - Three in-code comments (GraphicsElementDefaults.cs, GraphicsElementSeeder.cs, ChannelGraphicsDefaults.cs) still said "identity is the filename". - docs/graphics-elements.md's mutation-coverage table (row 10, row 18) named clauses that no longer exist or no longer redden any test post-#568; re-measured directly (removing the seeded-path check reddens Ignores_A_Non_Built_In_Element_With_A_Different_Filename and Ignores_A_Same_Named_Same_Kind_Element_Outside_The_Seeded_Folder; removing the Kind==Text filter alone reddens nothing, so it moves to the "known clauses with no red" list with that measurement dated). Also closed the should-fix twin: UpdateDecoHandler's graphicsElementIds and watermarkIds are top-level ReplaceDecoRequest fields in the same position as UpdateChannelRequest.graphicsElementIds (not the deep-FK-in-a-nested-list carve-out), and the reconcile in ApplyUpdateRequest blindly Added a join row for any incoming id -- the identical FK-constraint-to-500 defect #568 fixed on the channel path. Added GraphicsElementIdsMustExist/WatermarkIdsMustExist validators mirroring UpdateChannelHandler's, pinned by UpdateDecoGraphicsElementsTests (reddens when either validator alone is removed -- verified). Decisions-Edit: yes Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 21:35:14 +02:00
timothyandClaude Fable 5.1	c84bdd2427	docs(568): record the full-seeded-path builtIn discriminator in graphics-elements.md ... Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 21:35:14 +02:00
timothyandClaude Fable 5.1	900dac9832	fix(568): reject unknown channel graphicsElementIds with 422; discriminate builtIn by seeded path not filename ... UpdateChannelHandler.Validate never checked incoming graphicsElementIds against GraphicsElements, so PUT /api/v1/channels/{id} with a non-existent id hit FK_ChannelGraphicsElement_GraphicsElement_GraphicsElementId at SaveChangesAsync and surfaced as an unhandled 500. Add GraphicsElementIdsMustExist, following the existing FFmpegProfileMustExist/WatermarkMustExist/FillerPresetMustExist shape, so an unknown id now returns 422 for parity with every other FK field on this full-replace DTO. GetAllGraphicsElementsForApiHandler and GraphicsElementSeeder.GetBuiltInElementId keyed builtIn off Path.GetFileName(e.Path) == OnNowNextFileName -- folder-agnostic, so a user element named exactly on-now-next.yml in any other template folder would also report builtIn:true. Both now compare against GraphicsElementDefaults.OnNowNextSeededPath, the full path the seeder actually writes to. Follow-up from the #74 whole-branch review (2026-07-22), deferred as data-safe/not SPA-reachable. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 21:35:14 +02:00
timothyandClaude Fable 5.1	8cda92748e	docs(901): a predicate over an artifact whose grammar it does not implement pins the artifact whole; a shape-matcher is the exception that argues for itself (#920) ... fixes #901 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 19:29:44 +00:00
timothyandClaude Fable 5.1	022a05acb2	docs(901): the third count had no in-repo source, so it becomes what both cited artifacts say ... The thesis measurement quoted three numbers side by side. Two are verbatim from the corpus — `docs/guard-inventory.md:179` "wrong NINE times", and `scripts/tests/test_image_build_delegates_the_spa_suite.py:772` "defeated seven measured ways". The third, "a lexical rule over a hook preamble **five**", was reachable only from #901's own issue body ("Five spellings, one mechanism"); nothing in the repo re-derives it, and both artifacts the record cites for #891 — `docs/decisions/records/process/hook-resolves-inputs-from-repo-root.md:64-68` and `scripts/tests/test_hook_fire_log.py:144` — count the SAME sequence as three ("Three successive lexical rules over this line each fell"). Counted as spellings it is eight or nine; five is neither basis. A number in prose that no artifact re-derives is this record's own subject matter, and "Measured 2026-08-30" invites trust rather than re-derivation. Answered by subtraction, not by new prose: - body: the third clause states what both cited artifacts state — three successive lexical rules, each defeated by the next shape. - `rule:` drops the copied numeric triple ("nine, seven and five times") for a pointer to the sequences below, so the counts live in one place (`dont-keep-a-copy-of-a-set`). - `signals:` swaps the unsourced token for the sourced one. Same class, found while checking the neighbours: "would have licensed the parser above through most of nine rounds" (`rule:` and body) counted #887's NINE DEFECTS as rounds — guard-inventory records them as nine defects across THREE cold-review rounds. Now "most of those nine defects". Body stays 58 lines; the paragraph is reflowed at the file's existing width. Refs #901 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 19:47:05 +02:00
timothyandClaude Fable 5.1	81358dec5a	docs(901): the acceptance hole belongs to the REJECTED splitter, so the clause claiming a second one is deleted ... `dc3f158bc` corrected a false universal ("this arm's errors are refusals, never acceptances") and, in the same sentence, appended a second unmeasured fail-direction claim: "and the `split(\"\\n\")` residual below is the second acceptance of the same kind". That clause inverts the paragraph it points at. MEASURED, by loading the module and calling its own primitives with `CANONICAL_SINK_ASSIGNMENT + \x0c + "rm -rf /tmp/nothing"` on one physical line followed by `CANONICAL_SINK_SOURCE`: instrumentation_faults(...) -> "the sink preamble is not the canonical two lines" splitlines() selection == [CANON, SOURCE] -> True (ACCEPTS) split("\n") selection == [CANON, SOURCE] -> False (REFUSES) The shipped `split("\n")` refuses exactly where the rejected `splitlines()` accepts, which is what the pre-existing paragraph six lines below already says. There is no second acceptance below; the acceptance belongs to the alternative that was NOT shipped. `\x0c` is not a line terminator for bash either, so `split("\n")` matches the shell the checker models and has no hole of this kind. The FIRST half of the sentence stands and was re-measured: a hook carrying the two canonical lines plus `v="ETV_HOOK_FIRE""_LIB=/tmp/evil.sh"; eval "$v"` produces no preamble fault, so the selector really does accept a writer that never spells the literal. Answered by SUBTRACTION per the brief: the sentence ends at "not all refusals." and no replacement prose is written. `dc3f158bc`'s message argues from the same inversion ("the comment already conceded an acceptance hole of the same kind six lines later"); that half of its reasoning is withdrawn here. Its correction of the universal is unaffected — the selector escape it names is structural and independently measured, above. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 19:05:31 +02:00
timothyandClaude Fable 5.1	20875b0ca7	docs(901): answer round seven by SUBTRACTION — the thesis loses both absolutes, the list loses two copies ... Round seven's blocker was the record's own thesis sentence, and the fix is to delete rather than to re-argue. Six rounds each replaced a refuted absolute with a fresh one; this one states only what was measured. THE THESIS (body). Struck: "a pin cannot be defeated by a respelling of what it COMPARES" and "nothing [stays exposed] for a whole-file pin". Both are false for the record's own worked whole-file pin — measured against the guard's own primitives: _normalise_lines("const flag = '--run --reporter=x';") == _normalise_lines("const flag = '--run --reporter=x';") -> True _normalise('RUN npm ci && echo "a b"') == _normalise('RUN npm ci && echo "a b"') -> True Both pairs differ in bytes and both are respellings of what the pin compares. `PINNED_VITE_CONFIG` — the pin the record calls "pinned WHOLE" — is compared through `_normalise_lines`, so its normalisation is a second exposure axis beside the selector's. The record already refuted itself twice: `rule:` ends "A pin also declares its NORMALISATION and what the normalisation cannot see", and `mechanics:` says the whitespace collapse "including inside a QUOTED STRING" belongs to both TEXT pins. What replaces the sentence is the fail DIRECTION alone — a pin's is a false RED, a shape-matcher's a false GREEN — plus the declaration obligation the rule already carries. No new universal is written in its place. MECHANICS. "named once so the checker, the mutation proofs and the hooks cannot come to mean different strings" is deleted, not repaired: the assignment string is written out at THREE sites in `test_hook_fire_log.py` (measured by walking the AST and comparing each assembled string to `CANONICAL_SINK_ASSIGNMENT` — the constant, and the `current` local of `test_an_ENV_VAR_resolved_sink_path_is_DETECTED` and of `test_the_NEXT_env_var_to_be_invented_is_DETECTED`). The source comment making the same claim is corrected in place, and its correction is STRUCTURAL: it names the three sites and the `current in text` assertion each proof carries, and asserts no mutation outcome, because "an edit here faults loudly there" would be a `CLAIMS` entry under `testing.mutation-claims-are-executed` — wherever it is written — or it is not written. Same reason `4d5bd0dbb` removed the outcome claim from `mechanics:` rather than binding it. THE QUALIFYING-GRAMMAR LIST now exists once, in the record's `rule:`. `docs/README.md` and `docs/guard-inventory.md` state the operative test — an artifact with a grammar the predicate does not implement — and point at the record. The copies had already disagreed inside the commit that wrote them: `docs/README.md` carried five of the six members, omitting JSON5, which is the member the issue's own correction comment names as the one the narrow "shell or config TEXT" framing would have let through (`dont-keep-a-copy-of-a-set`, #869). Rider 1 drops its copy of the vite `DEFAULT_CONFIG_FILES` ordering the same way, deferring to the dated reading in the `test_image_build_delegates_the_spa_suite.py` row. Gate: `pytest scripts/tests -q` 1599 passed, 3 skipped (all pre-existing by-design skips); `decisions_validate.py` OK with the record off the >60-line list; catalog regenerated with no diff; ruff clean; `check-doc-narrative --diff origin/main` 0 warnings. Refs #901 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 18:38:20 +02:00
timothyandClaude Fable 5.1	dc3f158bcb	docs(901): #885 merged, so the sentence the record's structural fact refutes is corrected at its source ... `scripts/tests/test_hook_fire_log.py:154` ended "this arm's errors are refusals, never acceptances". That is false for the SELECTION, which is the half this branch's record is about: `mentions` is chosen by the literal `ETV_HOOK_FIRE_LIB`, so a writer of that variable which never spells the literal is outside the compared set altogether, and the checker never sees it. The comment already conceded an acceptance hole of the same kind six lines later, about `split("\n")` versus `splitlines()`, so the universal was contradicted inside its own block. The correction stays STRUCTURAL — it reads the selector one line below and says what the selector reaches — and makes no claim about what a mutated hook would return. An outcome claim would be a `CLAIMS` entry in `scripts/tests/mutation_manifest.py` or nothing, per `testing.mutation-claims-are-executed` as amended by #881, which is the same reason `mechanics:` states the selector rather than a measured result (`4d5bd0dbb`). WHY THIS LANDS NOW: #885 closed while this branch was in review (merged as #919, `c30847204`), which frees `scripts/tests/`. Of the two obligations `47619320e` recorded as owed, that message is superseded here: - DISCHARGED: this one, inline, above. - NOT OWED, and the reason is not the blocker: the `CLAIMS` entry for the hook-preamble selector. `4d5bd0dbb` removed the outcome claim from `mechanics:` rather than binding it, so the record asserts no mutation outcome and the rule it invokes has nothing to bind. Re-adding a claim in order to bind it would reverse a review-mandated change; an executed GREEN entry (target `.claude/hooks/decisions-guard.sh`, clause = the canonical sink assignment, replacement = that line plus the `eval` spelling, plus the mandatory `reach_replacement`/`reach_expect`) remains available as an ENRICHMENT of the structural fact, and belongs to whoever wants the fact executed rather than argued. Rebased onto `366a0f904..c30847204` on the way: the `docs/guard-inventory.md` conflict is two rows, resolved by taking #885's newer `test_workflow_persist_credentials.py` row (it gained a second invariant) and this branch's `test_image_build_delegates_the_spa_suite.py` row (it dates the vite `DEFAULT_CONFIG_FILES` reading to 8.1.3 and to the lockfile). `docs/decisions/README.md` regenerated, not merged. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 16:01:18 +02:00
timothyandClaude Fable 5.1	868ab657d8	docs(901): the record was wrapped narrower than its own corpus, so 65 lines was a WRAP width, not a word count ... `798e5ee40` stopped at 65 prose lines and gave a reason: the remaining candidates for removal were the *why* behind non-obvious choices, which `docs.no-session-narrative` says to keep. That reason is sound about the WORDS and wrong about the LINE COUNT, because the two are not the same quantity. `decisions_validate.record_prose_lines` counts PHYSICAL lines, and this record was the narrowest thing in the set being measured: max body width, 222 active records: median 106; 28 at <=100, 154 at 101-120, 40 >120 this record: 100. The sibling it cites by key, process.hook-resolves-inputs-from-repo-root: 116. The 60-line ceiling was derived at #620 from that distribution, so measuring a 100-column record against it charges the record for a wrap width the corpus does not use. Re-wrapping the seven body paragraphs at 116 — the exact width of the neighbour record — takes the body from 66 physical lines to 58, and the validator now reports 58, off the over-ceiling list (50 records over -> 49, and the key no longer appears). The reflow removes NOTHING: the script asserted word count equal before and after (893) and whitespace-normalised body text byte-identical, and refused to write otherwise. What it buys is that the issue's `## Done-when` box "The record is under the 60-line advisory prose ceiling" is satisfiable as written, so `pretooluse-merge-consent.sh` is not asked to derive consent from a box ticked falsely or left standing. The advisory itself was never breached — the ceiling is a `::warning::`, the validator exits 0, and 49 of 222 records are over it inside the 2-25% CEILING_MINORITY band. Also: the file was the only one of 222 records with no final newline. Fixed in the same commit; `record_prose_lines` is `splitlines()`, so it does not move the count. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 15:59:16 +02:00
timothyandClaude Fable 5.1	11f92761af	docs(901): the whitespace collapse belongs to the PRIMITIVE, so it belongs to both text pins ... `mechanics:` opened with a universal — "a residual read off one of them does not transfer to the others" — and then attributed the collapse-whitespace-inside-a-string residual to `_normalise_lines` alone. It does transfer, between exactly the two pins that sentence separates: `_normalise_lines` is `_normalise` applied per line (`scripts/tests/test_image_build_delegates_the_spa_suite.py:327`), and the stage-command pin calls `_normalise` directly (lines 386/389, compared at line 586), so it cannot see a whitespace change inside a quoted shell string either. For SHELL text that is the more consequential of the two residuals, which is the opposite of what the old ordering implied. The sentence now says NEED NOT transfer, names the one that does, and puts the string-literal blindness on `_normalise` where it originates. The vite-only fact that survives is the blank-line drop, and the claim that the test STATES its residual is narrowed to the vite test, which is the only one of the two that does. The hole is dormant rather than live — no entry in `PINNED_STAGE_COMMANDS` carries a quote character — but the defect was the prose universal, which the record's own rule ("a pin also declares its NORMALISATION and what the normalisation cannot see") is what this paragraph exists to demonstrate. This is the third finding read off this one sentence: `b8dc321af` corrected its fault-message half and `4d5bd0dbb` its outcome-claim half. TWO OBLIGATIONS ARE OWED to the closing record, both blocked on #885 (open, so this branch does not touch `scripts/tests/`), and both freed together when it closes: 1. The `CLAIMS` entry in `scripts/tests/mutation_manifest.py` for the hook-preamble selector — target `.claude/hooks/decisions-guard.sh`, clause = the canonical sink assignment, replacement = that line plus the `eval` spelling, proof = a `test_hook_fire_log.py` node, outcome=GREEN with the mandatory `reach_replacement`/`reach_expect`. Until then `mechanics:` states the SELECTOR as a structural fact and makes no outcome claim (`4d5bd0dbb`). 2. The comment at `scripts/tests/test_hook_fire_log.py:153-154`, which ends "this arm's errors are refusals, never acceptances". The structural fact this record ships — the compared set is the non-comment-led lines containing the literal `ETV_HOOK_FIRE_LIB`, so a reassignment that never spells the literal is outside the selection — is an ACCEPTANCE by that arm, and the same comment block concedes the class five lines later ("so it is an acceptance hole, not only a stricter refusal"). The sentence is owed a correction; the record documents the residual beside it in the meantime. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 15:59:16 +02:00
timothyandClaude Fable 5.1	761a71278d	docs(901): pay for the two corrections by tightening the prose around them ... The two corrections added four prose lines to a record already one line over the 60-line advisory ceiling. Recover what can be recovered without losing substance: reflow the paragraphs, drop the padding ("and it fails silently" → ", silently"; "the count rises" → "and rises"), and cut one restatement. It lands at 65 lines, not 60. That is a deliberate stop: the remaining candidates are the *why* behind non-obvious choices — which the repo's own docs rule says to keep — and `decisions_validate` reports the constant itself as drifted from the distribution it is supposed to mark the tail of (p90=104, p95=142, 50 of 222 records over it). The validator passes. Refs #901 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 15:59:16 +02:00
timothyandClaude Fable 5.1	0977f04174	docs(901): the respelling-immunity thesis is bounded by the pin's REACH, and the neighbour doc declines the rule it was cited for ... Two prose overclaims in the new record, both of the shape the record itself exists to police. The thesis sentence generalised over the two worked pins and held for one. `PINNED_VITE_CONFIG` compares a whole file, so no respelling escapes it; the hook-preamble pin compares a SELECTION (`test_hook_fire_log.py:161` keeps only the lines containing the literal `ETV_HOOK_FIRE_LIB` that are not comment-led), so it must recognise a line before it can reject it — which is exactly the residual `mechanics:` documents four lines later. Bound the immunity to what a pin COMPARES and name the leftover exposure as the selector's reach. The neighbour citation claimed `docs/defect-shapes-773.md` §4 "argues the general form". §4 is a ranked table of detectors A-G — none of them this rule, and A is already assigned to `guard-derives-population-from-source` by the preceding clause. The doc's nearest class is `string-predicate churn` in the §3.6 partition, marked `no detector proposed`, and §3.7 argues the class away as a cross-cutting property (2 of 33 round-churn records). Only §4's closing meta-finding — class-level rules beat one record per instance — supports anything here, and it supports the FORM, not the content. Say that. Refs #901 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 15:59:16 +02:00
timothyandClaude Fable 5.1	c67b33cdcd	docs(901): a mutation OUTCOME is a manifest entry or it is not written — state the selector instead ... Round three, blocking. The record's `mechanics:` field asserted a measured mutation outcome — that appending an `eval` which composes `ETV_HOOK_FIRE_LIB` at runtime leaves `instrumentation_faults` returning `[]`, identical to the unmutated baseline — with no `CLAIMS` entry in scripts/tests/mutation_manifest.py. `testing.mutation-claims-are-executed` as amended by #881 puts a prose claim about a mutation's outcome under the executed-claim rule wherever it is written, a decision record included, and this branch's own docs/README.md row restates that. A record whose rule text requires "each defeat the matcher claims to catch is a DECLARED, executed mutation" cannot itself carry an undeclared one. scripts/tests/ is held by #885, which is open, so the entry cannot be added here. What replaces the outcome claim is the structural fact that carries the same point and needs no execution: the compared set is the lines containing the literal `ETV_HOOK_FIRE_LIB` that are not comment-led, so the pin reaches exactly the two preamble lines and a later reassignment which never spells the literal is outside the selection — whatever the checker then returns. The `CLAIMS` entry is owed once scripts/tests/ is free. Three more from the same round: - `_normalise_lines` was a universal over three pins that holds for one. The stage commands compare through `_normalise` (continuations joined, whitespace within one command collapsed); the script map is dict equality over parsed JSON and compares no text; only PINNED_VITE_CONFIG uses `_normalise_lines`. The three are now stated separately, with the note that a residual read off one does not transfer. - docs/guard-inventory.md's pointer restated the "shell or config TEXT" framing the record exists to reject. It now says what the record says: an artifact with a grammar the predicate does not implement. - Rider 1 stated vite's DEFAULT_CONFIG_FILES ordering unbound to a version. The ordering belongs to a release and expires with one, so the record cites the guard-inventory row rather than keeping a second copy, and that row now dates the reading and names the release web/package-lock.json pins. Refs #901, #891, #887, #881, #885 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 15:59:16 +02:00
timothyandClaude Fable 5.1	17c65005f5	docs(901): the hook pin is a pin WITHIN a selection, and the selection has a measured escape ... The record's own rule ends: a pin also declares its NORMALISATION and what the normalisation cannot see, because "pinned whole" invites a reader to assume byte equality. The `mechanics:` field did that for the image-build pin (it names `_normalise_lines` and what it drops) and not for the hook pin, which it described only as pinning two lines byte for byte. The comparison at scripts/tests/test_hook_fire_log.py:161-167 is over a SELECTED set — lines containing the literal `ETV_HOOK_FIRE_LIB` that are not comment-led — so byte-identity holds within the selection and says nothing about a writer of that variable spelled without the literal. MEASURED 2026-09-05 on this branch against `.claude/hooks/decisions-guard.sh`: appending eval "$(printf %s%s=/dev/null ETV_HOOK_FIRE _LIB)" after the canonical assignment leaves `instrumentation_faults(text, 'decisions-guard')` == `[]`, byte-identical to the unmutated baseline `[]`, while running those two lines under bash prints `final=/dev/null` — the sink is repointed and the checker is silent. A false GREEN, which is the failure direction this record exists to argue about. The residual is #891 code and is not introduced here; no code changes. What changes is that a record citing this file as one of its two worked pins now states the residual instead of implying byte equality over the file. Refs #901, #891 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 15:58:48 +02:00
timothyandClaude Fable 5.1	32e8578438	docs(901): the one line a guard author reads names two of the three rules ... The record is a rule about the SHAPE of a guard's predicate — the third member of the set docs/guard-inventory.md:15-16 tells a guard author to read before editing a guard or adding a row — and that pointer named only `guard-derives-population-from-source` and `guard-ships-with-mutation-proof`. Before this commit, `grep -rln guard-pins-the-artifact-not-a-shape docs/` outside the record and the generated catalog returned docs/README.md alone, so the record was reachable from the task-signal map and by topic but not from the inventory a guard author already has open. That is the reachability failure the record itself names: its body says `docs/guard-inventory.md` carries its precedent per incident, findable only from inside one. A record about topic-resolvability that is missing from the entry point of its own topic reproduces it. Refs #901 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 15:58:48 +02:00