Cold re-review round 2. One finding was a genuine CI red I should have caught
locally; the rest are overclaims in prose. One of its findings dissolved under
measurement into something more useful.
**The red.** `ruff format --check` failed on `scripts/tests/test_mcp_smoke.py` —
the only file of the 47 tracked Python files that did. I never ran ruff on a file
I wrote, which is a standing rule and not a subtle one. Formatted; the whole
population is clean and `ruff check` passes.
**The twin that was not a twin.** The review flagged `id_tools` as an unproven
sibling clause: mutating it leaves every case green, while the inventory advertised
the guard as catching "an answer pre-answered before the request". Measured on
isolated copies, three ways:
- `id_tools = 2` alone -> all green
- reader retention clause alone -> all green
- BOTH -> rc 0, the false green
So the tools stage is held by TWO mechanisms that mask each other — the reader keeps
only the reply matching the id in flight, so a `tools/list` frame emitted while
`initialize` is pending is dropped whatever its id. That is #685's shape, benign
here but worth naming. `id_init` is the one place a pre-answer is SINGLY
exploitable, which is why it stays the declared clause. The tools case is kept as
behavioural coverage with a docstring that states the measurement instead of the
mechanism I had assumed — the first version of it narrated a vulnerability that
does not exist, which is the defect this issue is about, one level in.
**The absence-assertion.** The review demonstrated that gutting the stub so it
emits NOTHING still satisfied the pre-answer test, because a silent server also
yields rc 9. The stub now drops a marker file once it has emitted, and the test
asserts it — so the case cannot pass without having posed the attack it narrates.
**Anti-vacuity is now a dependency, not a convention.** The positive control moved
into a module fixture the refusal tests depend on; a node-id selection or `-k` can
no longer skip it.
Prose corrections: coverage stated as six named refusal paths rather than "every
protocol branch" (the config/command/spawn stages are not driven); "the defect
history sits on the provable side" conceded — two of the five defects were in
`check-local-lsp.sh`, the file this record puts in the exempt branch; the wall-clock
timing dropped for the invariant; and the `mechanics` claim that one call site
carries all three traps narrowed to the two it actually carries. The `GUARD`
row citing itself is now recorded as a deliberate vocabulary stretch rather than
left to look routine.
Verification: 1104 passed, 2 skipped; ruff format+check clean over all 47 tracked
Python files; decisions-validate OK.
Refs: #796
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
timothyandClaude Opus 5
cd9f24a67c