open/repo-mailbox
1
0
Fork 0
Code Issues Releases 2 Activity

fix(infra): a failed measurement must never render as a reassuring value

Browse source 
Tier 3, all five the same defect class (Verifiseringsloven ansikt 4): a
broken or uninstrumented query returning a positive-looking null, consumed
as a fact about the world.

F5  coord-count.sh: a mailbox root that does not exist was byte-identical
    to one where nobody has pending mail - zero lines, exit 0, silent
    stderr. Now exit 3 + a named stderr line; an existing-but-empty root
    stays a silent, clean 0. 3 rather than 2 because 2 already means "you
    called me wrong" and this means "the world you named is not there".
F14 coord-count.sh: the header promised exit 0 unconditionally while
    --exclude with no value already exited 2. Contract restated as
    0/2/3 and pinned as a check on the help TEXT.
F6  board.sh: `git status | wc -l` yields 0 lines whether the tree is
    clean or git refused to answer, so a failure printed DRT=0. Now "?",
    and BOTH awk consumers handle it - --plan's free-capacity test
    compares the field as a string against "0" (a "?" coerces to 0 in
    arithmetic and would certify an unmeasured tree as free), and the SUM
    roll-up names what it could not add.
F10 board.sh: a scan root that does not exist was skipped in silence and
    the empty scan exited 0. Bad roots are now named on stderr; exit 3
    only when NO root was scanned. A mix still exits 0 and prints the
    board. Replaces an assertion that encoded this defect as a pass.
F13 pre-state-line-guard.mjs: MAX_LINES is overridable via
    CLAUDE_STATE_MAX_LINES so the boundary is testable without hardcoding
    120 twice. An unusable value denies by name rather than falling back
    to the default - a limit that silently did not take effect is the
    same defect one layer up.

Every design choice mutation-tested; every negative check carries a
known-positive control. Section 11's first cut was vacuously green (wrong
basename + unexported fixture path) - recorded in CLAUDE.md rather than
quietly fixed, and the section now asserts its own ground truth.

Denominator measured, not estimated: coord-inbox.sh:57 and
coord-order-inbox.sh:60/64 carry the same `|| exit 0` shape and are
deliberately left alone (injection path, prose output, must never fail a
SessionStart) - stated in CLAUDE.md as a bounded gap.

Suites: coord 230->242, board 281->300, guard 40->54, route 69, orders
110, npm 11/11. Verified under system bash 3.2, not just Homebrew 5.3.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-08-26 12:15:05 +02:00
commit d8fdeaa991
7 changed files with 606 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

91
scripts/coord-selftest.sh
View file

@ -1159,6 +1159,97 @@ check "F7(f): control - a dot-prefixed target name still delivers" $?
/bin/rm -rf "$F7DIR" 2>/dev/null
# 36. F5 - a missing mailbox ROOT and an empty one are two different facts, and
# coord-count.sh used to report them identically: `[ -d "$COORD" ] || exit 0`,
# zero lines on stdout, exit 0, nothing on stderr. A consumer reading that TSV
# (board.sh does) cannot tell "no mailbox has pending mail" from "the root I
# was pointed at is not there" - Verifiseringsloven ansikt 4 exactly: a broken
# query returning a positive-looking null, consumed as a fact about the world.
# The two are now distinguishable by EXIT STATUS and a stderr line. Status 3 is
# new and deliberately not 2: 2 already means "you called me wrong" (a usage
# error, nothing counted), 3 means "the world you named is not there". Both
# print nothing on stdout, so no consumer can mistake either for a count.
#
# The three cases below are the whole point - they must not collapse into one.
F5DIR="$(mktemp -d)"
# (a) The known-positive control FIRST: an EXISTING root holding real mail must
# still count it. A guard that exits 3 on everything would pass every negative
# check below while having destroyed the script, and this is what proves the
# query can still find.
CLAUDE_COORD_DIR="$F5DIR" "$SEND" --to f5box --from tester --subject s --message m >/dev/null 2>&1
f5a_err="$F5DIR/../f5a.err"
f5a_out="$(CLAUDE_COORD_DIR="$F5DIR" "$COUNT" 2>"$f5a_err")"; f5a_rc=$?
[ "$f5a_rc" -eq 0 ] && printf '%s' "$f5a_out" | grep -q '^f5box 1 1 '
check "F5(a): control - an existing root with mail still counts it and exits 0" $?
# (b) An EXISTING but EMPTY root: the genuine "nobody has pending mail" answer.
# Exit 0, no stdout, and NOTHING on stderr - a warning here would make the
# ordinary case noisy and train every reader to ignore the channel that case
# (c) needs.
F5EMPTY="$(mktemp -d)"
f5b_err="$F5DIR/../f5b.err"
f5b_out="$(CLAUDE_COORD_DIR="$F5EMPTY" "$COUNT" 2>"$f5b_err")"; f5b_rc=$?
[ "$f5b_rc" -eq 0 ] && [ -z "$f5b_out" ] && [ ! -s "$f5b_err" ]
check "F5(b): an existing but empty root is a silent, clean zero (exit 0)" $?
# (c) The defect: a root that does not exist. Pre-fix this was byte-identical
# to (b) on every channel a consumer can read.
f5c_err="$F5DIR/../f5c.err"
f5c_out="$(CLAUDE_COORD_DIR="$F5DIR/no/such/root" "$COUNT" 2>"$f5c_err")"; f5c_rc=$?
[ "$f5c_rc" -eq 3 ]
check "F5(c): a missing mailbox root exits 3, not 0" $?
[ -z "$f5c_out" ]
check "F5(c): a missing root still prints NO count line (3 is not a count)" $?
[ -s "$f5c_err" ] && grep -q 'coord-count' "$f5c_err" && grep -q 'not counted' "$f5c_err"
check "F5(c): a missing root says so on stderr, naming what was not measured" $?
# (d) Ground truth that (b) and (c) really are distinguishable now. This is the
# defect stated as one predicate rather than as three separate assertions: it
# fails if any future change collapses the two readings again, including one
# that keeps both exit codes but drops the stderr line.
[ "$f5b_rc" -ne "$f5c_rc" ]
check "F5(d): empty root and missing root no longer report the same status" $?
/bin/rm -rf "$F5EMPTY" "$F5DIR/../f5a.err" "$F5DIR/../f5b.err" "$F5DIR/../f5c.err" 2>/dev/null
# 37. F14 - the header's exit contract said "always 0" while the script exited
# 2 on `--exclude` with no value, and now exits 3 on a missing root (36 above).
# The header IS the contract: it is what `-h` prints, so a consumer that reads
# it and trusts it is reading a false claim. Pinned as a check on the HELP TEXT
# for the same reason board-selftest pins the FLY legend wording - the text is
# engine behavior, not prose, and a doc line nothing tests is a doc line that
# drifts.
f14_help="$(CLAUDE_COORD_DIR="$F5DIR" "$COUNT" --help 2>/dev/null)"; f14_rc=$?
[ "$f14_rc" -eq 0 ] && [ -n "$f14_help" ] && printf '%s' "$f14_help" | grep -q '^Exit:'
check "F14: control - --help still exits 0 and prints an Exit: contract" $?
# Ground truth for the claim the old header contradicted.
f14b_rc=0
CLAUDE_COORD_DIR="$F5DIR" "$COUNT" --exclude >/dev/null 2>&1 || f14b_rc=$?
[ "$f14b_rc" -eq 2 ]
check "F14: ground truth - --exclude with no value really does exit 2" $?
printf '%s' "$f14_help" | grep -q 'always 0'
[ $? -ne 0 ]
check "F14: the header no longer claims the script always exits 0" $?
printf '%s' "$f14_help" | grep -q '2 *= *usage error'
check "F14: the header documents exit 2 (usage error, nothing counted)" $?
printf '%s' "$f14_help" | grep -q '3 *= *mailbox root'
check "F14: the header documents exit 3 (missing root, nothing counted)" $?
# The reason the "always 0" claim existed at all must survive its removal: the
# session-start path must still not be failable by mailbox STATE. Every exit
# above 0 is a caller/world error, never "this mailbox has awkward contents".
f14c_rc=0
CLAUDE_COORD_DIR="$F5DIR" "$COUNT" --exclude f5box >/dev/null 2>&1 || f14c_rc=$?
[ "$f14c_rc" -eq 0 ]
check "F14: control - a correct call over a real root still exits 0" $?
/bin/rm -rf "$F5DIR" 2>/dev/null
echo "----"
echo "PASS=$PASS FAIL=$FAIL"
[ "$FAIL" -eq 0 ]