mutations.toml

# Mutation proofs replayed by the pinned ckdev-mutate runner (see README.md,
# "Mutation catalogue"). Each row deliberately breaks one production guard
# and names the Bun test(s) that must fail because of it. Each command row's
# list_command discovers those full names without executing their test bodies.
#
# Command-row `{test}` values are passed to Bun as regexes over the full test name,
# where describe names and test names are joined by single spaces. Most patterns
# anchor and escape each full name, spelling spaces with `\s` because ids cannot
# contain whitespace. Rows with a JUnit breadth audit (`broad_command`)
# use the literal leaf name instead, so `broad_id = '{name}'` maps the same
# testcase in the report; without those fields a `--broad` run cannot tell the
# named failure from collateral failures in the same file. `Ran {count} test` verifies one named test
# executes on both clean and mutated trees. Fixtures import from `dist/`, so the
# prebuild steps install and build before the baseline and each mutant. Replay
# with the Bun version CI pins (1.3.14): `rpc-declared-oversize-413-half-closes`
# guards a workaround for Bun 1.3.14 reusing a connection refused with 413, which
# Bun 1.4.2 no longer does.
prebuild = [
  { name = "install", command = ["bun", "install", "--frozen-lockfile"], timeout_s = 600 },
  { name = "build", command = ["bun", "run", "build"], timeout_s = 600 },
]

# --- lease clock domains ---
[[control]]
id = 'pool-lease-injected-clock'
guards = 'A pool using a synthetic logical clock cannot publish a lease that a wall-time withLock contender can evict'
file = 'src/store/refresh-lock.ts'
old = 'const lock = await acquireRefreshFileLock({'
new = '''const lock = await ((options: Parameters<typeof acquireRefreshFileLock>[0]) =>
      import('../fs/refresh-file-lock.js').then(({ acquireRefreshFileLockWithClock }) =>
        acquireRefreshFileLockWithClock({ ...options, now: () => 1_000_000 })))({ // NON-VACUITY BREAK: use the store test's injected logical clock for its leases'''
test_file = 'test/store/lease-clock.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/lease-clock.test.ts -t "$1"', 'sh', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/store/lease-clock.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^a\ssynthetic\sstore\sclock\scannot\slet\swithLock\sevict\sa\slive\spool-config\slease$']
expect_message = 'Received: true'

[[control]]
id = 'fs-lease-injected-clock'
guards = 'The public filesystem lease API ignores injected clocks even when JavaScript passes an extra now field'
file = 'src/fs/refresh-file-lock.ts'
old = 'return acquireRefreshFileLockWithClock({ ...options, now: Date.now })'
new = 'return acquireRefreshFileLockWithClock(options) // NON-VACUITY BREAK: honor an injected lease clock at runtime'
test_file = 'test/fs/lease-clock.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/fs/lease-clock.test.ts -t "$1"', 'sh', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/fs/lease-clock.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^public\sfilesystem\sleases\signore\sinjected\sclocks\sfor\sexpiry\srenewal\sand\seviction$']
expect_message = 'toBeGreaterThan'

# --- auth-plugin setup: OpenCode/Pi discovery and package registration ---
[[control]]
id = 'setup-static-claustrum'
guards = 'Setup Claustrum imports remain static so plugin rebuilds cannot strand a running host on a removed lazy chunk'
file = 'src/setup/detect.ts'
old = 'const connect = io.connect ?? connectClaustrumEnrollmentClient'
new = "const connect = io.connect ?? (await import('../claustrum/enrollment.js')).connectClaustrumEnrollmentClient /* NON-VACUITY BREAK */"
test_file = 'test/setup/bundle.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/setup/bundle.test.ts -t "$1"', 'sh', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/bundle.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\skeeps\sClaustrum\simports\sstatic\sand\sbundles\swithout\slazy\schunks$']
expect_message = 'dynamic-import'

[[control]]
id = 'setup-config-not-private'
guards = 'Ordinary host config registration preserves its mode instead of using the secret-file writer'
file = 'src/setup/register.ts'
old = "import { writeHostConfigAtomic } from './config-write.js'"
new = "import { writeJsonAtomic as writeHostConfigAtomic } from '../fs/index.js' // NON-VACUITY BREAK"
test_file = 'test/setup/register.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/setup/register.test.ts -t "$1"', 'sh', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/register.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sregistration\sconfig\sregistration\snever\sapplies\sprivate\swriter\spermissions$']
expect_message = 'Received: 384'

[[control]]
id = 'setup-windows-runtime-pi'
guards = 'Pi entry scripts are recognized behind Node and Bun image names'
file = 'src/setup/process-fence.ts'
old = "PI_SCRIPT_PATTERN.test(script) ? 'pi' : null"
new = "false /* NON-VACUITY BREAK */ ? 'pi' : null"
test_file = 'test/setup/fence.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/setup/fence.test.ts -t "$1"', 'sh', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/fence.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sprocess\sfence\sWindows\sinspects\sNode\sand\sBun\scommand\slines\sfor\shost\sentry\sscripts$']
expect_message = 'toEqual'

[[control]]
id = 'setup-windows-idle-pid'
guards = 'Windows tasklist idle PID zero is accepted before filtering host processes'
file = 'src/setup/process-fence.ts'
old = 'pid < 0'
new = 'pid <= 0 /* NON-VACUITY BREAK */'
test_file = 'test/setup/fence.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/setup/fence.test.ts -t "$1"', 'sh', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/fence.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sprocess\sfence\sWindows\sidle\sPID\szero\sand\scurrent\sruntime\sprocess\sare\svalid\slisting\srows$']
expect_message = 'cannot prove hosts are stopped'

[[control]]
id = 'setup-process-inspection-diagnostics'
guards = 'Inspection refusals retain the failing command step and safe timeout diagnostics'
file = 'src/setup/process-fence.ts'
old = 'this.timedOut = details.timedOut'
new = 'this.timedOut = false /* NON-VACUITY BREAK */'
test_file = 'test/setup/fence.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/setup/fence.test.ts -t "$1"', 'sh', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/fence.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sprocess\sfence\sinspection\sfailures\scarry\ssafe\sstep\stimeout\sexit\ssignal\sand\sduration\sfields$']
expect_message = 'timedOut'

[[control]]
id = 'setup-windows-cim-budget'
guards = 'Cold Windows CIM startup has its own product latency budget while inspections past it still refuse'
file = 'src/setup/process-fence.ts'
old = 'const WINDOWS_CIM_TIMEOUT_MS = 45_000'
new = 'const WINDOWS_CIM_TIMEOUT_MS = 15_000 /* NON-VACUITY BREAK */'
test_file = 'test/setup/fence.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/setup/fence.test.ts -t "$1"', 'sh', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/fence.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sprocess\sfence\sWindows\sCIM\suses\sa\s45\ssecond\sone-shot\sbudget\sand\sstill\srefuses\spast\sit$']
expect_message = 'cannot prove hosts are stopped'

[[control]]
id = 'setup-windows-cmd-path'
guards = 'Windows npm batch launchers count as installed without a successful direct exec'
file = 'src/setup/detect.ts'
old = "['.exe', '.cmd', '.bat', '']"
new = "['.exe', '.bat', ''] /* NON-VACUITY BREAK */"
test_file = 'test/setup/detect.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/setup/detect.test.ts -t "$1"', 'sh', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/detect.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sdetection\sWindows\scmd\slauncher\salone\sis\sinstalled$']
expect_message = 'Expected: true'

[[control]]
id = 'setup-desktop-markers'
guards = 'Desktop installation markers count as installed on every supported OS'
file = 'src/setup/detect.ts'
old = 'openCodeDesktopMarkers(io).some((marker) => fs.exists(marker)) ||'
new = 'false /* NON-VACUITY BREAK */ ||'
test_file = 'test/setup/detect.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/setup/detect.test.ts -t "$1"', 'sh', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/detect.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sdetection\sDesktop\smarkers\salone\sare\sinstalled\son\severy\sOS$']
expect_message = 'Expected: true'

[[control]]
id = 'setup-config-folder'
guards = 'An OpenCode config directory is enough even before a config file is created'
file = 'src/setup/detect.ts'
old = 'fs.isDirectory(configDir) ||'
new = 'false /* NON-VACUITY BREAK */ ||'
test_file = 'test/setup/detect.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/setup/detect.test.ts -t "$1"', 'sh', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/detect.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sdetection\sconfig\sfolder\swithout\sa\sconfig\sfile\sis\sinstalled$']
expect_message = 'Expected: true'

[[control]]
id = 'setup-deduplicate-package'
guards = 'Upgrading a package leaves exactly one registration despite older duplicates'
file = 'src/setup/register.ts'
old = 'matches.slice(1).reverse()'
new = '[] /* NON-VACUITY BREAK */'
test_file = 'test/setup/register.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/setup/register.test.ts -t "$1"', 'sh', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/register.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sregistration\sreplaces\solder\spackage\sentries\sand\sremoves\sduplicates$']
expect_message = 'toEqual'

[[control]]
id = 'setup-command-error-redacts-stderr'
guards = 'Pi install diagnostics scrub credentials from the captured stderr tail'
file = 'src/setup/command-error.ts'
old = 'const redacted = redact(tail)'
new = 'const redacted = tail /* NON-VACUITY BREAK */'
test_file = 'test/setup/register.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/setup/register.test.ts -t "$1"', 'sh', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/register.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sregistration\sPi\sinstall\serror\spreserves\sits\smessage\sand\sredacts\sstderr\scredentials$']
expect_message = 'abc123secret'

[[control]]
id = 'setup-command-error-bounds-stderr'
guards = 'Captured Pi install stderr keeps only the final 4 KiB'
file = 'src/setup/command-runner.ts'
old = 'export const STDERR_TAIL_MAX_BYTES = 4 * 1024'
new = 'export const STDERR_TAIL_MAX_BYTES = 8 * 1024 /* NON-VACUITY BREAK */'
test_file = 'test/setup/register.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/setup/register.test.ts -t "$1"', 'sh', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/register.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sregistration\sPi\sinstall\serror\skeeps\sonly\sthe\sfinal\s4\sKiB\sof\sstderr$']
expect_message = 'toBeLessThanOrEqual'

[[control]]
id = 'setup-command-error-drops-partial-line'
guards = 'A truncated Pi install tail discards the line that may begin inside a credential'
file = 'src/setup/command-error.ts'
old = "return newline < 0 ? '' : tail.slice(newline + 1)"
new = 'return tail /* NON-VACUITY BREAK */'
test_file = 'test/setup/register.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/setup/register.test.ts -t "$1"', 'sh', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/register.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sregistration\sPi\sinstall\serror\sdrops\sa\spartial\scredential\sline\sat\sthe\sstderr\sboundary$']
expect_message = 'toStartWith'

[[control]]
id = 'setup-command-runner-bounds-stdout'
guards = 'Setup child stdout retention is capped at one MiB'
file = 'src/setup/command-runner.ts'
old = 'const length = Math.min(remaining, chunk.length)'
new = 'const length = chunk.length /* NON-VACUITY BREAK */'
test_file = 'test/setup/command-runner.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/setup/command-runner.test.ts -t "$1"', 'sh', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/command-runner.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\scommand\srunner\sstdout\sbeyond\sthe\scap\sfails\sthe\schild\sand\skeeps\sonly\scapped\soutput$']
expect_message = 'toBe'

[[control]]
id = 'setup-process-fence'
guards = 'Active hosts refuse setup rather than racing migration and credential writes'
file = 'src/setup/process-fence.ts'
old = 'if (active.length) throw new ProcessFenceViolationError(active)'
new = 'if (false /* NON-VACUITY BREAK */) throw new ProcessFenceViolationError(active)'
test_file = 'test/setup/fence.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/setup/fence.test.ts -t "$1"', 'sh', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/fence.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sprocess\sfence\srefuses\sactive\sPOSIX\shosts\sand\sredacts\scommand\sarguments$']
expect_message = 'Expected promise that rejects'

# --- staged roster publication (0.12.0) ---
# The runner first proves a named test passes with its guard intact, then
# deliberately removes that guard and requires the same test to fail. The
# command prints the source diff in each run to show when the break is present.
# Each filter selects one named test; unrelated failures cannot count as catches.

[[control]]
id = 'store-stage-refuse'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'refuse never rotates or writes an existing secret holder'
file = 'src/store/rows.ts'
old = "if (mode === 'refuse') {"
new = "if (mode === 'stage-duplicate' /* NON-VACUITY BREAK */) {"
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement refuse preserves holder and duplicate requires both staging fields']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-crash-marker'
guards = 'the first state write persists staging ownership before any config exists'
file = 'src/store/rows.ts'
old = '...(extra.staged ? { staged: extra.staged } : {}),'
new = '...(false ? { staged: extra.staged } : {}), /* NON-VACUITY BREAK */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\sreplacement\schild\scrash\safter\sadd\sstate\sresumes\sexact\sreplay\sat\sgenuine\sepoch$']
expect_message = 'unbound-credential'

[[control]]
id = 'store-stage-orphan-foreign'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'a different stored reservation cannot be replayed by the caller'
file = 'src/store/rows.ts'
old = 'staged.reservation !== input.stage?.reservation ||'
new = 'false /* NON-VACUITY BREAK */ ||'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement foreign orphan different reservation refuses unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-orphan-missing'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'staging ownership is never synthesized from caller wishes'
file = 'src/store/rows.ts'
old = 'const staged = stamp?.staged'
new = "const staged = stamp?.staged ?? { reservation: input.stage!.reservation, label: input.label, disabledReason: input.disabled!.reason, providerState: incoming === undefined ? undefined : canonicalDigest(incoming) } /* NON-VACUITY BREAK */"
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement foreign orphan missing reservation refuses unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-replay-metadata'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'replay compares all provider metadata, not only credentialBound'
file = 'src/store/rows.ts'
old = 'staged.providerState !== incomingDigest ||'
new = 'false /* NON-VACUITY BREAK */ ||'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement exact replay rejects changed provider metadata']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-replay-label'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'replay compares label including absence'
file = 'src/store/rows.ts'
old = 'staged.label !== label ||'
new = 'false /* NON-VACUITY BREAK */ ||'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement exact replay rejects changed label']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-replay-identity'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'replay requires exact identity absence as well as presence'
file = 'src/store/rows.ts'
old = 'stamp.binding.identity !== identity'
new = 'false /* NON-VACUITY BREAK */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement exact replay rejects changed identity absence']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-replay-access'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'replay compares the OAuth access token via full dispatch digest'
file = 'src/store/rows.ts'
old = '''credentialDigest(credential) !== stamp.digest ||
    dispatchDigest(credential) !== stamp.dispatch'''
new = '''credentialDigest(credential) !== stamp.digest ||
    false /* NON-VACUITY BREAK */'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement exact replay rejects changed access token']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-replay-expiry'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'replay compares OAuth expiry via full dispatch digest'
file = 'src/store/rows.ts'
old = '''credentialDigest(credential) !== stamp.digest ||
    dispatchDigest(credential) !== stamp.dispatch'''
new = '''credentialDigest(credential) !== stamp.digest ||
    false /* NON-VACUITY BREAK */'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement exact replay rejects changed expiry']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-replay-endpoint'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'replay compares trimmed API endpoint and effective header'
file = 'src/store/rows.ts'
old = '''credentialDigest(credential) !== stamp.digest ||
    dispatchDigest(credential) !== stamp.dispatch'''
new = '''credentialDigest(credential) !== stamp.digest ||
    false /* NON-VACUITY BREAK */'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement exact replay rejects changed endpoint']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-replay-enabled'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'an enabled complete row is not a staged replay'
file = 'src/store/rows.ts'
old = '''row.type !== credential.type ||
    row.enabled ||'''
new = '''row.type !== credential.type ||
    false /* NON-VACUITY BREAK */ ||'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement exact replay rejects changed enabled shape']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-protect-add'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'add protect is evaluated on locked successor management before writes'
file = 'src/store/rows.ts'
old = '''async (tx): Promise<AddResult> => {
          await protectIn(tx, id, options.protect)'''
new = '''async (tx): Promise<AddResult> => {
          /* NON-VACUITY BREAK: protect omitted */'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement protect add observes successor management under locks']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-protect-enable'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'enable protect is evaluated on locked successor management before writes'
file = 'src/store/rows.ts'
old = '''async (tx): Promise<RowTransitionResult> => {
          await protectIn(tx, id, options.protect)'''
new = '''async (tx): Promise<RowTransitionResult> => {
          /* NON-VACUITY BREAK: protect omitted */'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement protect enable observes successor management under locks']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-protect-disable'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'disable protect is evaluated on locked successor management before writes'
file = 'src/store/rows.ts'
old = '''async (tx): Promise<RowTransitionResult> => {
          await protectIn(tx, id, options.protect)'''
new = '''async (tx): Promise<RowTransitionResult> => {
          /* NON-VACUITY BREAK: protect omitted */'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement protect disable observes successor management under locks']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-reserved-enable'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'reserved enable refuses before either file changes'
file = 'src/store/reserved.ts'
old = 'if (reservation !== undefined)'
new = 'if (false /* NON-VACUITY BREAK */)'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement reserved enable refuses unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-reserved-disable'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'reserved disable refuses before either file changes'
file = 'src/store/reserved.ts'
old = 'if (reservation !== undefined)'
new = 'if (false /* NON-VACUITY BREAK */)'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement reserved disable refuses unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-reserved-refresh'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'reserved refresh refuses before provider dispatch'
file = 'src/store/reserved.ts'
old = 'if (reservation !== undefined)'
new = 'if (false /* NON-VACUITY BREAK */)'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement reserved refresh refuses unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-reserved-replace'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'reserved replace refuses before either file changes'
file = 'src/store/reserved.ts'
old = 'if (reservation !== undefined)'
new = 'if (false /* NON-VACUITY BREAK */)'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement reserved replace refuses unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-reserved-rotate'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'reserved rotate refuses before either file changes'
file = 'src/store/reserved.ts'
old = 'if (reservation !== undefined)'
new = 'if (false /* NON-VACUITY BREAK */)'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement reserved rotate refuses unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-reserved-identity'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'reserved identity observation refuses before either file changes'
file = 'src/store/reserved.ts'
old = 'if (reservation !== undefined)'
new = 'if (false /* NON-VACUITY BREAK */)'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement reserved recordIdentity refuses unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-reserved-quota'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'reserved quota observation refuses before either file changes'
file = 'src/store/reserved.ts'
old = 'if (reservation !== undefined)'
new = 'if (false /* NON-VACUITY BREAK */)'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement reserved recordQuota refuses unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-reserved-provider-state'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'reserved provider state refuses before either file changes'
file = 'src/store/reserved.ts'
old = 'if (reservation !== undefined)'
new = 'if (false /* NON-VACUITY BREAK */)'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement reserved updateProviderState refuses unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-reserved-add'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'reserved ordinary re-add never rotates or completes it'
file = 'src/store/reserved.ts'
old = 'if (reservation !== undefined)'
new = 'if (false /* NON-VACUITY BREAK */)'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement reserved add refuses unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-never-candidate'
guards = 'an enabled-shaped reservation is never a candidate or polled'
file = 'src/store/schema.ts'
old = 'row.candidate = enabled && credential !== undefined && !reserved'
new = 'row.candidate = enabled && credential !== undefined /* NON-VACUITY BREAK */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\sreplacement\senabled\sshaped\sreserved\srows\snever\sroute\sor\spull$']
expect_message = 'error: expect('

[[control]]
id = 'store-stage-remove-fence'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'stale staged cleanup cannot remove a published row'
file = 'src/store/rows.ts'
old = '} else if (options.staged)'
new = '} else if (false /* NON-VACUITY BREAK */)'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement remove fence deletes reserved rows but never published rows']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-publish-attribution'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'publication removal requires exact credential epoch and identity'
file = 'src/store/publication.ts'
old = '''assertBoundRowAttribution(
                ref.id,
                row,
                ref.attribution,
                'publishRoster',
              )
              if (
                !row.credential ||'''
new = '''/* NON-VACUITY BREAK: attribution omitted */
              if (
                !row.credential ||'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement publication rejects attribution unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-publish-fingerprint'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'publication refuses a removed secret that changed during preparation'
file = 'src/store/publication.ts'
old = 'fingerprintOf(row.credential) !== ref.fingerprint'
new = 'false /* NON-VACUITY BREAK */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "^$1$"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement publication rejects fingerprint unchanged']
expect_message = 'Expected promise that rejects'


[[control]]
id = 'store-publish-config-reservation'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'finalization requires the exact config reservation'
file = 'src/store/publication.ts'
old = 'row.staged?.reservation !== ref.reservation ||'
new = 'false /* NON-VACUITY BREAK */ ||'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement publication rejects different reservation unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-publish-stamp-reservation'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'config alone cannot claim staged ownership without the exact stamp marker'
file = 'src/store/publication.ts'
old = 'stamp?.staged?.reservation !== ref.reservation ||'
new = 'false /* NON-VACUITY BREAK */ ||'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement publication rejects stamp reservation unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-publish-order'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'publication order names exactly all survivors'
file = 'src/store/publication.ts'
old = '''survivors.length !== plan.order.length ||
    plan.order.some((id) => !survivors.some((row) => row.id === id)) ||
    survivors.some((row) => !plan.order.includes(row.id))'''
new = 'false /* NON-VACUITY BREAK */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement publication rejects order unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-publish-enabled-identity'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'the final enabled roster has no duplicate known OAuth identity'
file = 'src/store/publication.ts'
old = 'if (identities.has(row.identity))'
new = 'if (false /* NON-VACUITY BREAK */)'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement publication rejects enabled identity unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-publish-secret-identity'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'a staged secret cannot claim a different removed known identity'
file = 'src/store/publication.ts'
old = 'old.fingerprint === row.fingerprint,'
new = 'false /* NON-VACUITY BREAK */,'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement publication rejects secret identity unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-publish-protect'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'publication protect vetoes the irreversible write'
file = 'src/store/publication.ts'
old = 'await protectIn(tx, plan.operationId, options.protect)'
new = '/* NON-VACUITY BREAK: protect omitted */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement publication rejects protect unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-publish-required-fingerprint'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'a required removal fingerprint cannot be omitted'
file = 'src/store/publication.ts'
old = '(rt.ctx.requireRemovedFingerprint && !ref.fingerprint)'
new = '(false /* NON-VACUITY BREAK */)'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement publication rejects required fingerprint unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-publish-disabled-final'
guards = 'disabled finalization persists the requested reason and does not enable'
file = 'src/store/publication.ts'
old = 'raw.enabled = ref.enabled'
new = 'raw.enabled = true /* NON-VACUITY BREAK */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\sreplacement\sdisabled\sfinalization\sreleases\sreservation\sand\slater\sattributed\senable\sworks$']
expect_message = 'error: expect('

[[control]]
id = 'store-publish-lock-dedupe'
guards = 'same-wire old and staged rows take one row lock without self-deadlock'
file = 'src/store/publication.ts'
old = '[...new Set(keys.values())].sort()'
new = '[...keys.values()].sort() /* NON-VACUITY BREAK */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\sreplacement\sdeduplicates\ssame\swire\slock\sand\sleaves\soutside\srows\suntouched$']
expect_message = 'lock-contention'

[[control]]
id = 'store-publish-refresh-fingerprint'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'a middle-row wait sees the refresh spending the planned old token'
file = 'src/store/publication.ts'
old = 'fingerprintOf(row.credential) !== ref.fingerprint'
new = 'false /* NON-VACUITY BREAK */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement waits behind middle row refresh and checks post refresh fingerprint']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-publish-key-recheck'
guards = 'named keys are recomputed under store locks before publication'
file = 'src/store/publication.ts'
old = '''if (
              named.some('''
new = '''if (
              false && /* NON-VACUITY BREAK */ named.some('''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\sreplacement\schanged\srow\skeys\sretry\sonce\sthen\srefuse\swithout\spublication$']
expect_message = 'error: expect('

[[control]]
id = 'store-publish-before-observer'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'before-config-write observer rejects before the config rename'
file = 'src/store/mutate.ts'
old = 'await this.ctx.onStep?.(`before-${file}-write`, this.info)'
new = '/* NON-VACUITY BREAK: before-write observer omitted */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement before publication rename observer leaves old pool usable']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-publish-before-lease'
guards = 'a lost lease refuses the irreversible config rename'
file = 'src/store/mutate.ts'
old = '''// Ownership is proved immediately before the rename, on every lease.
          await this.locks.assertAll()'''
new = '// NON-VACUITY BREAK: pre-rename lease assertion omitted'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\sreplacement\sbefore\spublication\srename\slease\sleaves\sold\spool\susable$']
expect_message = 'error: expect('

[[control]]
id = 'store-publish-committed-receipt'
guards = 'the irreversible config rename includes its forward-cleanup receipt'
file = 'src/store/publication.ts'
old = 'saveReceipt(tx, receipt)'
new = '/* NON-VACUITY BREAK: decision receipt omitted */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\sreplacement\safter\spublication\srename\sresumes\sonly\sreceipt\scleanup$']
expect_message = 'error: expect('

[[control]]
id = 'store-publish-child-recovery'
guards = 'a durable committed receipt resumes cleanup after a process crash'
file = 'src/store/publication.ts'
old = "return { outcome: 'cleaned', receipt: await cleanup(tx, prior) }"
new = "return { outcome: 'cleaned', receipt: prior } /* NON-VACUITY BREAK */"
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\sreplacement\schild\scrash\safter\spublication\sresumes\swith\sattributed\sorphan\sremoval$']
expect_message = 'error: expect('

[[control]]
id = 'store-publish-digest'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'reusing an operation id for a different digest cannot adopt its receipt'
file = 'src/store/publication.ts'
old = 'if (prior.planDigest !== planDigest)'
new = 'if (false /* NON-VACUITY BREAK */)'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement reused operation id refuses a different plan digest']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-publish-file-sync'
guards = 'durable publication syncs the staged file before rename'
file = 'src/fs/atomic-write.ts'
old = '''if (options.durable) {
      try {
        await handle.sync()'''
new = '''if (options.durable) {
      try {
        /* NON-VACUITY BREAK: file sync omitted */'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\sreplacement\sdurable\spublication\sand\sreceipt\ssync\sfile\sand\sdirectory\sonly$']
expect_message = 'error: expect('

[[control]]
id = 'store-publish-directory-sync'
guards = 'durable publication syncs the parent directory after rename'
file = 'src/fs/atomic-write.ts'
old = '''if (options.durable) {
      const directory = await open(dirname(path), 'r')
      try {
        await directory.sync()'''
new = '''if (options.durable) {
      const directory = await open(dirname(path), 'r')
      try {
        /* NON-VACUITY BREAK: directory sync omitted */'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\sreplacement\sdurable\spublication\sand\sreceipt\ssync\sfile\sand\sdirectory\sonly$']
expect_message = 'error: expect('

[[control]]
id = 'store-publish-outside-state'
guards = 'cleanup never drops state belonging to rows outside the plan'
file = 'src/store/publication.ts'
old = 'await tx.commitState(undefined, { durable: true })'
new = 'tx.state.accounts = {}; await tx.commitState(undefined, { durable: true }) /* NON-VACUITY BREAK */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\sreplacement\sdeduplicates\ssame\swire\slock\sand\sleaves\soutside\srows\suntouched$']
expect_message = 'error: expect('

[[control]]
id = 'store-remove-id-memory'
guards = 'a refused-before-rename removal never records the id as removed in memory'
file = 'src/store/mutate.ts'
old = 'retireEpochsIn(this.config, dropped)'
new = 'for (const id of dropped) this.ctx.removedIds.add(id); retireEpochsIn(this.config, dropped) /* NON-VACUITY BREAK */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\sreplacement\sremoval\srefused\sbefore\srename\sdoes\snot\sretire\sid\sin\smemory$']
expect_message = 'error: expect('

[[control]]
id = 'store-stage-duplicate-prerequisites'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'stage-duplicate requires an explicit disabled reservation'
file = 'src/store/rows.ts'
old = "(mode === 'stage-duplicate' && (!input.disabled || !input.stage))"
new = '(false /* NON-VACUITY BREAK */)'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement refuse preserves holder and duplicate requires both staging fields']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-replay-reason'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'staged replay requires the exact original disabled reason'
file = 'src/store/rows.ts'
old = 'staged.disabledReason !== input.disabled?.reason ||'
new = 'false /* NON-VACUITY BREAK */ ||'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement exact replay rejects changed disabled reason']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-stamp-parse'
guards = 'malformed staged records never become valid credential stamps'
file = 'src/store/schema.ts'
old = "if ('staged' in raw && !staged) return undefined"
new = 'if (false /* NON-VACUITY BREAK */) return undefined'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\sreplacement\sstamp\sparser\srejects\smalformed\sreservation\srecords$']
expect_message = 'error: expect('

[[control]]
id = 'store-publish-missing-reservation'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'finalization cannot adopt a row whose config marker is absent'
file = 'src/store/publication.ts'
old = 'row.staged?.reservation !== ref.reservation ||'
new = 'false /* NON-VACUITY BREAK */ ||'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement publication rejects missing reservation unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-publish-disabled-reason-required'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'a disabled finalization must carry its reason'
file = 'src/store/publication.ts'
old = ": typeof ref.disabledReason !== 'string')"
new = ': false /* NON-VACUITY BREAK */)'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement publication rejects disabled reason required unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-publish-enabled-reason-forbidden'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'an enabled finalization must not carry a disabled reason'
file = 'src/store/publication.ts'
old = '? ref.disabledReason !== undefined'
new = '? false /* NON-VACUITY BREAK */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement publication rejects enabled reason forbidden unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-publish-removed-reserved'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'publication removal never consumes another reserved row'
file = 'src/store/publication.ts'
old = 'tx.assertNotStaged(ref.id)'
new = '/* NON-VACUITY BREAK: reserved-removal guard omitted */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement publication rejects removed reserved unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-publish-removed-unbound'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'publication removal requires a bindable credential stamp'
file = 'src/store/publication.ts'
old = '''assertBoundRowAttribution(
                ref.id,
                row,
                ref.attribution,
                'publishRoster',
              )
              if (
                !row.credential ||'''
new = '''/* NON-VACUITY BREAK: bound removal attribution omitted */
              if (
                !row.credential ||'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement publication rejects removed unbound unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-publish-removed-torn'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'publication removal cannot settle a torn credential by deleting it'
file = 'src/store/publication.ts'
old = '''assertBoundRowAttribution(
                ref.id,
                row,
                ref.attribution,
                'publishRoster',
              )
              if (
                !row.credential ||'''
new = '''/* NON-VACUITY BREAK: bound removal attribution omitted */
              if (
                !row.credential ||'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement publication rejects removed torn unchanged']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-publish-forward-cleanup'
guards = 'a committed receipt resumes cleanup instead of revalidating its spent plan'
file = 'src/store/publication.ts'
old = 'if (prior) {'
new = "if (prior && prior.phase === 'cleaned') { /* NON-VACUITY BREAK */"
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\sreplacement\safter\spublication\srename\sresumes\sonly\sreceipt\scleanup$']
expect_message = 'attribution'

# --- fs locks ---

[[control]]
id = 'store-stage-invalid-row-projection'
guards = 'a reserved config marker remains visible even when its roster row is invalid'
file = 'src/store/schema.ts'
old = '''invalid: 'roster',
          stamp: 'none',
          ...(staged ? { staged } : {}),'''
new = '''invalid: 'roster',
          stamp: 'none',
          /* NON-VACUITY BREAK: reserved marker hidden */'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\sreplacement\senabled\sshaped\sreserved\srows\snever\sroute\sor\spull$']
expect_message = 'error: expect('

[[control]]
id = 'store-stage-no-rotate-mode'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'a stage marker cannot reach the ordinary old-holder rotation branch'
file = 'src/store/rows.ts'
old = "if (input.stage !== undefined && mode === 'rotate')"
new = 'if (false /* NON-VACUITY BREAK */)'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement stage with rotate refuses before locks and preserves holder']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-replay-no-pull'
guards = 'staged replay never schedules a pull capture that could repair an old row'
file = 'src/store/rows.ts'
old = '!preparing &&'
new = 'true /* NON-VACUITY BREAK */ &&'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\sreplacement\sorphan\sreplay\spreserves\sgenuine\sepoch\sand\sstored\sstate$']
expect_message = 'error: expect('

[[control]]
id = 'store-publish-replay-no-validation'
guards = 'a committed receipt resumes even when a later store requires removal fingerprints'
file = 'src/store/publication.ts'
old = 'const prior = receiptIn(tx.config, plan.operationId)'
new = 'validatePlan(rt, plan); const prior = receiptIn(tx.config, plan.operationId) /* NON-VACUITY BREAK */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\sreplacement\sreceipt\sreplay\snever\srevalidates\sa\scommitted\splan$']
expect_message = 'invalid-input'

[[control]]
id = 'store-publish-rename-bookkeeping'
guards = 'post-rename directory sync failure cannot masquerade as a before-write failure'
file = 'src/fs/atomic-write.ts'
old = 'onRenamed?.()'
new = '/* NON-VACUITY BREAK: rename bookkeeping omitted */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\sreplacement\sdirectory\ssync\sfailure\sstill\srecords\sthe\sirreversible\srename$']
expect_message = 'error: expect('

[[control]]
id = 'store-stage-raw-label-absence'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'a malformed present config label cannot count as the staged label being absent'
file = 'src/store/rows.ts'
old = 'raw.label !== label ||'
new = 'false /* NON-VACUITY BREAK */ ||'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement exact replay rejects changed label']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-raw-identity-absence'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'a malformed present config identity cannot count as the staged identity being absent'
file = 'src/store/rows.ts'
old = 'raw.accountId !== identity'
new = 'false /* NON-VACUITY BREAK */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged replacement exact replay rejects changed identity absence']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-stage-attributed-toggle-repair'
guards = 'after protect and a matching fence, attributed toggles still finish proved torn replacements'
file = 'src/store/rows.ts'
old = '''if (mutator === undefined || codec === undefined) {
            await tx.completeTorn()'''
new = '''if (mutator === undefined || codec === undefined) {
            /* NON-VACUITY BREAK: matching replacement repair omitted */'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\sreplacement\sattributed\stoggle\sstill\scompletes\sa\sproved\storn\sreplacement$']
expect_message = 'error: expect('

[[control]]
id = 'fs-lock-live-holder-excludes-second-acquirer'
guards = 'a live lock refuses a second acquirer: a holder whose lease has not expired is never treated as stale and evicted'
file = 'src/fs/refresh-file-lock.ts'
old = 'if (Number.isFinite(expiresAt) && expiresAt > now())'
new = 'if (false /* NON-VACUITY BREAK */)'
test_file = 'test/fs/with-lock.test.ts'
runner = "command"
command = ["bun", "test", "test/fs/with-lock.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/with-lock.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^contention\swaits\sand\sreports\slock\sidentity$']
expect_message = '/Expected constructor: \[class LockContentionError[^\n]*\nReceived value: undefined/'

[[control]]
id = 'fs-lock-try-once-refuses-held-lock'
guards = 'the try-once acquire returns null while another owner holds the lock, instead of reporting an existing lock file as acquired'
file = 'src/fs/refresh-file-lock.ts'
old = "if (await leaseContention(error)) return false"
new = "if (await leaseContention(error)) return true /* NON-VACUITY BREAK */"
test_file = 'test/fs/with-lock.test.ts'
runner = "command"
command = ["bun", "test", "test/fs/with-lock.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/with-lock.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^the\sfs\ssubpath\sexports\sthe\stry-once\slock:\sa\sheld\slock\sreturns\snull\suntil\sreleased$']
expect_message = '/expect\(received\)\.toBeNull\(\)\s+Received: \{/'

[[control]]
id = 'fs-lock-release-is-owner-fenced'
guards = "release removes the lock only while it still carries this owner's id, never a successor's lock"
file = 'src/fs/refresh-file-lock.ts'
old = '''
            if (owner?.ownerId !== ownerId) {
              removalConfirmed = true
              return
            }'''
new = '''
            if (Boolean(false) /* NON-VACUITY BREAK */) {
              removalConfirmed = true
              return
            }'''
test_file = 'test/fs/refresh-file-lock.test.ts'
runner = "command"
command = ["bun", "test", "test/fs/refresh-file-lock.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/refresh-file-lock.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^acquireRefreshFileLock\sassertOwned\sobserves\stakeover\swith\sownership\sdetails\swithout\srenewal$']
expect_message = '/ENOENT: no such file or directory, open .*assert-observed\.json\.assert\.lock/'

[[control]]
id = 'fs-lock-relinquish-after-marker-loss-is-owner-fenced'
guards = 'after losing its eviction marker post-write, a renewal relinquishes only a lock record that still carries its own owner id'
file = 'src/fs/refresh-file-lock.ts'
old = '''
      if (owner?.ownerId !== ownerId) return
      try {
        await rm(lockPath, { recursive: true, force: true })'''
new = '''
      void owner
      try {
        await rm(lockPath, { recursive: true, force: true })'''
test_file = 'test/fs/refresh-file-lock.test.ts'
runner = "command"
command = ["bun", "test", "test/fs/refresh-file-lock.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/refresh-file-lock.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^acquireRefreshFileLock\spreserves\sa\ssuccessor\srecord\sduring\spost-write\srelinquish$']
expect_message = '/expect\(existsSync\(lockPath\)\)\.toBe\(true\)[\s\S]*Received: false/'

[[control]]
id = 'fs-lock-post-fence-acquire-relinquishes-not-removes'
guards = 'an acquisition that loses its marker after recreating a stale lock relinquishes through the owner check, never removing a successor by pathname'
file = 'src/fs/refresh-file-lock.ts'
old = '''
          await relinquishLockAfterMarkerLoss()
          acquired = false'''
new = '''
          await rm(lockPath, { recursive: true, force: true })
          acquired = false'''
test_file = 'test/fs/acquisition-orderings.test.ts'
runner = "command"
command = ["bun", "test", "test/fs/acquisition-orderings.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/acquisition-orderings.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^deterministic\sstale\sacquisition\sorderings\spost-fence\smarker\sloss\spreserves\sthe\ssuccessor\safter\sstale\slock\srecreation$']
expect_message = '/ENOENT: no such file or directory, open .*tokens\.json\.refresh\.lock/'

[[control]]
id = 'fs-lock-stale-lock-is-reclaimed'
guards = 'an expired lock is removed under the eviction marker and recreated, so a crashed holder cannot block the lock forever'
file = 'src/fs/refresh-file-lock.ts'
old = '''
        await removeLeaseObject(lockPath)
        // Fence check 3'''
new = '''
        /* NON-VACUITY BREAK: retain the expired lease instead of reclaiming it */
        // Fence check 3'''
test_file = 'test/fs/with-lock.test.ts'
runner = "command"
command = ["bun", "test", "test/fs/with-lock.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/with-lock.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^reads\sexpired\slegacy\sowner\.json\sdespite\sa\sfresh\sdirectory\smtime$']
expect_message = 'LockContentionError: Timed out acquiring'

[[control]]
id = 'fs-lock-stale-reclaim-rechecks-liveness-under-marker'
guards = 'a contender that saw a stale lock rechecks liveness after taking the eviction marker, so a replacement owner installed meanwhile is preserved'
file = 'src/fs/refresh-file-lock.ts'
old = '''
        const confirmed = await readLockState()'''
new = '''
        const confirmed = observed as LockState /* NON-VACUITY BREAK */'''
test_file = 'test/fs/acquisition-orderings.test.ts'
runner = "command"
command = ["bun", "test", "test/fs/acquisition-orderings.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/acquisition-orderings.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^deterministic\sstale\sacquisition\sorderings\sordering\s2\srechecks\sliveness\sunder\sthe\smarker\sand\spreserves\sthe\sreplacement\sowner$']
expect_message = 'stale-lock-confirmed'

[[control]]
id = 'fs-lock-missing-is-not-stale'
guards = 'a missing lock retries exclusive creation without taking an eviction marker or claiming stale eviction'
file = 'src/fs/refresh-file-lock.ts'
old = "return { status: 'missing' }"
new = "return { status: 'stale', identity: { kind: 'owner', ownerId: 'missing', expiresAt: 0 } } /* NON-VACUITY BREAK */"
test_file = 'test/fs/stale-lock-identity.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/fs/stale-lock-identity.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/stale-lock-identity.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^stale\slock\sidentity\smissing\slock\sretries\sexclusive\screate\swithout\san\seviction\smarker$']
expect_message = 'stale-lock-observed'

[[control]]
id = 'fs-lock-stale-removal-binds-identity'
guards = 'the final removal fence preserves a different expired record installed after stale confirmation'
file = 'src/fs/refresh-file-lock.ts'
old = 'if (!sameStaleLock(observed.identity, current)) continue'
new = 'if (false /* NON-VACUITY BREAK */) continue'
test_file = 'test/fs/stale-lock-identity.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/fs/stale-lock-identity.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/stale-lock-identity.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^stale\slock\sidentity\spreserves\sexpired\sreplacement\safter\sstale\sconfirmation$']
expect_message = 'toBeNull'

[[control]]
id = 'fs-lock-renewal-rechecks-expiry-before-publish'
guards = 'a holder whose lease expires after the awaited renewal barrier cannot publish a renewed lease'
file = 'src/fs/refresh-file-lock.ts'
old = '''        current?.ownerId !== ownerId ||
        !(Number(current?.expiresAt) > now()) ||'''
new = '''        current?.ownerId !== ownerId ||
        false /* NON-VACUITY BREAK */ ||'''
test_file = 'test/fs/stale-lock-identity.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/fs/stale-lock-identity.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/stale-lock-identity.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^stale\slock\sidentity\srenewal\srefuses\sexpiry\safter\sits\slast\sawaited\swrite\sbarrier$']
expect_message = 'toEqual'

[[control]]
id = 'fs-lock-renewal-error-stops-on-takeover'
guards = 'a renewal that fails after another owner took the lock records the loss and stops, instead of retrying to extend a lock it no longer holds'
file = 'src/fs/refresh-file-lock.ts'
old = "if (owner?.ownerId !== ownerId) recordLoss('taken-over', owner)"
new = "if (false) recordLoss('taken-over', owner)"
test_file = 'test/fs/refresh-file-lock.test.ts'
runner = "command"
command = ["bun", "test", "test/fs/refresh-file-lock.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/refresh-file-lock.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^acquireRefreshFileLock\srenewal\serrors\sstop\simmediately\swhen\sownership\scannot\sremain\slive$']
expect_message = '/expect\(lock\.hasLost\(\)\)\.toBe\(true\)[\s\S]*Received: false/'

# --- atomic and staged file writes ---

[[control]]
id = 'atomic-write-stages-under-random-name'
guards = 'writeJsonAtomic stages under a fresh random name, never a predictable one another local user could pre-plant'
file = 'src/fs/atomic-write.ts'
old = 'const tempPath = `${path}.${(options.stageName ?? randomUUID)()}.tmp`'
new = 'const tempPath = `${path}.${(options.stageName ?? (() => String(process.pid)))()}.tmp` /* NON-VACUITY BREAK */'
test_file = 'test/fs/atomic-write.test.ts'
runner = "command"
command = ["bun", "test", "test/fs/atomic-write.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/atomic-write.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^atomic\swriter\sstages\seach\swrite\sunder\sa\sfresh\sunpredictable\sname$']
expect_message = '/Expected: not "state\.json\.\d+\.tmp"/'

[[control]]
id = 'atomic-write-stage-is-exclusive'
guards = "writeJsonAtomic creates its stage with O_EXCL ('wx'), so a planted file or symlink at the stage name is refused, not followed"
file = 'src/fs/atomic-write.ts'
old = "handle = await open(tempPath, 'wx', 0o600)"
new = "handle = await open(tempPath, 'w', 0o600)"
test_file = 'test/fs/atomic-write.test.ts'
runner = "command"
command = ["bun", "test", "test/fs/atomic-write.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/atomic-write.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^atomic\swriter\srefuses\san\sexisting\sstage\ssymlink$']
expect_message = 'Received promise that resolved'

[[control]]
id = 'atomic-write-stage-is-0600-before-rename'
guards = 'writeJsonAtomic chmods its stage to 0600 before the rename, whatever the umask'
file = 'src/fs/atomic-write.ts'
old = 'await handle.chmod(0o600)'
new = '/* NON-VACUITY BREAK: private mode restoration omitted */'
test_file = 'test/fs/atomic-write.test.ts'
runner = "command"
command = ["bun", "test", "test/fs/atomic-write.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/atomic-write.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^atomic\swriter\srestores\sprivate\smode\sdespite\srestrictive\sumask$']
expect_message = '/Expected: 384\s+Received: 0/'

[[control]]
id = 'atomic-write-cleans-only-its-own-stage'
guards = 'writeJsonAtomic removes a stage only when it created it, never a colliding file it failed to create'
file = 'src/fs/atomic-write.ts'
old = 'if (created) await rm(tempPath, { force: true }).catch(() => {})'
new = 'await rm(tempPath, { force: true }).catch(() => {})'
test_file = 'test/fs/atomic-write.test.ts'
runner = "command"
command = ["bun", "test", "test/fs/atomic-write.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/atomic-write.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^atomic\swriter\srefuses\san\sexisting\sstage\sfile$']
expect_message = "/ENOENT: no such file or directory, (lstat|statx) '[^']*state\\.json\\.seeded\\.tmp'/"

[[control]]
id = 'port-file-stages-under-random-name'
guards = 'writePortFile stages the token-bearing port file under a random name, so a stale file at the old pid-based name cannot block or capture it'
file = 'src/rpc/port-file.ts'
old = 'const tmp = `${target}.${(options.stageName ?? randomUUID)()}.tmp`'
new = 'const tmp = `${target}.${(options.stageName ?? (() => String(process.pid)))()}.tmp` /* NON-VACUITY BREAK */'
test_file = 'test/rpc/staging-security.test.ts'
runner = "command"
command = ["bun", "test", "test/rpc/staging-security.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/rpc/staging-security.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^port\sstaging\sprotects\sold\sfile\sunder\sBun$']
expect_message = "/EEXIST: file already exists, open '[^']*port-123\\.json\\.\\d+\\.tmp'/"

[[control]]
id = 'port-file-cleans-only-its-own-stage'
guards = 'writePortFile unlinks a stage only when it created it, never a colliding file at the stage name'
file = 'src/rpc/port-file.ts'
old = 'if (created) await unlink(tmp).catch(() => {})'
new = 'await unlink(tmp).catch(() => {})'
test_file = 'test/rpc/staging-security.test.ts'
runner = "command"
command = ["bun", "test", "test/rpc/staging-security.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/rpc/staging-security.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^port\sstaging\sprotects\scollision\sfile\sunder\sBun$']
expect_message = "/ENOENT: no such file or directory, (lstat|statx) '[^']*port-123\\.json\\.seeded\\.tmp'/"

[[control]]
id = 'dump-response-stage-is-exclusive'
guards = "the dump's replaceFile creates its stage with O_EXCL ('wx'), so a planted symlink at the stage name is never followed"
file = 'src/dump/index.ts'
old = "handle = await open(staging, 'wx', 0o600)"
new = "handle = await open(staging, 'w', 0o600)"
test_file = 'test/dump/dump.test.ts'
runner = "command"
command = ["bun", "test", "test/dump/dump.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/dump/dump.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^response\sdump\srefuses\san\sexisting\sstage\ssymlink$']
expect_message = '/expect\(received\)\.toBeUndefined\(\)\s+Received: "[^"]*\.response\.json"/'

[[control]]
id = 'enrollment-state-is-0600-before-rename'
guards = 'the Claustrum enrollment state (which holds the request secret) is chmodded to 0600 before its rename, whatever the umask'
file = 'src/claustrum/enrollment.ts'
old = '''
    await descriptor.chmod(0o600)
    await descriptor.sync()'''
new = '    await descriptor.sync()'
test_file = 'test/claustrum/enrollment.test.ts'
runner = "command"
command = ["bun", "test", "test/claustrum/enrollment.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/claustrum/enrollment.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^ClaustrumEnrollmentManager\spersists\sthe\senrollment\sstate\s0600\sdespite\sa\sumask\sthat\sstrips\sowner\swrite$']
expect_message = '/Expected: 384\s+Received: 256/'

# --- account store: crash safety, stamps, epochs, fences ---

[[control]]
id = 'store-torn-row-is-not-a-candidate'
guards = 'a row left half-replaced by a crash between the two replace writes is shown completed but is never a routing candidate'
file = 'src/store/torn.ts'
old = '''
      row.torn = true
      row.candidate = false'''
new = '      row.torn = true'
test_file = 'test/store/torn.test.ts'
runner = "command"
command = ["bun", "test", "test/store/torn.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/torn.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^a\sreplace\storn\sbetween\sits\swrites\sa\srow\storn\sbetween\sthe\swrites\sof\sreplace\sis\sshown\sas\sthe\sreplacement,\sis\sno\scandidate,\sand\sthe\snext\swrite\scompletes\sit$']
expect_message = '/\+\s+"candidate": true/'

[[control]]
id = 'store-pull-refuses-torn-row'
guards = 'a quota reading is never recorded against a row torn between the two writes of an operation (here a first-identity record)'
file = 'src/store/attribution.ts'
old = '''
          row.torn ||
          !entry ||'''
new = '          !entry ||'
test_file = 'test/store/torn.test.ts'
runner = "command"
command = ["bun", "test", "test/store/torn.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/torn.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^crash\stable:\severy\swrite\sstep\sof\severy\soperation\sthat\swrites\sa\srow\sa\scrash\sat\safter-state-write\sof\srecordIdentity\sof\sa\sfirst\sidentity\sshows\sa\sfresh\sreader,\sa\sfresh\spull\sand\sthe\snext\swrite\sonly\swhole\srows$']
expect_message = '/expect\(recorded\)\.toBe\(false\)[\s\S]*Received: true/'

[[control]]
id = 'store-strict-unbound-row-is-not-a-candidate'
guards = 'with requireCredentialStamps, a row whose stamp is not bound loads unbound and is never a routing candidate'
file = 'src/store/torn.ts'
old = '''
      row.unbound = true
      row.candidate = false'''
new = '      row.unbound = true'
test_file = 'test/store/credential-stamps.test.ts'
runner = "command"
command = ["bun", "test", "test/store/credential-stamps.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/credential-stamps.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^credential\sstamp\sstatus\severy\scrafted\srow\sloads\swith\sits\sstamp\sstatus,\sand\sonly\sstrict\smode\smakes\sit\sunbound$']
expect_message = '/\+\s+"tightCandidate": true/'

[[control]]
id = 'store-strict-operations-refuse-unbound-rows'
guards = 'a strict store refuses every operation on an unbound row before any provider call or write'
file = 'src/store/runtime.ts'
old = '''
  if (row.unbound)
    throw refusal('''
new = '''
  if (false)
    throw refusal('''
test_file = 'test/store/credential-stamps.test.ts'
runner = "command"
command = ["bun", "test", "test/store/credential-stamps.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/credential-stamps.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^strict\smode\srefuses\sunbound\srows\sstrict\srefresh\srefuses\severy\sunbound\srow\sbefore\sthe\sprovider\scall\sand\swrites\snothing$']
expect_message = 'expected a rejection'

[[control]]
id = 'store-dispatch-digest-covers-access-token'
guards = 'the stamp dispatch digest covers the OAuth access token, so an access-only bearer swap leaves the row unbound'
file = 'src/store/schema.ts'
old = "typeof credential.access === 'string' ? credential.access : null,"
new = 'null,'
test_file = 'test/store/stamp-coverage.test.ts'
runner = "command"
command = ["bun", "test", "test/store/stamp-coverage.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/stamp-coverage.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^stamps\scover\sthe\stoken\ssent\sand\sthe\saccount\sand\sendpoint\sit\sgoes\sto\sstrict\smode\smust\sreject\san\saccess-only\sbearer\sswap$']
expect_message = '/\+\s+"stamp": "bound"/'

[[control]]
id = 'store-dispatch-digest-covers-expiry'
guards = 'the stamp dispatch digest covers the expiry, so a strict store does not complete a torn replace whose expiry was changed'
file = 'src/store/schema.ts'
old = '''
          typeof credential.expires === 'number' &&
          Number.isFinite(credential.expires)
            ? credential.expires
            : null,'''
new = '          null,'
test_file = 'test/store/strict-torn-dispatch.test.ts'
runner = "command"
command = ["bun", "test", "test/store/strict-torn-dispatch.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/strict-torn-dispatch.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^a\sstrict\sstore\sand\sa\storn\sreplace\swhose\sstamp\sno\slonger\sdescribes\sthe\scredential\sa\sstrict\sstore\sneither\scompletes\snor\soperates\son\sa\storn\sOAuth\sreplace\swhose\sexpiry\swas\schanged$']
expect_message = '/\+\s+"torn": true/'

[[control]]
id = 'store-strict-torn-replace-completes-only-on-matching-credential'
guards = 'a strict store completes an interrupted replace only when the stamp dispatch digest still matches the credential beside it'
file = 'src/store/torn.ts'
old = '''
          dispatchDigest(projectedReplacement(row.credential, stamp.binding))
        )
          continue'''
new = '''
          dispatchDigest(projectedReplacement(row.credential, stamp.binding))
        )
          void 0'''
test_file = 'test/store/strict-torn-dispatch.test.ts'
runner = "command"
command = ["bun", "test", "test/store/strict-torn-dispatch.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/strict-torn-dispatch.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^a\sstrict\sstore\sand\sa\storn\sreplace\swhose\sstamp\sno\slonger\sdescribes\sthe\scredential\sstrict\scorrupted-dispatch\storn\sreplacement\smust\srefuse\sbefore\sany\sconfig\srepair$']
expect_message = '/\+\s+"torn": true/'

[[control]]
id = 'store-strict-transition-compares-dispatch'
guards = 'a strict store completes a pending stamped transition only when its dispatch digest still matches the loaded credential, never repairing config before refusing edited material'
file = 'src/store/torn.ts'
old = '''      if (
        options.requireCredentialStamps &&
        stamp.dispatch !== dispatchDigest(row.credential)
      )
        continue'''
new = '      // NON-VACUITY BREAK: complete transitions without validating dispatch.'
test_file = 'test/store/strict-torn-transition.test.ts'
runner = "command"
command = ["bun", "test", "test/store/strict-torn-transition.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/strict-torn-transition.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^strict\storn\srefresh\stransition\saccess-only\sedit\srefuses\sa\sreal-crash\stransition\swithout\srepairing\sfile\sbytes$']
expect_message = '/error: strict transition refusal preserves state and config bytes/'

[[control]]
id = 'store-interrupted-add-compares-endpoint'
guards = 'a strict replay compares the full endpoint stamped by an interrupted API add before completing its roster row'
file = 'src/store/rows.ts'
old = '    if (credential.baseURL.trim() !== stamp.binding.baseURL) return refuse()'
new = '    // NON-VACUITY BREAK: accept a different endpoint.'
test_file = 'test/store/strict-interrupted-add.test.ts'
runner = "command"
command = ["bun", "test", "test/store/strict-interrupted-add.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/strict-interrupted-add.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^strict\sinterrupted\sadd\sAPI\sreplay\srefuses\sa\sdifferent\sendpoint\swithout\schanging\sbytes$']
expect_message = '/error: strict interrupted add refuses conflicting material\s+Expected constructor: \[class PoolOperationError extends Error\]\s+Received value: undefined/'

[[control]]
id = 'store-interrupted-add-compares-header'
guards = 'a strict replay compares the effective auth header stamped by an interrupted API add before completing its roster row'
file = 'src/store/rows.ts'
old = '''    if (
      (credential.authHeader ?? 'authorization-bearer') !==
      stamp.binding.authHeader
    )
      return refuse()'''
new = '    // NON-VACUITY BREAK: accept a different header.'
test_file = 'test/store/strict-interrupted-add.test.ts'
runner = "command"
command = ["bun", "test", "test/store/strict-interrupted-add.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/strict-interrupted-add.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^strict\sinterrupted\sadd\sAPI\sreplay\srefuses\sa\sdifferent\sheader\swithout\schanging\sbytes$']
expect_message = '/error: strict interrupted add refuses conflicting material\s+Expected constructor: \[class PoolOperationError extends Error\]\s+Received value: undefined/'

[[control]]
id = 'store-interrupted-add-validates-before-recovery'
guards = 'strict add validates an existing state-only orphan rather than overwriting it with incoming material before a config write'
file = 'src/store/rows.ts'
old = '    !rt.ctx.requireCredentialStamps ||'
new = '    Boolean(true) || // NON-VACUITY BREAK: recover without validating the orphan.'
test_file = 'test/store/strict-interrupted-add.test.ts'
runner = "command"
command = ["bun", "test", "test/store/strict-interrupted-add.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/strict-interrupted-add.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^strict\sinterrupted\sadd\sAPI\sreplay\srefuses\sa\sdifferent\skey\swithout\schanging\sbytes$']
expect_message = '/error: strict interrupted add refuses conflicting material\s+Expected constructor: \[class PoolOperationError extends Error\]\s+Received value: undefined/'

[[control]]
id = 'store-lock-order-row-then-extra-then-store'
guards = 'add takes the row lock and provider-wide lock before the extra locks, and those before the store locks'
file = 'src/store/rows.ts'
old = '''
      await locks.acquire(rowLockSpec(rt, { id, identity }))
      if (credential.type === 'oauth')
        await locks.acquire(options.providerLock ?? rt.providerLock)
      for (const extra of options.extraLocks ?? []) await locks.acquire(extra)'''
new = '''
      for (const extra of options.extraLocks ?? []) await locks.acquire(extra)
      await locks.acquire(rowLockSpec(rt, { id, identity }))
      if (credential.type === 'oauth')
        await locks.acquire(options.providerLock ?? rt.providerLock)'''
test_file = 'test/store/row-extra-locks.test.ts'
runner = "command"
command = ["bun", "test", "test/store/row-extra-locks.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/row-extra-locks.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^add,\sreplace,\srotate\sand\srecordIdentity\stake\sextra\slocks\safter\sthe\srow\sand\sprovider-wide\slocks\sand\sbefore\sthe\sstore\slocks$']
expect_message = '/\+\s+"(?:row-acct-1|extra-1)@state"/'

[[control]]
id = 'store-readded-id-starts-past-retired-epochs'
guards = 'a removed and re-added id starts past every credential epoch it held, so work attributed to the old credential never matches the new one'
file = 'src/store/schema.ts'
old = '    Math.max(retiredEpochIn(config, id) ?? 0, entryEpochIn(config, id) ?? 0) + 1'
new = '    (entryEpochIn(config, id) ?? 0) + 1'
test_file = 'test/store/id-reuse.test.ts'
runner = "command"
command = ["bun", "test", "test/store/id-reuse.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/id-reuse.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^a\sre-added\sid\sstarts\spast\severy\sepoch\sit\sheld,\sincluding\sthose\sof\sreplaced\scredentials$']
expect_message = '/Expected: 3\s+Received: 1/'

[[control]]
id = 'store-attributed-transition-is-epoch-fenced'
guards = 'an attributed disable or enable issued for a credential the row no longer holds is refused and writes nothing'
file = 'src/store/rows.ts'
old = '            assertRowAttribution(operation, id, row, fence)'
new = '            void fence'
test_file = 'test/store/row-transition.test.ts'
runner = "command"
command = ["bun", "test", "test/store/row-transition.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/row-transition.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^an\sattributed\sdisable\sfor\sa\scredential\sthe\srow\sno\slonger\sholds\sis\srefused\sand\swrites\snothing$']
expect_message = 'expected a rejection'

[[control]]
id = 'store-attributed-replace-is-fenced'
guards = 'replace checks the locked row attribution before any hook, stamp, state write or config write, so a late replacement cannot overwrite a successor'
file = 'src/store/rows.ts'
old = "            assertRowAttribution('replace', id, tx.row(id), options.attribution)"
new = '            void options.attribution // NON-VACUITY BREAK'
test_file = 'test/store/row-write-attribution.test.ts'
runner = "command"
command = ["bun", "test", "test/store/row-write-attribution.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/row-write-attribution.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^an\sattributed\sreplace\swith\sa\sstale\sepoch\srefuses\sbefore\shooks\sand\swrites\snothing$']
expect_message = 'expected a rejection'

[[control]]
id = 'store-attributed-rotate-is-fenced'
guards = 'rotate checks the locked row attribution before any stamp or file write, so a late rotation cannot overwrite a successor'
file = 'src/store/rows.ts'
old = "            assertRowAttribution('rotate', id, tx.row(id), options.attribution)"
new = '            void options.attribution // NON-VACUITY BREAK'
test_file = 'test/store/row-write-attribution.test.ts'
runner = "command"
command = ["bun", "test", "test/store/row-write-attribution.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/row-write-attribution.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^an\sattributed\srotate\swith\sa\sstale\sepoch\srefuses\sbefore\shooks\sand\swrites\snothing$']
expect_message = 'expected a rejection'

[[control]]
id = 'store-attribution-compares-exact-identity'
guards = 'the shared transition and credential-write fence compares identity exactly: an absent identity never matches a row that records one'
file = 'src/store/rows.ts'
old = '    row.identity !== fence.identity'
new = '    false // NON-VACUITY BREAK'
test_file = 'test/store/row-write-attribution.test.ts'
runner = "command"
command = ["bun", "test", "test/store/row-write-attribution.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/row-write-attribution.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^an\sattributed\sreplace\srefuses\sabsent\sagainst\srecorded\sand\swrites\snothing$']
expect_message = 'expected a rejection'

[[control]]
id = 'store-replacement-hook-receives-previous-identity'
guards = 'onReplace receives the identity recorded on the locked row before replacement, separately from the incoming identity'
file = 'src/store/provider-state.ts'
old = '''
          ...(row.identity !== undefined
            ? { previousIdentity: row.identity }
            : {}),'''
new = '          // NON-VACUITY BREAK: omit the previously recorded identity.'
test_file = 'test/store/replacement-identity.test.ts'
runner = "command"
command = ["bun", "test", "test/store/replacement-identity.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/replacement-identity.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^onReplace\sreceives\sthe\sprevious\srecorded\sidentity\sbeside\sthe\sincoming\sidentity$']
expect_message = '/-\s+"previousIdentity": "acct-a"/'

[[control]]
id = 'store-refresh-detects-identity-contradiction'
guards = 'a refresh that returns another account than the row records is reported as identity-contradicted: the successor is persisted, the row disabled and not propagated'
file = 'src/store/refresh.ts'
old = '''
            current.identity !== result.identity
              ? {'''
new = '''
            current.identity === result.identity
              ? {'''
test_file = 'test/store/refresh.test.ts'
runner = "command"
command = ["bun", "test", "test/store/refresh.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/refresh.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^refresh\sidentity\scontinuity\sa\scontradicted\sknown\sidentity\spersists\sthe\ssuccessor\sbound\sbut\sdisabled\swithout\spropagating\sit$']
expect_message = '/\+\s+"status": "rotated"/'

[[control]]
id = 'store-refresh-contradiction-disable-is-in-the-state-write'
guards = 'the identity-contradiction disable is stamped into the state write that persists the successor, so a crash before the config write never exposes it enabled'
file = 'src/store/refresh.ts'
old = '''
            transition,
            identity: learnt,'''
new = '            identity: learnt,'
test_file = 'test/store/crash.test.ts'
runner = "command"
command = ["bun", "test", "test/store/crash.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/crash.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^a\scontradicted\srefresh\scrash\sat\safter-state-write\snever\sexposes\srotated\senabled\scredentials$']
expect_message = '/\+\s+"enabled": true/'

[[control]]
id = 'store-enable-refuses-identity-contradicted-row'
guards = 'a plain enable of an identity-contradicted row is refused until an identity-validated replacement'
file = 'src/store/rows.ts'
old = '''
            flag.enabled &&
            row.disabledReason?.startsWith(IDENTITY_CONTRADICTED_REASON_PREFIX)'''
new = '''
            flag.enabled &&
            row.disabledReason?.startsWith('never-a-reason-prefix: ')'''
test_file = 'test/store/refresh.test.ts'
runner = "command"
command = ["bun", "test", "test/store/refresh.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/refresh.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^refresh\sidentity\scontinuity\sa\scontradicted\sknown\sidentity\spersists\sthe\ssuccessor\sbound\sbut\sdisabled\swithout\spropagating\sit$']
expect_message = 'expected a rejection'

# --- Claustrum vault consumer ---

[[control]]
id = 'claustrum-admits-captured-antigravity-wire'
guards = 'the captured antigravity auth_method and refresh adapter reach an asserted OAuth receipt through the real client decoder, rather than silently disappearing from the roster'
file = 'src/claustrum/custody.ts'
old = "  if (!row.operations.includes('read')) return undefined"
new = '''  if (!row.operations.includes('read')) return undefined
  // NON-VACUITY BREAK: refuse the antigravity refresh adapter.
  if (row.refreshAdapter === 'antigravity') return undefined'''
test_file = 'test/claustrum/antigravity-wire.test.ts'
runner = "command"
command = ["bun", "test", "test/claustrum/antigravity-wire.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/claustrum/antigravity-wire.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^the\scaptured\santigravity\swire\scredential\sroutes\sand\sserves\san\sasserted\sOAuth\sreceipt$']
expect_message = '/Expected length: 1\s+Received length: 0/'

[[control]]
id = 'claustrum-receipt-carries-served-project-id'
guards = 'the Google Cloud project id served by get_scoped reaches the send receipt instead of being silently dropped'
file = 'src/claustrum/custody.ts'
old = '''
          ...(served.projectId !== undefined && {
            projectId: served.projectId,
          }),'''
new = '          // NON-VACUITY BREAK: omit the served project id from the receipt.'
test_file = 'test/claustrum/e2e.test.ts'
runner = "command"
command = ["bun", "test", "test/claustrum/e2e.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/claustrum/e2e.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^a\sscoped\ssend\sreceipt\scarries\sonly\sthe\svault-served\sproject\sid$']
expect_message = '/Expected: "vault-project"\s+Received: undefined/'

[[control]]
id = 'claustrum-absent-grants-mean-unknown'
guards = 'a vault list reply without grant fields leaves the consumer grant reach unknown, so a plugin never tells a user they hold no grant when the vault simply did not say'
file = 'src/claustrum/custody.ts'
old = 'if (grants === undefined || grantTuples === undefined) return undefined'
new = 'if (grants === undefined || grantTuples === undefined) return { grants: 0, tuples: [] } // NON-VACUITY BREAK: read absent grant fields as zero grants'
test_file = 'test/claustrum/grant-reach.test.ts'
runner = "command"
command = ["bun", "test", "test/claustrum/grant-reach.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/claustrum/grant-reach.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^a\svault\sthat\ssends\sno\sgrant\sfields\sleaves\sthe\sgrant\sreach\sunknown,\snot\szero$']
expect_message = 'toBeUndefined'

[[control]]
id = 'claustrum-reports-only-401'
guards = 'only a 401 is reported to the vault; 429, 402 and 5xx are never reported as authentication failures'
file = 'src/claustrum/custody.ts'
old = 'if (status !== 401) return'
new = 'if (status < 400) return'
test_file = 'test/claustrum/custody.test.ts'
runner = "command"
command = ["bun", "test", "test/claustrum/custody.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/claustrum/custody.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^scoped\scustody\sdispatch\sauthorization\sreports\sonly\s401\susing\sexact\ssend-time\senrollment\sand\sserved\sversion$']
expect_message = '/Expected length: 0\s+Received length: 1/'

[[control]]
id = 'claustrum-401-reports-the-served-record-version'
guards = 'a final 401 is reported against the receipt (record version) the failing send was actually served, including after a retry'
file = 'src/claustrum/consumer.ts'
old = '''
        served = current
        response = await dispatch(current, signal)'''
new = '        response = await dispatch(current, signal)'
test_file = 'test/claustrum/consumer.test.ts'
runner = "command"
command = ["bun", "test", "test/claustrum/consumer.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/claustrum/consumer.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^profile\s401\sretries\sthe\snew\srecord\sand\sreports\sits\sversion\sif\sit\salso\sfails$']
expect_message = '/Expected: 4\s+Received: 3/'

[[control]]
id = 'claustrum-incomplete-reply-marks-unlisted-account-stale'
guards = 'an incomplete vault reply keeps an account it does not account for as a stale row, not a live one'
file = 'src/claustrum/roster.ts'
old = '''
        ...(aliases.length && { aliases }),
        stale: true,'''
new = '        ...(aliases.length && { aliases }),'
test_file = 'test/claustrum/roster.test.ts'
runner = "command"
command = ["bun", "test", "test/claustrum/roster.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/claustrum/roster.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^a\smalformed\sor\sduplicated\sfallback\srecord\skeeps\sits\saccount\sas\sstale$']
expect_message = '/-\s+"stale": true/'

[[control]]
id = 'claustrum-relisted-credential-is-stripped-from-stale-row'
guards = 'a credential an incomplete reply lists under another account is taken out of its old stale row, so it is never authorized under two accounts'
file = 'src/claustrum/roster.ts'
old = '''
    const [credentialId, ...aliases] = memberIds(row).filter(
      (id) => !listed.has(id),
    )'''
new = '''
    const [credentialId, ...aliases] = memberIds(row).filter(
      (id) => id !== '',
    )'''
test_file = 'test/claustrum/consumer.test.ts'
runner = "command"
command = ["bun", "test", "test/claustrum/consumer.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/claustrum/consumer.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^a\scredential\san\sincomplete\sreply\sre-lists\sunder\sanother\saccount\sis\snever\sauthorized\sor\squota-recorded\sunder\sits\sold\saccount$']
expect_message = '/\+\s+"vault:oauth:test~/'

[[control]]
id = 'claustrum-decline-follows-the-account'
guards = 'a decline is keyed on the provider account, so a new credential id or alias of the same account stays declined'
file = 'src/claustrum/interlock.ts'
old = '''
  if (entry.accountIdentity !== undefined && accountIdentity !== undefined)
    return entry.accountIdentity === accountIdentity
  return entry.credentialId === credentialId'''
new = '  return entry.credentialId === credentialId'
test_file = 'test/claustrum/roster.test.ts'
runner = "command"
command = ["bun", "test", "test/claustrum/roster.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/claustrum/roster.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^a\sdeclined\saccount\sstays\sdeclined\sunder\sa\snew\scredential\sid\sor\salias,\sand\safter\sleaving\sand\sreturning$']
expect_message = '/Expected: false\s+Received: true/'

[[control]]
id = 'claustrum-private-group-refuses-other-member'
guards = 'a group-writable enrollment ancestor is accepted only when the group lists no member other than the effective user'
file = 'src/claustrum/enrollment.ts'
old = "members.split(',').every((member) => member === name)"
new = 'true /* NON-VACUITY BREAK: accept another explicit group member */'
test_file = 'test/claustrum/enrollment-ancestors.test.ts'
runner = "command"
command = ["bun", "test", "test/claustrum/enrollment-ancestors.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/claustrum/enrollment-ancestors.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^refuses\sa\sgroup-writable\sancestor\swith\sanother\sexplicit\sgroup\smember$']
expect_message = 'Received promise that resolved'

[[control]]
id = 'claustrum-private-group-refuses-other-primary-user'
guards = 'a group-writable enrollment ancestor is refused when another user has that group as its primary group'
file = 'src/claustrum/enrollment.ts'
old = '!users.some((user) => Number(user[2]) !== uid && Number(user[3]) === gid)'
new = 'true /* NON-VACUITY BREAK: accept another primary-group user */'
test_file = 'test/claustrum/enrollment-ancestors.test.ts'
runner = "command"
command = ["bun", "test", "test/claustrum/enrollment-ancestors.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/claustrum/enrollment-ancestors.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^refuses\sa\sgroup-writable\sancestor\swith\sanother\sprimary-gid\suser$']
expect_message = 'Received promise that resolved'

[[control]]
id = 'claustrum-request-path-token-read-skips-ancestor-check'
guards = 'the per-request token read does not run the setup-time ancestor check, so an owner-only token below a non-private writable ancestor still authorizes'
file = 'src/claustrum/enrollment.ts'
old = '''
  const value = await readBoundedJson(tokenPath)
  if (value === undefined)
    throw new ClaustrumConsumerError(
      'not-enrolled','''
new = '''
  await refuseWritableAncestor(dirname(tokenPath))
  const value = await readBoundedJson(tokenPath)
  if (value === undefined)
    throw new ClaustrumConsumerError(
      'not-enrolled','''
test_file = 'test/claustrum/enrollment-ancestors.test.ts'
runner = "command"
command = ["bun", "test", "test/claustrum/enrollment-ancestors.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/claustrum/enrollment-ancestors.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^authorizes\swith\san\sowner-only\stoken\sbelow\sa\snon-private\swritable\sancestor$']
expect_message = 'Claustrum enrollment path has a writable ancestor'

# --- sidebar RPC: port files, proxy bypass, request limits ---

[[control]]
id = 'rpc-stop-closes-incomplete-headers'
guards = 'stop closes a peer that sent incomplete headers, including a peer Bun 1.3.14 does not expose through the connection event'
file = 'src/rpc/rpc-server.ts'
old = '''
        server.closeAllConnections?.()
        server.close(() => resolve())'''
new = '''
        server.close(() => resolve())
        server.closeAllConnections?.()'''
test_file = 'test/rpc/stop-incomplete-headers.test.ts'
runner = "command"
command = ["bun", "test", "test/rpc/stop-incomplete-headers.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/rpc/stop-incomplete-headers.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^RPC\sstop\scloses\sa\speer\sthat\ssent\sincomplete\sheaders$']
expect_message = '/error: stop closes the peer that sent incomplete headers[\s\S]*Received: false/'

[[control]]
id = 'rpc-stop-removes-port-file-only-if-token-matches'
guards = "stop removes the port file only when it still holds this server's token, so a successor's file survives"
file = 'src/rpc/rpc-server.ts'
old = 'if (current?.port === port && current.token === token)'
new = 'if (current?.port === port)'
test_file = 'test/rpc/rpc-server.test.ts'
runner = "command"
command = ["bun", "test", "test/rpc/rpc-server.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/rpc/rpc-server.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^stop\sport-file\sidentity\sfence:\sdifferent\stoken$']
expect_message = '/ENOENT: no such file or directory, open .*port-\d+\.json/'

[[control]]
id = 'rpc-stop-removes-port-file-only-if-port-matches'
guards = "stop removes the port file only when it still names this server's port, so a successor's file survives"
file = 'src/rpc/rpc-server.ts'
old = 'if (current?.port === port && current.token === token)'
new = 'if (current?.token === token)'
test_file = 'test/rpc/rpc-server.test.ts'
runner = "command"
command = ["bun", "test", "test/rpc/rpc-server.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/rpc/rpc-server.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^stop\sport-file\sidentity\sfence:\sdifferent\sport$']
expect_message = '/ENOENT: no such file or directory, open .*port-\d+\.json/'

[[control]]
id = 'rpc-client-never-routes-through-http-proxy'
guards = 'the loopback RPC client connects straight to the port file port and never to a configured HTTP proxy, which would see the bearer token'
file = 'src/rpc/rpc-client.ts'
old = "socket = connect({ host: '127.0.0.1', port: entry.port })"
new = "socket = connect({ host: '127.0.0.1', port: Number(new URL(process.env.HTTP_PROXY ?? `http://127.0.0.1:${entry.port}`).port) })"
test_file = 'test/rpc/client-proxy.test.ts'
runner = "command"
command = ["bun", "test", "test/rpc/client-proxy.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/rpc/client-proxy.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^loopback\sRPC\sclient\sbypasses\sHTTP_PROXY,\shttp_proxy\sand\sHTTPS_PROXY$']
expect_message = '/assert\.equal\(pending\.length, 1\)[\s\S]*actual: 0,/'

# Bun 1.3.14's fetch reuses a connection after the server answers 413 with
# "Connection: close", so the next request queues behind the unread upload and
# stalls. The server therefore half-closes the socket after the 413 and drains
# the rest of the upload for a bounded time. Bun 1.4.2 never reuses that
# connection, so on 1.4.2 this break survives: replay it with Bun 1.3.14, the
# version ci.yml pins. Measurements: research/load-probe/RPC-413-CLOSE.md.
[[control]]
id = 'rpc-declared-oversize-413-half-closes'
guards = 'a declared-oversize upload gets its 413 and then a bounded half-close of the connection, so the refused socket is not reused'
file = 'src/rpc/rpc-server.ts'
old = 'if (error.declaredOversize) {'
new = 'if (error.declaredOversize && !error.declaredOversize) {'
test_file = 'test/rpc/request-errors.test.ts'
runner = "command"
command = ["bun", "test", "test/rpc/request-errors.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/rpc/request-errors.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^a\srequest\sbody\sover\sthe\s1\sMiB\scap\sanswers\s413$']
expect_message = "/event\\.phase === 'socket-local-end'[\\s\\S]*Received: false/"

[[control]]
id = 'rpc-streamed-body-is-capped'
guards = 'a request body streamed without a declared length is refused with 413 once it grows past the 1 MB cap'
file = 'src/rpc/rpc-server.ts'
old = 'if (size > MAX_BODY_BYTES) {'
new = 'if (false) {'
test_file = 'test/rpc/request-errors.test.ts'
runner = "command"
command = ["bun", "test", "test/rpc/request-errors.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/rpc/request-errors.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^a\schunked\srequest\sbody\sthat\sgrows\spast\sthe\scap\sanswers\s413$']
expect_message = '/\+\s+"error": "invalid json"/'

[[control]]
id = 'rpc-malformed-pending-params-rejected-before-drain'
guards = 'a pending-notifications call with a malformed cursor or session is answered 400 without draining the queue'
file = 'src/rpc/rpc-server.ts'
old = '''
              throw new Error('invalid params')
            pending = {'''
new = '''
              void 0
            pending = {'''
test_file = 'test/rpc/pending.test.ts'
runner = "command"
command = ["bun", "test", "test/rpc/pending.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/rpc/pending.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^pending\srejects\smalformed\sdefault\scursors\sand\ssessions\swithout\sdraining$']
expect_message = '/Expected: 400\s+Received: 200/'

[[control]]
id = 'rpc-session-drains-only-its-own-notifications'
guards = "a session drain returns only that session's notifications and broadcasts, never another session's"
file = 'src/rpc/notifications.ts'
old = ': n.sessionId === undefined || n.sessionId === sessionId'
new = ': true'
test_file = 'test/rpc/notifications.test.ts'
runner = "command"
command = ["bun", "test", "test/rpc/notifications.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/rpc/notifications.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^notifications\ssession\sscoping:\sa\ssession\sonly\sdrains\sits\sown\s\+\sglobal$']
expect_message = '/\+\s+"fixture-dump"/'

[[control]]
id = 'rpc-sessionless-ack-cannot-prune-other-sessions'
guards = "a sessionless acknowledgement in the default mode prunes nothing, so it cannot consume another session's notifications"
file = 'src/rpc/notifications.ts'
old = 'return !broadcastOnly || n.sessionId !== undefined'
new = 'return false'
test_file = 'test/rpc/rpc-server.test.ts'
runner = "command"
command = ["bun", "test", "test/rpc/rpc-server.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/rpc/rpc-server.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^rpc-server\sa\ssession-less\snotification\sdrain\sdelivers\severy\snotice\sbut\scannot\sprune\sanother\ssession$']
expect_message = '/\+ \[\]/'

[[control]]
id = 'rpc-broadcast-only-sessionless-drain-gets-no-targeted'
guards = 'in broadcast-only mode a sessionless drain returns broadcasts only, never notifications targeted at a session'
file = 'src/rpc/notifications.ts'
old = '? !broadcastOnly || n.sessionId === undefined'
new = '? true'
test_file = 'test/rpc/sessionless-drain.test.ts'
runner = "command"
command = ["bun", "test", "test/rpc/sessionless-drain.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/rpc/sessionless-drain.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^a\sbroadcast-only\ssessionless\sdrain\sreturns\sbroadcasts\sand\snever\stargeted\snotifications$']
expect_message = '/\+\s+"session-a"/'

# --- credential scrubbing in commands and the logger ---

[[control]]
id = 'commands-seam-drops-credential-fields'
guards = 'the command seam drops credential-shaped properties from every payload it hands the host'
file = 'src/commands/seam.ts'
old = '''
    if (isCredentialName(name)) {
      report.dropped.push(`${path}.${name}`)'''
new = '''
    if (false) {
      report.dropped.push(`${path}.${name}`)'''
test_file = 'test/commands/seam.test.ts'
runner = "command"
command = ["bun", "test", "test/commands/seam.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/commands/seam.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^command\spayload\sseam\sa\splugin\ssection\sleaking\sa\scredential-shaped\sfield\sis\sscrubbed\sand\sthe\sdropped\snames\sare\swarned,\snever\sthe\svalues$']
expect_message = 'Expected to not contain: "rt-leak-2"'

[[control]]
id = 'commands-seam-redacts-string-values'
guards = 'every string crossing the command seam passes through the redactor'
file = 'src/commands/seam.ts'
old = 'const clean = report.redact(value)'
new = 'const clean = value'
test_file = 'test/commands/failure-projection.test.ts'
runner = "command"
command = ["bun", "test", "test/commands/failure-projection.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/commands/failure-projection.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^command\sfailure\sprojection\san\soutcome\stext\squoting\ssecrets\sis\smasked,\susing\sthe\splugin\spattern\sfor\sits\skey\sshape$']
expect_message = 'Expected to not contain: "synthetic-audit-secret"'

[[control]]
id = 'commands-unknown-failure-shows-generic-message'
guards = 'an exception the seam cannot vouch for is shown only as a generic code and message, never its raw text'
file = 'src/commands/seam.ts'
old = '''
    }
  return ACTION_FAILED
}'''
new = '''
    }
  return { code: ACTION_FAILED.code, text: String((error as Error)?.message ?? error) }
}'''
test_file = 'test/commands/failure-projection.test.ts'
runner = "command"
command = ["bun", "test", "test/commands/failure-projection.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/commands/failure-projection.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^command\sfailure\sprojection\sa\sthrown\sfailure\squoting\sa\sbearer\stoken\sshows\sonly\sthe\sgeneric\scode\sand\smessage$']
expect_message = '/\+\s+"text": "upstream said 401/'

[[control]]
id = 'logger-redacts-token-named-keys'
guards = 'the logger masks the values of compound token-named keys (accessToken, refreshToken, bearerToken)'
file = 'src/logger/redact.ts'
old = "(normalized.endsWith('token') && !normalized.endsWith('tokens')) ||"
new = 'false ||'
test_file = 'test/logger/engine.test.ts'
runner = "command"
command = ["bun", "test", "test/logger/engine.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/logger/engine.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^logger\sredaction\sredacts\scompound\ssecret\skeys\s\(accessToken,\sapiKey,\sclientSecret,\sbearerToken,\srefreshToken\)$']
expect_message = 'Expected to not contain: "should-be-redacted"'

[[control]]
id = 'logger-masks-token-shaped-values'
guards = 'the logger masks bearer tokens, sk- keys and JWTs inside any logged string'
file = 'src/logger/redact.ts'
old = 'const patterns = [TOKEN_VALUE, ...(options.extraValuePatterns ?? [])]'
new = 'const patterns = [...(options.extraValuePatterns ?? [])]'
test_file = 'test/logger/redact.test.ts'
runner = "command"
command = ["bun", "test", "test/logger/redact.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/logger/redact.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^scrubs\sembedded\seyJabc\sin\splace\swhile\spreserving\ssurrounding\smessage\stext$']
expect_message = 'Received: "before eyJabc after"'

[[control]]
id = 'logger-error-serialization-is-scrubbed'
guards = 'a logged Error is rendered through the same scrubbing walk, so a token in its message or stack is masked'
file = 'src/logger/redact.ts'
old = "if (error && errorDepth >= MAX_ERROR_DEPTH) return '[Truncated]'"
new = 'if (error) return { name: value.name, message: value.message, stack: value.stack }'
test_file = 'test/logger/errors.test.ts'
runner = "command"
command = ["bun", "test", "test/logger/errors.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/logger/errors.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^a\stoken\sinside\sa\slogged\serror\smessage\sand\sstack\sis\sredacted$']
expect_message = 'Received: "request failed for sk-fixture-not-a-real-key'

# --- routing and quota admission ---

[[control]]
id = 'routing-api-key-row-skips-quota'
guards = 'an API-key row is admitted without consulting quota'
file = 'src/routing/admission.ts'
old = '''
    if (row.kind === 'api-key') {
      survivors.push'''
new = '''
    if (false) {
      survivors.push'''
test_file = 'test/routing/admission.test.ts'
runner = "command"
command = ["bun", "test", "test/routing/admission.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/routing/admission.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^admission\sgates\sgate\s1:\san\sapi-key\srow\sis\sadmitted\swithout\squota$']
expect_message = '/\+ \[\]/'

[[control]]
id = 'routing-unknown-reset-fails-closed'
guards = 'an exhausted reading whose reset is missing, unparsable or past cannot confirm the exhaustion, so the row is refused as unknown (fail closed) and a pull is requested, never admitted'
file = 'src/routing/admission.ts'
old = 'if (futureResetAt(limit, now) === undefined) {'
new = 'if (false) {'
test_file = 'test/routing/admission.test.ts'
runner = "command"
command = ["bun", "test", "test/routing/admission.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/routing/admission.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^admission\sgates\sgate\s4:\san\sexhausted\sreading\swith\sa\smissing\sreset\sis\srefused\sunknown\swith\sa\spull$']
expect_message = '/expect\(result\.refused\)\.toEqual\(\[[\s\S]*\+ \[\]/'

[[control]]
id = 'routing-spent-credit-budget-is-refused'
guards = 'a row whose credit budget is known spent is refused while another path survives'
file = 'src/routing/admission.ts'
old = "refused.push({ id: row.id, stage: 2, reason: 'budget-spent', ...reset })"
new = 'admitted.push(row)'
test_file = 'test/routing/admission.test.ts'
runner = "command"
command = ["bun", "test", "test/routing/admission.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/routing/admission.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^admission\scredit\sbudget\sadmission\squota\sskips\sa\sfallback\swhose\scredit\sbudget\sis\sspent$']
expect_message = '/\+\s+"work-alt"/'

[[control]]
id = 'routing-sticky-pin-moves-only-on-confirmed-exhaustion'
guards = 'the move policy keeps a pin whose row is refused for unknown quota or excluded; only confirmed exhaustion or a killswitch verdict moves it'
file = 'src/routing/sticky.ts'
old = '''
      pinRefusal?.reason === 'exhausted' ||
      pinRefusal?.reason === 'budget-spent')'''
new = '      pinRefusal !== undefined)'
test_file = 'test/routing/sticky.test.ts'
runner = "command"
command = ["bun", "test", "test/routing/sticky.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/routing/sticky.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^routeSticky\srefused\spin\spolicy\sthe\smove\spolicy\skeeps\sa\spin\swhose\srow\sis\srefused\sfor\sunknown\squota\sor\sexcluded,\sserving\selsewhere$']
expect_message = '/\+\s+"action": "assign"/'

[[control]]
id = 'routing-sticky-pin-moves-on-killswitch'
guards = 'the move policy moves a pin whose row the killswitch kills'
file = 'src/routing/sticky.ts'
old = '(input.killswitch?.get(input.pin.accountId) === false ||'
new = '(false ||'
test_file = 'test/routing/sticky.test.ts'
runner = "command"
command = ["bun", "test", "test/routing/sticky.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/routing/sticky.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^routeSticky\srefused\spin\spolicy\sthe\smove\spolicy\smoves\sa\spin\swhose\srow\sthe\skillswitch\skills$']
expect_message = '/\+\s+"action": "retain"/'

# --- OpenCode 2 request hooks ---

[[control]]
id = 'opencode2-request-without-account-is-refused'
guards = 'a model request the adapter chose no account for is refused locally, never sent with the host credential'
file = 'src/opencode2/install.ts'
old = '''
          if (rec.accountId === undefined) throw noAccount(rec.scope)
          applyHeaderEdits(draft.headers, {'''
new = '          applyHeaderEdits(draft.headers, {'
test_file = 'test/opencode2/install.test.ts'
runner = "command"
command = ["bun", "test", "test/opencode2/install.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/install.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^installOpenCode2Auth\sa\srequest\swith\sno\saccount\sis\srefused\sand\sits\sretry\svetoed$']
expect_message = '/Expected constructor: \[class OpenCode2AuthError[^\n]*\nReceived value: undefined/'

[[control]]
id = 'opencode2-host-placeholder-never-leaves'
guards = "a request still carrying the host's placeholder credential is refused before it leaves"
file = 'src/opencode2/install.ts'
old = 'if (forbidden.some((secret) => value.includes(secret))) {'
new = 'if (false) {'
test_file = 'test/opencode2/install.test.ts'
runner = "command"
command = ["bun", "test", "test/opencode2/install.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/install.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^installOpenCode2Auth\sa\srequest\sstill\scarrying\sthe\shost\splaceholder\sis\srefused\sbefore\sit\sleaves$']
expect_message = "(evaluating 'http.kind')"

[[control]]
id = 'opencode2-unproven-response-is-dropped'
guards = 'an http.response whose request the installer did not produce is dropped, not attributed to an outstanding attempt'
file = 'src/opencode2/install.ts'
old = 'const rec = byRequest.get(draft.request)'
new = 'const rec = byRequest.get(draft.request) ?? newestOf(keyOf(draft.sessionID, draft.kind))'
test_file = 'test/opencode2/attempts.test.ts'
runner = "command"
command = ["bun", "test", "test/opencode2/attempts.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/attempts.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^installOpenCode2Auth\sattempts\sa\sresponse\sthe\shost\shands\sback\son\sanother\srequest\sobject\sis\sdropped,\seven\swith\sone\sattempt\soutstanding$']
expect_message = '/\+\s+"response:s1\/primary#1"/'

[[control]]
id = 'opencode2-ws-frame-rewrite-never-drops-a-frame'
guards = 'a WebSocket frame rewrite that returns nothing sends the original frame unchanged'
file = 'src/opencode2/install.ts'
old = 'if (frame !== undefined) draft.frame = frame'
new = "draft.frame = frame ?? ''"
test_file = 'test/opencode2/attempts.test.ts'
runner = "command"
command = ["bun", "test", "test/opencode2/attempts.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/attempts.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^installOpenCode2Auth\sWebSocket\sframe\srewrite\sa\srewrite\sreturning\sundefined\ssends\sthe\sframe\sunchanged$']
expect_message = 'Received: ""'

[[control]]
id = 'opencode2-selection-checks-after-choice'
guards = 'a forgotten selection refuses immediately after chooseAccount, before starting accountHeaders'
file = 'src/opencode2/install.ts'
old = '''    const accountId = await adapter.chooseAccount(input)
    assertActive()'''
new = '''    const accountId = await adapter.chooseAccount(input)
    // NON-VACUITY BREAK: omit the post-choice revocation check.'''
test_file = 'test/opencode2/revocation.test.ts'
runner = "command"
command = ["bun", "test", "test/opencode2/revocation.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/revocation.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^installOpenCode2Auth\srevocation\sforget\safter\schooseAccount\srefuses\smodel\.request\swithout\spublishing\sor\spreparing\sauth$']
expect_message = '/expect\(headerCalls\)\.toBe[\s\S]*Expected: 0\nReceived: 1/'

[[control]]
id = 'opencode2-selection-checks-after-headers'
guards = 'a forgotten selection refuses after accountHeaders, before remembering an attempt or emitting select'
file = 'src/opencode2/install.ts'
old = '''      const result = await adapter.accountHeaders({ ...scope, accountId })
      assertActive()'''
new = '''      const result = await adapter.accountHeaders({ ...scope, accountId })
      // NON-VACUITY BREAK: omit the post-headers revocation check.'''
test_file = 'test/opencode2/revocation.test.ts'
runner = "command"
command = ["bun", "test", "test/opencode2/revocation.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/revocation.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^installOpenCode2Auth\srevocation\sforget\safter\saccountHeaders\srefuses\smodel\.request\swithout\spublishing\sor\spreparing\sauth$']
expect_message = '/expect\(installation\.size\)\.toBe\(0\)[\s\S]*Expected: 0\nReceived: 1/'

[[control]]
id = 'opencode2-dispose-revokes-in-flight'
guards = 'dispose revokes selections not yet remembered as attempts, before removing hooks'
file = 'src/opencode2/install.ts'
old = '      for (const sessionID of inFlight.keys()) revokeSelections(sessionID)'
new = '      // NON-VACUITY BREAK: leave active selections alive on dispose.'
test_file = 'test/opencode2/revocation.test.ts'
runner = "command"
command = ["bun", "test", "test/opencode2/revocation.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/revocation.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^installOpenCode2Auth\srevocation\sdispose\safter\schooseAccount\srefuses\smodel\.request\swithout\spublishing\sor\spreparing\sauth$']
expect_message = '/expect\(headerCalls\)\.toBe[\s\S]*Expected: 0\nReceived: 1/'

[[control]]
id = 'opencode2-model-handoff-checks-revocation'
guards = 'model.request rechecks revocation after awaiting selection before publishing account headers'
file = 'src/opencode2/install.ts'
old = '''          assertActive()
          if (rec.accountId === undefined) throw noAccount(rec.scope)'''
new = '''          // NON-VACUITY BREAK: publish the revoked model selection.
          if (rec.accountId === undefined) throw noAccount(rec.scope)'''
test_file = 'test/opencode2/revocation.test.ts'
runner = "command"
command = ["bun", "test", "test/opencode2/revocation.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/revocation.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^installOpenCode2Auth\srevocation\sforget\sat\sthe\sselection\shandoff\srefuses\smodel\.request\sbefore\spublishing\sauth$']
expect_message = '/Expected constructor: \[class OpenCode2AuthError[^\n]*\nReceived value: undefined/'

[[control]]
id = 'opencode2-http-handoff-checks-revocation'
guards = 'http.request rechecks revocation after awaiting its attempt binding before preparing an authenticated request'
file = 'src/opencode2/install.ts'
old = '''                'http',
                mark,
                assertActive,
              )
          assertActive()'''
new = '''                'http',
                mark,
                assertActive,
              )
          // NON-VACUITY BREAK: prepare the revoked HTTP selection.'''
test_file = 'test/opencode2/revocation.test.ts'
runner = "command"
command = ["bun", "test", "test/opencode2/revocation.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/revocation.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^installOpenCode2Auth\srevocation\sforget\sat\sthe\sselection\shandoff\srefuses\shttp\.request\sbefore\spublishing\sauth$']
expect_message = '/Expected constructor: \[class OpenCode2AuthError[^\n]*\nReceived value: undefined/'

[[control]]
id = 'opencode2-http-rewrite-checks-revocation'
guards = 'http.request rechecks revocation after an asynchronous adapter rewrite before preparing auth'
file = 'src/opencode2/install.ts'
old = '''                })) ?? request
              assertActive()'''
new = '''                })) ?? request
              // NON-VACUITY BREAK: prepare auth after a revoked rewrite.'''
test_file = 'test/opencode2/revocation.test.ts'
runner = "command"
command = ["bun", "test", "test/opencode2/revocation.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/revocation.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^installOpenCode2Auth\srevocation\sforget\sduring\san\sHTTP\srewrite\srefuses\sthe\sprepared\sauthenticated\srequest$']
expect_message = '/Expected constructor: \[class OpenCode2AuthError[^\n]*\nReceived value: undefined/'

[[control]]
id = 'opencode2-ws-handoff-checks-revocation'
guards = 'the WebSocket handshake rechecks revocation after awaiting its attempt binding before publishing auth'
file = 'src/opencode2/install.ts'
old = '''                'ws',
                mark,
                assertActive,
              )
          assertActive()'''
new = '''                'ws',
                mark,
                assertActive,
              )
          // NON-VACUITY BREAK: publish the revoked WebSocket selection.'''
test_file = 'test/opencode2/revocation.test.ts'
runner = "command"
command = ["bun", "test", "test/opencode2/revocation.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/revocation.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^installOpenCode2Auth\srevocation\sforget\sat\sthe\sselection\shandoff\srefuses\sexperimental\.ws\.handshake\sbefore\spublishing\sauth$']
expect_message = '/Expected constructor: \[class OpenCode2AuthError[^\n]*\nReceived value: undefined/'

[[control]]
id = 'opencode2-retry-end-checks-revocation'
guards = 'retry rechecks revocation after waiting for onAttemptEnd, before recording or announcing a retry'
file = 'src/opencode2/install.ts'
old = '''              await rec.ended
              assertActive()'''
new = '''              await rec.ended
              // NON-VACUITY BREAK: retry after the forgotten attempt ends.'''
test_file = 'test/opencode2/revocation.test.ts'
runner = "command"
command = ["bun", "test", "test/opencode2/revocation.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/revocation.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^installOpenCode2Auth\srevocation\sforget\swhile\sretry\sawaits\sattempt\send\srefuses\slocally\swithout\sremembering\sa\sretry$']
expect_message = '/Expected constructor: \[class OpenCode2AuthError[^\n]*\nReceived value: \{/'

[[control]]
id = 'opencode2-retry-limit-checks-revocation'
guards = 'retry rechecks revocation after waiting for limit listeners, before recording or announcing a retry'
file = 'src/opencode2/install.ts'
old = '''              await rec.limit.delivered
              assertActive()'''
new = '''              await rec.limit.delivered
              // NON-VACUITY BREAK: reroute after the session was forgotten.'''
test_file = 'test/opencode2/revocation.test.ts'
runner = "command"
command = ["bun", "test", "test/opencode2/revocation.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/revocation.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^installOpenCode2Auth\srevocation\sforget\swhile\sretry\sawaits\slimit\slistener\srefuses\slocally\swithout\sremembering\sa\sretry$']
expect_message = '/Expected constructor: \[class OpenCode2AuthError[^\n]*\nReceived value: \{/'

[[control]]
id = 'opencode2-forget-revokes-in-flight'
guards = 'forgetSession revokes selections still inside adapter awaits, not only remembered attempts'
file = 'src/opencode2/install.ts'
old = '''  const forgetSession = (sessionID: string) => {
    revokeSelections(sessionID)'''
new = '''  const forgetSession = (sessionID: string) => {
    // NON-VACUITY BREAK: forget only attempts already remembered.'''
test_file = 'test/opencode2/revocation.test.ts'
runner = "command"
command = ["bun", "test", "test/opencode2/revocation.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/revocation.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^installOpenCode2Auth\srevocation\sforget\safter\schooseAccount\srefuses\smodel\.request\swithout\spublishing\sor\spreparing\sauth$']
expect_message = '/expect\(headerCalls\)\.toBe[\s\S]*Expected: 0\nReceived: 1/'

[[control]]
id = 'opencode2-selection-tracking-does-not-grow'
guards = 'settled selections release the private session map even without forgetSession; no tombstones accumulate'
file = 'src/opencode2/install.ts'
old = '''      if (selections.size === 0 && inFlight.get(scope.sessionID) === selections)
        inFlight.delete(scope.sessionID)'''
new = '      // NON-VACUITY BREAK: retain empty sets after selection settles.'
test_file = 'test/opencode2/revocation.test.ts'
runner = "command"
command = ["bun", "test", "test/opencode2/revocation.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/revocation.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^installOpenCode2Auth\srevocation\sin-flight\stracking\sdrops\sforgotten\ssessions\simmediately\sand\sall\stokens\swhen\sselections\ssettle$']
expect_message = '/expect\(tracking\?\.size\)\.toBe\(0\)[\s\S]*Expected: 0\nReceived: 1/'

# --- sidebar-file ---

[[control]]
id = 'sidebar-merge-rechecks-before-write'
guards = 'an update re-reads the file after merging and remerges when it changed, so a stale merge result is never written'
file = 'src/sidebar-file/sidebar-file.ts'
old = 'if ((await readRaw()) !== raw) continue'
new = 'if (false) continue'
test_file = 'test/sidebar-file/sidebar-file.test.ts'
runner = "command"
command = ["bun", "test", "test/sidebar-file/sidebar-file.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/sidebar-file/sidebar-file.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^merge\srechecks\snew\sbytes\sand\snever\swrites\sthe\sfirst\sresult$']
expect_message = '/expect\(seen\)\.toEqual\(\[1, 2\]\)[\s\S]*-\s+2,/'

# --- tui-build ---

[[control]]
id = 'tui-build-emits-one-copy-per-shared-module'
guards = 'a shared module reached from several importers is emitted once, so its consumers share one module instance'
file = 'src/tui-build/build-tui.ts'
old = '''
    const previous = copied.get(source)
    if (previous) return previous'''
new = '''
    const previous = copied.get(source)
    if (previous && source === '') return previous'''
test_file = 'test/tui-build/linking.test.ts'
runner = "command"
command = ["bun", "test", "test/tui-build/linking.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/tui-build/linking.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^inlined\sfs\sand\ssidebar\sconsumers\sshare\sone\sLockContentionError\sidentity$']
expect_message = 'is claimed by both'

[[control]]
id = 'tui-build-shared-names-are-package-relative'
guards = 'a shared module name is derived from its package name and package-relative path, never the absolute checkout path'
file = 'src/tui-build/build-tui.ts'
old = 'return `package:${name}/${portable(path)}`'
new = 'return `package:${name}/${source}`'
test_file = 'test/tui-build/reproducible.test.ts'
runner = "command"
command = ["bun", "test", "test/tui-build/reproducible.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/tui-build/reproducible.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^builds\sof\sone\ssource\sgraph\sfrom\stwo\scheckout\sdirectories\semit\sbyte-identical\strees$']
expect_message = '/expect\(\[\.\.\.b\.keys\(\)\]\)\.toEqual\(\[\.\.\.a\.keys\(\)\]\)/'

# --- dump ---

[[control]]
id = 'dump-counter-is-process-wide'
guards = 'the dump sequence counter is shared by every dumper in the process, so two dumpers never pick the same name in one millisecond'
edits = [
  { file = 'src/dump/index.ts', old = "  function remember(key: string, text: string): void {", new = "  let dumperCounter = 0\n  function remember(key: string, text: string): void {" },
  { file = 'src/dump/index.ts', old = "const counter = ++processDumpCounter", new = "const counter = ++dumperCounter" },
]
test_file = 'test/dump/dump.test.ts'
runner = "command"
command = ["bun", "test", "test/dump/dump.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/dump/dump.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^request\sdumps\stwo\sdumpers\sin\sone\sprocess\snever\scollide\sin\sthe\ssame\smillisecond$']
expect_message = '/expect\(received\)\.toBeDefined\(\)\s+Received: undefined/'

[[control]]
id = 'dump-sweep-evicts-oldest-first'
guards = 'the dump byte cap evicts whole dumps oldest first'
file = 'src/dump/index.ts'
old = 'left.newest - right.newest || leftName.localeCompare(rightName)'
new = 'right.newest - left.newest || leftName.localeCompare(rightName)'
test_file = 'test/dump/dump.test.ts'
runner = "command"
command = ["bun", "test", "test/dump/dump.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/dump/dump.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^dump\sdirectory\sbyte\scap\senforces\sthe\scap\sin\sa\sconfigured\scustom\sdump\sdirectory$']
expect_message = '/\+\s+"2026-07-17T12-00-00-000Z-4242-000001-session-http\.body\.json"/'

[[control]]
id = 'dump-sweep-stops-under-the-cap'
guards = 'the dump sweep stops evicting once the directory is under its cap'
file = 'src/dump/index.ts'
old = 'if (total <= maxBytes) break'
new = 'if (total < 0) break'
test_file = 'test/dump/dump.test.ts'
runner = "command"
command = ["bun", "test", "test/dump/dump.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/dump/dump.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^dump\sdirectory\sbyte\scap\sevicts\scomplete\sdump\sartifact\sgroups\sinstead\sof\sorphaning\srequest\spairs$']
expect_message = '/\+\s+"removed": 4/'

# --- scan guards ---

[[control]]
id = 'check-local-deps-rejects-outside-file-dependency'
guards = 'the local dependency checker fails on a file: dependency that resolves outside the repository'
file = 'scripts/check-local-deps.mjs'
old = '  if (outsideRoot(resolved)) {'
new = '  if (false) {'
test_file = 'test/tooling/check-local-deps.test.ts'
runner = "command"
command = ["bun", "test", "test/tooling/check-local-deps.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/tooling/check-local-deps.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^local\sdependency\schecker\srejects\san\soutside\sfile\sdependency$']
expect_message = '/expect\(result\.exitCode\)\.toBe\(1\)[\s\S]*Received: 0/'

[[control]]
id = 'check-installed-ranges-rejects-drift'
guards = 'the installed-range checker fails when an installed version is outside its declared range'
file = 'scripts/check-installed-ranges.mjs'
old = '} else if (!Bun.semver.satisfies(version, range)) {'
new = '} else if (false) {'
test_file = 'test/tooling/check-sources.test.ts'
runner = "command"
command = ["bun", "test", "test/tooling/check-sources.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/tooling/check-sources.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^installed\srange\schecker\senumerates\sroot\sand\sworkspace\sglobs\sand\srejects\sdrift$']
expect_message = '/expect\(drift\.exitCode\)\.toBe\(1\)[\s\S]*Received: 0/'

[[control]]
id = 'check-sources-counts-only-passed-tests'
guards = 'the docs/sources.md gate counts a test only when it passed: a skipped, failed or errored case does not satisfy a row'
file = 'scripts/check-sources.mjs'
old = "if (/<(?:skipped|failure|error)\\b/.test(match[2] ?? '')) continue"
new = 'void 0'
test_file = 'test/tooling/check-sources.test.ts'
runner = "command"
command = ["bun", "test", "test/tooling/check-sources.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/tooling/check-sources.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^source\schecker\sexcludes\sskipped,\sfailed\sand\serrored\ssynthetic\scases$']
expect_message = '/expect\(result\.exitCode\)\.toBe\(1\)[\s\S]*Received: 0/'

[[control]]
id = 'check-sources-rejects-empty-table'
guards = 'the docs/sources.md gate fails when it parses no test cells at all, instead of passing vacuously'
file = 'scripts/check-sources.mjs'
old = 'if (cells.length === 0 || unmatched.length > 0) {'
new = 'if (unmatched.length > 0) {'
test_file = 'test/tooling/check-sources.test.ts'
runner = "command"
command = ["bun", "test", "test/tooling/check-sources.test.ts", "-t", "{test}"]
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/tooling/check-sources.test.ts", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ['^source\schecker\srejects\sempty\stables\sand\sunmatched\scells$']
expect_message = '/expect\(empty\.exitCode\)\.toBe\(1\)[\s\S]*Received: 0/'

# --- idle CPU: shared preferences watcher and cached RPC discovery ---
# CAUGHT on Bun 1.3.14: each break is a named assertion, not a timing benchmark.

[[control]]
id = 'tui-prefs-subscribers-share-native-and-probe'
guards = 'bundled subscriptions to the same canonical preferences path share one native watcher and one metadata poll'
file = 'src/tui-prefs/watcher.ts'
old = 'const shared = registry.get(path)'
new = 'const shared = new Map<string, SharedWatcher>().get(path) // NON-VACUITY BREAK: create a watcher per subscriber.'
test_file = 'test/tui-prefs/watcher.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/tui-prefs/watcher.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/tui-prefs/watcher.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^bundled\ssubscribers\sshare\sone\snative\swatcher\sand\sone\sprobe\suntil\slast\sdisposal$']
expect_message = 'one native watcher for bundled subscribers'

[[control]]
id = 'tui-prefs-unchanged-probe-skips-read'
guards = 'unchanged metadata probes do not read preferences bytes, even over multiple polling intervals'
file = 'src/tui-prefs/watcher.ts'
old = 'if (!native && metadata === lastMetadata) return'
new = '// NON-VACUITY BREAK: read bytes on unchanged probes.'
test_file = 'test/tui-prefs/watcher.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/tui-prefs/watcher.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/tui-prefs/watcher.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^unchanged\smetadata\sprobes\sperform\szero\sfile\sreads\sover\sthree\sseconds$']
expect_message = 'unchanged probes must not read file bytes'

[[control]]
id = 'tui-prefs-failed-read-is-retried'
guards = 'a changed file whose read fails is read again on the next probe, so its new contents are never hidden by a recorded metadata value'
file = 'src/tui-prefs/watcher.ts'
old = '''      if (text === null) return
      lastMetadata = metadata
      if (text === lastSeen) return'''
new = '''      lastMetadata = metadata // NON-VACUITY BREAK: record metadata after a failed read.
      if (text === null || text === lastSeen) return'''
test_file = 'test/tui-prefs/watcher.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/tui-prefs/watcher.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/tui-prefs/watcher.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^a\sfailed\sread\safter\sa\smetadata\schange\sis\sretried\sby\sthe\snext\sprobe$']
expect_message = 'the failed read was retried'

[[control]]
id = 'tui-prefs-failed-seed-records-no-metadata'
guards = 'when the first synchronous read fails, no metadata is recorded, so the probe keeps reading until the file is readable'
file = 'src/tui-prefs/watcher.ts'
old = '''      lastMetadata = metadata
    } catch {'''
new = '''    } catch {
      lastMetadata = identity((options.fs?.statSync ?? statSync)(path)) // NON-VACUITY BREAK: record metadata after a failed seed read.'''
test_file = 'test/tui-prefs/watcher.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/tui-prefs/watcher.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/tui-prefs/watcher.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^an\sunreadable\sfile\smade\sreadable\sagain\sis\sread\sby\sthe\sprobe$']
expect_message = 'the file is read once it is readable'

[[control]]
id = 'rpc-client-cache-binds-validated-bytes'
guards = 'a cached RPC selection is bound to the identity of the port-file bytes that named it, so a file replaced during discovery is never pinned to the old server'
file = 'src/rpc/rpc-client.ts'
old = '    const identity = await boundIdentity(dir, entry)'
new = '    const identity = await portFileIdentity(dir, entry) // NON-VACUITY BREAK: stat the path after discovery.'
test_file = 'test/rpc/client-discovery-cache.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/rpc/client-discovery-cache.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/rpc/client-discovery-cache.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^a\sport\sfile\sreplaced\sduring\sdiscovery\sis\snot\scached\sfor\sthe\sold\sserver$']
expect_message = 'only the call that discovered A goes to A'

[[control]]
id = 'rpc-client-stable-selection-skips-discovery'
guards = 'ten stable pending calls, across clients with the same selection key, perform one validated discovery'
file = 'src/rpc/rpc-client.ts'
old = '''  if (
    !windowsPrivateFiles &&
    cached &&
    (await portFileIdentity(dir, cached.entry)) === cached.identity
  )
    return cached'''
new = '  void cached // NON-VACUITY BREAK: rediscover on every call.'
test_file = 'test/rpc/client-discovery-cache.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/rpc/client-discovery-cache.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/rpc/client-discovery-cache.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^stable\spending\scalls\sshare\sone\svalidated\sdiscovery\sper\sselection\skey$']
expect_message = 'stable pending calls must discover once'

[[control]]
id = 'claustrum-roster-reasserts-lock-at-publish'
guards = 'the roster write lock is reasserted at the final pre-rename point, so a lease lost while the roster is staged publishes nothing'
file = 'src/claustrum/roster.ts'
old = '''          await options.beforePublish?.()
          await lock.assertOwned()'''
new = '''          await options.beforePublish?.() // NON-VACUITY BREAK: no lock check at rename.'''
test_file = 'test/claustrum/roster.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/claustrum/roster.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/claustrum/roster.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^losing\sthe\sroster\slock\swhile\sstaging\sprevents\spublication$']
expect_message = 'toBeInstanceOf'

[[control]]
id = 'claustrum-roster-before-publish-at-rename'
guards = 'the caller publication guard runs after the roster is staged, immediately before the rename, not when the change callback returns'
file = 'src/claustrum/roster.ts'
old = '''      await lock.assertOwned()
      // Staging the file takes several awaited steps; check both the caller's
      // lease and this lock again at the last moment before the rename.
      await writeJsonAtomic(path, next, {
        beforeRename: async () => {
          await options.beforePublish?.()
          await lock.assertOwned()
        },
      })'''
new = '''      await options.beforePublish?.() // NON-VACUITY BREAK: guard before staging.
      await lock.assertOwned()
      await writeJsonAtomic(path, next, {
        beforeRename: async () => {
          await lock.assertOwned()
        },
      })'''
test_file = 'test/claustrum/roster.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/claustrum/roster.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/claustrum/roster.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^beforePublish\sruns\safter\sthe\sroster\sis\sstaged,\simmediately\sbefore\sthe\srename$']
expect_message = 'the new roster is staged when the guard runs'

[[control]]
id = 'commands-replaced-slot-wins'
guards = 'a replacement section takes the built-in section place, so a plugin that must not expose pool row ids never has them rendered'
file = 'src/commands/menu.ts'
old = '''      if (replacement)
        out.push(await plugin(slot, slot, replacement, invocation))'''
new = '''      if (replacement && !built.some((entry) => entry.slot === slot)) // NON-VACUITY BREAK
        out.push(await plugin(slot, slot, replacement, invocation))'''
test_file = 'test/commands/replace.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/commands/replace.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/commands/replace.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^replacing\sthe\sbuilt-in\sstore\ssections\sa\sreplaced\sslot\stakes\sthe\sbuilt-in\sone’s\splace\swhile\sthe\sothers\sstill\sread\sthe\sstore$']
expect_message = 'no pool row ids'

[[control]]
id = 'commands-built-in-slot-needs-store'
guards = 'a menu whose built-in slot has no store is refused at creation instead of failing on first open'
file = 'src/commands/menu.ts'
old = '''  if (builtSlots.length > 0 && !store)'''
new = '''  if (false) // NON-VACUITY BREAK'''
test_file = 'test/commands/replace.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/commands/replace.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/commands/replace.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^replacing\sthe\sbuilt-in\sstore\ssections\sa\sbuilt-in\sslot\swithout\sa\sstore\sis\srefused\swhen\sthe\smenu\sis\screated$']
expect_message = 'toThrow'

[[control]]
id = 'store-remove-attribution-orphan-epoch'
guards = 'an attributed remove refuses an orphan whose stamp names another credential epoch, so it never deletes an orphan a later interrupted add of the id left'
file = 'src/store/rows.ts'
old = '''    stamp.credentialEpoch !== fence.credentialEpoch ||'''
new = '''    false || // NON-VACUITY BREAK: orphan epoch not compared.'''
test_file = 'test/store/remove-attribution.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/store/remove-attribution.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/remove-attribution.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^remove\sattribution\san\sattributed\sremove\srefuses\sa\sforeign\shigher-epoch\sorphan\swith\sboth\sfiles\sunchanged$']
expect_message = 'expected a rejection'

[[control]]
id = 'store-remove-attribution-orphan-bound'
guards = 'an attributed remove refuses an orphan whose credential is not the one its stamp names'
file = 'src/store/rows.ts'
old = '''  if (!orphan?.credential || orphan.invalid || orphan.stamp !== 'bound')
    throw unbound()'''
new = '''  if (!orphan?.credential || orphan.invalid) // NON-VACUITY BREAK: stamp binding not required.
    throw unbound()'''
test_file = 'test/store/remove-attribution.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/store/remove-attribution.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/remove-attribution.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^remove\sattribution\san\sattributed\sremove\srefuses\san\sorphan\swithout\sa\sbindable\sstamp\swith\sboth\sfiles\sunchanged$']
expect_message = 'expected a rejection'

[[control]]
id = 'store-remove-attribution-live-row'
guards = 'an attributed remove refuses a live row of another epoch or identity'
file = 'src/store/rows.ts'
old = '''  operation: PoolOperationError['operation'] = 'remove',
): void {
  assertRowAttribution(operation, id, row, fence)'''
new = '''  operation: PoolOperationError['operation'] = 'remove',
): void {
  void assertRowAttribution // NON-VACUITY BREAK: live row not fenced.'''
test_file = 'test/store/remove-attribution.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/store/remove-attribution.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/remove-attribution.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^remove\sattribution\san\sattributed\sremove\srefuses\sa\slive\srow\sof\sanother\sepoch\sor\sidentity\swith\sboth\sfiles\sunchanged$']
expect_message = 'expected a rejection'

[[control]]
id = 'store-remove-attribution-no-torn-repair'
guards = 'a refused attributed remove leaves every other torn row as on disk'
file = 'src/store/rows.ts'
old = '''// An attributed removal is refused, when it is, with nothing written:
        // completing another row's interrupted write first would be a write.
        { completeTorn: false },'''
new = '''// An attributed removal is refused, when it is, with nothing written:
        // completing another row's interrupted write first would be a write.
        { completeTorn: true }, // NON-VACUITY BREAK: torn rows repaired before the fence.'''
test_file = 'test/store/remove-attribution.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/store/remove-attribution.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/remove-attribution.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^remove\sattribution\san\sattributed\sremove\scompletes\sno\sother\srow\sbefore\srefusing$']
expect_message = 'the torn row is not completed'

# --- OpenCode 2 opt-in placeholder ownership ---
# Each command prints git's unstaged diff before running the selected test.
# A diff on the mutated run records that the test sees the deliberate source
# change; the baseline run and the restored source have no unstaged diff.

[[control]]
id = 'opencode2-owned-api-key-pass-through'
guards = 'an API key on the same provider is untouched with zero adapter calls and attempts'
file = 'src/opencode2/install.ts'
old = 'ownership.credential(headers) === placeholderSecret(providerID)'
new = 'true // NON-VACUITY BREAK: remove exact ownership equality'
test_file = 'test/opencode2/ownership.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; exec bun test test/opencode2/ownership.test.ts -t "$1"', 'mutation', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/ownership.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^OpenCode\s2\splaceholder\sownership\san\sAPI\skey\spasses\sthrough\sbyte\sidentical\swith\sno\sadapter\scalls\sor\sattempts$']
expect_message = 'expect(received).toBe(expected)'

[[control]]
id = 'opencode2-owned-host-login-pass-through'
guards = 'a host OAuth bearer is untouched with zero adapter calls and attempts'
file = 'src/opencode2/install.ts'
old = 'ownership.credential(headers) === placeholderSecret(providerID)'
new = 'true // NON-VACUITY BREAK: remove exact ownership equality'
test_file = 'test/opencode2/ownership.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; exec bun test test/opencode2/ownership.test.ts -t "$1"', 'mutation', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/ownership.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^OpenCode\s2\splaceholder\sownership\sa\shost\slogin\sbearer\spasses\sthrough\sbyte\sidentical\swith\sno\sadapter\scalls\sor\sattempts$']
expect_message = 'expect(received).toBe(expected)'

[[control]]
id = 'opencode2-owned-exact-equality-control'
guards = 'a placeholder prefix is not ownership; remove equality as a red control'
file = 'src/opencode2/install.ts'
old = 'ownership.credential(headers) === placeholderSecret(providerID)'
new = 'true // NON-VACUITY BREAK: remove exact ownership equality'
test_file = 'test/opencode2/ownership.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; exec bun test test/opencode2/ownership.test.ts -t "$1"', 'mutation', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/ownership.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^OpenCode\s2\splaceholder\sownership\sownership\srequires\sexact\splaceholder\sequality$']
expect_message = 'expect(received).toBe(expected)'

[[control]]
id = 'opencode2-owned-placeholder-retry'
guards = 'owned placeholders retain immediate retry after an attributed refusal'
file = 'src/opencode2/install.ts'
old = '''        if (ownership && latestTransportOwned.get(draft.sessionID) !== true)
          return'''
new = '        if (ownership) return // NON-VACUITY BREAK: suppress owned retry'
test_file = 'test/opencode2/ownership.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; exec bun test test/opencode2/ownership.test.ts -t "$1"', 'mutation', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/ownership.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^OpenCode\s2\splaceholder\sownership\san\sowned\splaceholder\sis\sserved\sattributed\sand\sretried\sat\stransport$']
expect_message = 'expect(received).toEqual(expected)'

[[control]]
id = 'opencode2-owned-local-refusal'
guards = 'no account means local refusal before dispatch, never fabricated credentials'
file = 'src/opencode2/install.ts'
old = 'const accountId = await adapter.chooseAccount(input)'
new = "const accountId = (await adapter.chooseAccount(input)) ?? 'A' // NON-VACUITY BREAK: bypass refusal"
test_file = 'test/opencode2/ownership.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; exec bun test test/opencode2/ownership.test.ts -t "$1"', 'mutation', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/ownership.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^OpenCode\s2\splaceholder\sownership\san\sowned\splaceholder\swith\sno\saccount\sis\srefused\slocally\sbefore\sdispatch$']
expect_message = 'Expected constructor:'

[[control]]
id = 'opencode2-refresh-issues-fresh-placeholder'
guards = 'an owned placeholder refresh receives a new expiry without consulting the pool'
file = 'src/opencode2/integration.ts'
old = 'return placeholderFor(credential.methodID)'
new = 'return credential // NON-VACUITY BREAK: keep the expired placeholder'
test_file = 'test/opencode2/integration.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; exec bun test test/opencode2/integration.test.ts -t "$1"', 'mutation', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/integration.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['host refresh renews only this integration.*placeholder']
expect_message = 'expect(received).not.toBe(expected)'

[[control]]
id = 'opencode2-refresh-refuses-real-login'
guards = 'a real OAuth login under the registered method ID is not replaced'
file = 'src/opencode2/integration.ts'
old = '''          if (!isPlaceholderCredential(credential, integrationID)) {'''
new = '''          if (!isPlaceholderCredential(credential, integrationID) && credential.access.startsWith(PLACEHOLDER_PREFIX)) { // NON-VACUITY BREAK: allow real OAuth credentials'''
test_file = 'test/opencode2/integration.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; exec bun test test/opencode2/integration.test.ts -t "$1"', 'mutation', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/integration.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['host refresh refuses a real OAuth credential with the same method ID']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'opencode2-refresh-refuses-other-integration'
guards = 'a placeholder belonging to another integration is not refreshed'
file = 'src/opencode2/integration.ts'
old = '''          if (!isPlaceholderCredential(credential, integrationID)) {'''
new = '''          if (!isPlaceholderCredential(credential)) { // NON-VACUITY BREAK: accept any integration placeholder'''
test_file = 'test/opencode2/integration.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; exec bun test test/opencode2/integration.test.ts -t "$1"', 'mutation', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/integration.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['host refresh refuses another integration.*placeholder']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'opencode2-owned-switch-retry'
guards = 'after switching to an API key, retry leaves the host decision untouched despite older owned refusals'
file = 'src/opencode2/install.ts'
old = '''        if (ownership && latestTransportOwned.get(draft.sessionID) !== true)
          return'''
new = '        // NON-VACUITY BREAK: let non-owned retries judge older owned attempts'
test_file = 'test/opencode2/ownership.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; exec bun test test/opencode2/ownership.test.ts -t "$1"', 'mutation', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/ownership.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^OpenCode\s2\splaceholder\sownership\sswitching\splaceholder\sto\sAPI\skey\sand\sback\schanges\sthe\snext\srequest\sand\sretry$']
expect_message = 'expect(received).toBe(expected)'

[[control]]
id = 'opencode2-owned-socket-send'
guards = 'a non-owned socket frame is not rewritten even with an older owned attempt'
file = 'src/opencode2/install.ts'
old = '''          if (
            ownership &&
            !ownedSockets.has(keyOf(scope.sessionID, scope.kind))
          )
            return'''
new = '          // NON-VACUITY BREAK: rewrite frames on non-owned sockets'
test_file = 'test/opencode2/ownership.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; exec bun test test/opencode2/ownership.test.ts -t "$1"', 'mutation', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/ownership.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^OpenCode\s2\splaceholder\sownership\sa\snon\sowned\ssocket\shandshake\sand\sframes\sare\suntouched\sand\sunattributed$']
expect_message = 'Received: "stock rewritten"'

[[control]]
id = 'opencode2-owned-socket-receive'
guards = 'a non-owned socket frame is not attributed even with an older owned attempt'
file = 'src/opencode2/install.ts'
old = '''        if (ownership && !ownedSockets.has(keyOf(draft.sessionID, draft.kind)))
          return'''
new = '        // NON-VACUITY BREAK: attribute frames on non-owned sockets'
test_file = 'test/opencode2/ownership.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; exec bun test test/opencode2/ownership.test.ts -t "$1"', 'mutation', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/ownership.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^OpenCode\s2\splaceholder\sownership\sa\snon\sowned\ssocket\shandshake\sand\sframes\sare\suntouched\sand\sunattributed$']
expect_message = 'expect(received).toEqual(expected)'

[[control]]
id = 'opencode2-owned-concurrent-attribution'
guards = 'concurrent owned HTTP responses belong to their request objects, not the newest attempt'
file = 'src/opencode2/install.ts'
old = 'const rec = byRequest.get(draft.request)'
new = 'const rec = newestOf(keyOf(draft.sessionID, draft.kind)) // NON-VACUITY BREAK: guess response by recency'
test_file = 'test/opencode2/ownership.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; exec bun test test/opencode2/ownership.test.ts -t "$1"', 'mutation', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/ownership.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^OpenCode\s2\splaceholder\sownership\sconcurrent\sowned\sattempts\sof\sone\ssession\sand\skind\skeep\stheir\sown\sattribution$']
expect_message = 'expect(received).toEqual(expected)'

[[control]]
id = 'opencode2-owned-legacy-default'
guards = 'omitting the option preserves 0.11.7 model selection and wire bytes'
file = 'src/opencode2/install.ts'
old = '''      'model.request',
      (draft) => {
        if (ownership) return'''
new = '''      'model.request',
      (draft) => {
        return // NON-VACUITY BREAK: disable legacy model selection'''
test_file = 'test/opencode2/ownership.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; exec bun test test/opencode2/ownership.test.ts -t "$1"', 'mutation', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/ownership.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^OpenCode\s2\splaceholder\sownership\somitting\sthe\soption\spreserves\slegacy\smodel\sselection\sand\swire\sbytes$']
expect_message = 'expect(received).toEqual(expected)'

[[control]]
id = 'opencode2-owned-placeholder-wire-guard'
guards = 'an owned placeholder never leaves even with a customized hostCredentials list'
file = 'src/opencode2/install.ts'
old = '...(ownership ? [placeholderSecret(providerID)] : []),'
new = '...[], // NON-VACUITY BREAK: omit the mandatory owned placeholder guard'
test_file = 'test/opencode2/ownership.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; exec bun test test/opencode2/ownership.test.ts -t "$1"', 'mutation', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/ownership.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^OpenCode\s2\splaceholder\sownership\sowned\splaceholders\scannot\sleave\seven\swith\sa\scustomized\swire\sguard$']
expect_message = 'Expected constructor:'

# --- publication invariants, reader consistency and ordered durability ---

[[control]]
id = 'store-revision-exact-rotating-holder'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'the exact valid fingerprint holder stays reserved even behind an invalid earlier holder'
file = 'src/store/reserved.ts'
old = 'if (reservation !== undefined)'
new = 'if (false /* NON-VACUITY BREAK */)'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged revision rotating add fences the exact valid holder behind an invalid holder']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-revision-rotate-orphan-secret'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'rotating add scans other state-only staging reservations before creating a duplicate secret holder'
file = 'src/store/rows.ts'
old = 'if (stagedOrphan)'
new = 'if (stagedOrphan && stagedOrphan[0] === id /* NON-VACUITY BREAK */)'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged revision rotate add cannot duplicate a staged orphan under another id']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-revision-refuse-orphan-secret'
guards = 'refuse-mode add reports a same-secret state-only reservation before ordinary duplicate handling'
file = 'src/store/rows.ts'
old = 'if (stagedOrphan)'
new = 'if (stagedOrphan && stagedOrphan[0] === id /* NON-VACUITY BREAK */)'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\srevision\srefuse\sadd\scannot\sduplicate\sa\sstaged\sorphan\sunder\sanother\sid$']
expect_message = 'error: expect('

[[control]]
id = 'store-revision-duplicate-orphan-secret'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'duplicate staging cannot claim a state-only orphan secret owned by another id'
file = 'src/store/rows.ts'
old = 'if (stagedOrphan)'
new = 'if (stagedOrphan && stagedOrphan[0] === id /* NON-VACUITY BREAK */)'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged revision stage-duplicate add cannot duplicate a staged orphan under another id']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-revision-survivor-finalized-secret'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'one resulting secret cannot carry different known identities across survivors and finalized rows'
file = 'src/store/publication.ts'
old = 'other.fingerprint === row.fingerprint,'
new = 'false /* NON-VACUITY BREAK */,'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged revision publication rejects shared secret across different identities for survivor and finalized']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-revision-finalized-secret-identities'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'two finalized rows cannot claim one secret under different known identities'
file = 'src/store/publication.ts'
old = 'other.fingerprint === row.fingerprint,'
new = 'false /* NON-VACUITY BREAK */,'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged revision publication rejects shared secret across different identities for two finalized']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-revision-survivor-secret-identities'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'publication audits shared secret identities even among untouched survivors'
file = 'src/store/publication.ts'
old = 'other.fingerprint === row.fingerprint,'
new = 'false /* NON-VACUITY BREAK */,'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged revision publication rejects shared secret across different identities for two survivors']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-revision-surviving-torn-replace'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'publication refuses surviving state-ahead replacements instead of committing their raw old roster bytes'
file = 'src/store/publication.ts'
old = 'if (tornSurvivor)'
new = "if (tornSurvivor && tornSurvivor.id === '' /* NON-VACUITY BREAK */)"
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged revision publication refuses a surviving torn replace without repair']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-revision-surviving-torn-transition'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'publication refuses pending transitions in the resulting roster without repairing them'
file = 'src/store/publication.ts'
old = 'if (tornSurvivor)'
new = "if (tornSurvivor && tornSurvivor.id === '' /* NON-VACUITY BREAK */)"
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged revision publication refuses a surviving torn transition without repair']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-revision-roster-bijection'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'duplicate survivor ids cannot admit an unknown order id that would serialize as a null account'
file = 'src/store/publication.ts'
old = 'const survivors = publicationSurvivors(tx, plan, rows)'
new = 'const survivors = rows.filter((row) => !plan.remove.some((ref) => ref.id === row.id)) /* NON-VACUITY BREAK */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged revision publication rejects duplicate raw roster ids instead of writing null accounts']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-revision-removed-roster-duplicates'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'publication refuses raw duplicate ids even when both duplicates are removed'
file = 'src/store/publication.ts'
old = 'rosterIds.has(raw.id)'
new = 'false /* NON-VACUITY BREAK */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged revision publication rejects duplicate removed roster ids too']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-revision-quarantine-before-repair'
guards = 'an enable refusal for identity contradiction precedes every config repair'
file = 'src/store/rows.ts'
old = '''async (tx): Promise<RowTransitionResult> => {
          await protectIn(tx, id, options.protect)
          tx.assertNotStaged(id)'''
new = '''async (tx): Promise<RowTransitionResult> => {
          await protectIn(tx, id, options.protect)
          tx.assertNotStaged(id)
          await tx.completeTorn() // NON-VACUITY BREAK'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\srevision\senable\sidentity-contradicted\srefusal\sdoes\snot\srepair\sa\storn\ssibling$']
expect_message = 'error: expect('

[[control]]
id = 'store-revision-duplicate-before-repair'
guards = 'an enable refusal for a duplicate identity precedes every config repair'
file = 'src/store/rows.ts'
old = '''async (tx): Promise<RowTransitionResult> => {
          await protectIn(tx, id, options.protect)
          tx.assertNotStaged(id)'''
new = '''async (tx): Promise<RowTransitionResult> => {
          await protectIn(tx, id, options.protect)
          tx.assertNotStaged(id)
          await tx.completeTorn() // NON-VACUITY BREAK'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\srevision\senable\sduplicate-identity\srefusal\sdoes\snot\srepair\sa\storn\ssibling$']
expect_message = 'error: expect('

[[control]]
id = 'store-revision-enable-mutator-before-repair'
guards = 'a rejecting enable provider-state mutator precedes any repair write'
file = 'src/store/rows.ts'
old = '''async (tx): Promise<RowTransitionResult> => {
          await protectIn(tx, id, options.protect)
          tx.assertNotStaged(id)'''
new = '''async (tx): Promise<RowTransitionResult> => {
          await protectIn(tx, id, options.protect)
          tx.assertNotStaged(id)
          await tx.completeTorn() // NON-VACUITY BREAK'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\srevision\senable\sprovider\smutator\srefusal\sprecedes\sany\storn\srepair$']
expect_message = 'error: expect('

[[control]]
id = 'store-revision-disable-mutator-before-repair'
guards = 'a rejecting disable provider-state mutator precedes any repair write'
file = 'src/store/rows.ts'
old = '''async (tx): Promise<RowTransitionResult> => {
          await protectIn(tx, id, options.protect)
          tx.assertNotStaged(id)'''
new = '''async (tx): Promise<RowTransitionResult> => {
          await protectIn(tx, id, options.protect)
          tx.assertNotStaged(id)
          await tx.completeTorn() // NON-VACUITY BREAK'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\srevision\sdisable\sprovider\smutator\srefusal\sprecedes\sany\storn\srepair$']
expect_message = 'error: expect('

[[control]]
id = 'store-revision-permanent-receipts'
guards = 'publication receipt history cannot forget the first operation id after later cleanups'
file = 'src/store/publication.ts'
old = 'pool.publications = receipts'
new = "for (const id of Object.keys(receipts)) if (id !== receipt.operationId && isRecord(receipts[id]) && receipts[id].phase === 'cleaned') delete receipts[id]; pool.publications = receipts /* NON-VACUITY BREAK */"
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\srevision\severy\spublication\sreceipt\sremains\sa\spermanent\sreplay\sfence$']
expect_message = 'error: expect('

[[control]]
id = 'store-revision-config-before-state-after'
guards = 'lock-free snapshots cannot pair pre-publication config with post-cleanup state'
file = 'src/store/mutate.ts'
old = 'if (configText !== checkedConfigText) {'
new = 'if (false /* NON-VACUITY BREAK */) {'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\srevision\sconfig\sread\sbefore\spublication\sand\sstate\sread\safter\scleanup\sretries\slock\sfree$']
expect_message = 'error: expect('

[[control]]
id = 'store-revision-snapshot-retry-bound'
guards = 'snapshot churn gets the promised three attempts rather than failing after only one'
file = 'src/store/mutate.ts'
old = 'attempt < 3'
new = 'attempt < 1 /* NON-VACUITY BREAK */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\srevision\ssnapshot\svalidation\srefuses\safter\sthree\schanging\sconfig\sreads\swithout\slocks$']
expect_message = 'error: expect('

[[control]]
id = 'store-revision-reserved-pull-capture'
guards = 'a reserved pull capture exits before repairing any unrelated row'
file = 'src/store/pull.ts'
old = 'if (tx.reservation(id) !== undefined) return undefined'
new = 'if (false /* NON-VACUITY BREAK */) return undefined'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\srevision\sreserved\spull\scapture\sand\squota\srecording\swrite\snothing\seven\sbeside\sa\storn\ssibling$']
expect_message = 'error: expect('

[[control]]
id = 'store-revision-reserved-quota-write'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'quota recording never writes an enabled-shaped reserved row'
file = 'src/store/attribution.ts'
old = 'tx.assertNotStaged(id)'
new = '/* NON-VACUITY BREAK: reservation fence omitted */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged revision reserved pull capture and quota recording write nothing even beside a torn sibling']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-revision-finalize-provider-state'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'finalize compares full provider metadata against the staged digest'
file = 'src/store/publication.ts'
old = 'stamp.staged.providerState !== fullProviderDigest'
new = 'false /* NON-VACUITY BREAK */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged revision finalize rejects changed full staged providerState material']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-revision-finalize-label'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'finalize compares the raw original staged label including absence'
file = 'src/store/publication.ts'
old = 'stamp.staged.label !== raw?.label ||'
new = 'false /* NON-VACUITY BREAK */ ||'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged revision finalize rejects changed full staged label material']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-revision-finalize-disabled-reason'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'finalize requires the exact disabled reason recorded in the staging stamp'
file = 'src/store/publication.ts'
old = 'stamp.staged.disabledReason !== row.disabledReason ||'
new = 'false /* NON-VACUITY BREAK */ ||'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged revision finalize rejects changed full staged disabledReason material']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-revision-staged-state-barrier'
guards = 'staged credentials are synced before the durable config rename removes old rows'
file = 'src/store/publication.ts'
old = 'await tx.syncState()'
new = '/* NON-VACUITY BREAK: staged state durability omitted */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\srevision\spublication\ssyncs\sstaged\sstate\sbefore\sthe\sdurable\sroster\sdecision$']
expect_message = 'error: expect('

[[control]]
id = 'store-revision-committed-config-barrier'
guards = 'a visible committed receipt is re-synced before any recovery cleanup write'
file = 'src/store/publication.ts'
old = 'await tx.syncConfig()'
new = '/* NON-VACUITY BREAK: committed config durability omitted */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\srevision\scommitted\sreceipt\sreplay\sresyncs\sconfig\sbefore\sany\scleanup\swrite$']
expect_message = 'error: expect('

[[control]]
id = 'store-revision-cleanup-state-barrier'
guards = 'cleanup state file and directory sync finish before the durable cleaned receipt'
file = 'src/store/publication.ts'
old = 'await tx.commitState(undefined, { durable: true })'
new = 'await tx.commitState() /* NON-VACUITY BREAK */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\srevision\scleanup\sstate\sfile\sand\sdirectory\sare\sdurable\sbefore\scleaned\sreceipt$']
expect_message = 'error: expect('

[[control]]
id = 'store-revision-never-compact-committed'
guards = 'later cleaned publications never compact or delete a committed receipt'
file = 'src/store/publication.ts'
old = 'pool.publications = receipts'
new = "for (const id of Object.keys(receipts)) if (id !== receipt.operationId && isRecord(receipts[id]) && receipts[id].phase === 'committed') delete receipts[id]; pool.publications = receipts /* NON-VACUITY BREAK */"
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\srevision\scommitted\sreceipts\ssurvive\severy\slater\scleaned\spublication$']
expect_message = 'error: expect('

[[control]]
id = 'store-revision-existing-file-sync'
guards = 'the existing file is fsynced rather than only its parent directory'
file = 'src/fs/atomic-write.ts'
old = 'await file.sync()'
new = '/* NON-VACUITY BREAK: existing file sync omitted */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\srevision\spublication\ssyncs\sstaged\sstate\sbefore\sthe\sdurable\sroster\sdecision$']
expect_message = 'error: expect('

[[control]]
id = 'store-revision-existing-directory-sync'
guards = 'existing file sync is followed by directory sync before recovery proceeds'
file = 'src/fs/atomic-write.ts'
old = '''  const directory = await open(dirname(path), 'r')
  try {
    await directory.sync()'''
new = '''  const directory = await open(dirname(path), 'r')
  try {
    /* NON-VACUITY BREAK: existing directory sync omitted */'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^staged\srevision\scommitted\sreceipt\sreplay\sresyncs\sconfig\sbefore\sany\scleanup\swrite$']
expect_message = 'error: expect('

[[control]]
id = 'store-revision-reject-staged-state-sync'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'a rejected staged-state sync stops publication before its config rename'
file = 'src/store/publication.ts'
old = 'await tx.syncState()'
new = '/* NON-VACUITY BREAK: failed sync bypassed */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged revision prepublication-state sync rejection prevents the next irreversible write']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-revision-reject-committed-config-sync'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'a rejected committed-config sync leaves state cleanup unwritten'
file = 'src/store/publication.ts'
old = 'await tx.syncConfig()'
new = '/* NON-VACUITY BREAK: failed sync bypassed */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged revision committed-config sync rejection prevents the next irreversible write']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'store-revision-reject-cleanup-state-sync'
broad_command = ['bun', 'test', 'test/store/staged-replacement.test.ts', '--reporter=junit', '--reporter-outfile=staged-replacement-broad.xml']
broad_report = 'staged-replacement-broad.xml'
broad_id = '{name}'
guards = 'a rejected cleanup-state sync cannot advance the cleaned receipt'
file = 'src/store/publication.ts'
old = 'await tx.commitState(undefined, { durable: true })'
new = 'await tx.commitState() /* NON-VACUITY BREAK: failed sync bypassed */'
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['staged revision cleanup-state sync rejection prevents the next irreversible write']
expect_message = 'Expected promise that rejects'

# --- changing snapshots can be retried; invalid accounts survive; rejected adds write nothing ---

[[control]]
id = 'store-final-snapshot-read'
guards = 'snapshot exhaustion remains a distinct retryable outcome at this read boundary'
file = 'src/store/mutate.ts'
old = '''file: 'config',
    kind: 'snapshot-contended',
    retryable: true,'''
new = '''file: 'config',
    /* NON-VACUITY BREAK: busy kind omitted */
    retryable: true,'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\ssnapshot\scontention\sis\sretryable\sat\sread\slock\skey\spre-read$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-snapshot-replace'
guards = 'snapshot exhaustion remains a distinct retryable outcome at this read boundary'
file = 'src/store/mutate.ts'
old = '''file: 'config',
    kind: 'snapshot-contended',
    retryable: true,'''
new = '''file: 'config',
    /* NON-VACUITY BREAK: busy kind omitted */
    retryable: true,'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\ssnapshot\scontention\sis\sretryable\sat\sreplace\slock\skey\spre-read$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-snapshot-rotate'
guards = 'snapshot exhaustion remains a distinct retryable outcome at this read boundary'
file = 'src/store/mutate.ts'
old = '''file: 'config',
    kind: 'snapshot-contended',
    retryable: true,'''
new = '''file: 'config',
    /* NON-VACUITY BREAK: busy kind omitted */
    retryable: true,'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\ssnapshot\scontention\sis\sretryable\sat\srotate\slock\skey\spre-read$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-snapshot-enable'
guards = 'snapshot exhaustion remains a distinct retryable outcome at this read boundary'
file = 'src/store/mutate.ts'
old = '''file: 'config',
    kind: 'snapshot-contended',
    retryable: true,'''
new = '''file: 'config',
    /* NON-VACUITY BREAK: busy kind omitted */
    retryable: true,'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\ssnapshot\scontention\sis\sretryable\sat\senable\slock\skey\spre-read$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-snapshot-disable'
guards = 'snapshot exhaustion remains a distinct retryable outcome at this read boundary'
file = 'src/store/mutate.ts'
old = '''file: 'config',
    kind: 'snapshot-contended',
    retryable: true,'''
new = '''file: 'config',
    /* NON-VACUITY BREAK: busy kind omitted */
    retryable: true,'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\ssnapshot\scontention\sis\sretryable\sat\sdisable\slock\skey\spre-read$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-snapshot-record-identity'
guards = 'snapshot exhaustion remains a distinct retryable outcome at this read boundary'
file = 'src/store/mutate.ts'
old = '''file: 'config',
    kind: 'snapshot-contended',
    retryable: true,'''
new = '''file: 'config',
    /* NON-VACUITY BREAK: busy kind omitted */
    retryable: true,'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\ssnapshot\scontention\sis\sretryable\sat\srecordIdentity\slock\skey\spre-read$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-snapshot-remove'
guards = 'snapshot exhaustion remains a distinct retryable outcome at this read boundary'
file = 'src/store/mutate.ts'
old = '''file: 'config',
    kind: 'snapshot-contended',
    retryable: true,'''
new = '''file: 'config',
    /* NON-VACUITY BREAK: busy kind omitted */
    retryable: true,'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\ssnapshot\scontention\sis\sretryable\sat\sremove\slock\skey\spre-read$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-snapshot-publish-roster'
guards = 'snapshot exhaustion remains a distinct retryable outcome at this read boundary'
file = 'src/store/mutate.ts'
old = '''file: 'config',
    kind: 'snapshot-contended',
    retryable: true,'''
new = '''file: 'config',
    /* NON-VACUITY BREAK: busy kind omitted */
    retryable: true,'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\ssnapshot\scontention\sis\sretryable\sat\spublishRoster\slock\skey\spre-read$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-snapshot-jitter'
guards = 'snapshot attempts yield with bounded jitter before retrying without locks'
file = 'src/store/mutate.ts'
old = '''if (attempt < 2) await snapshotDelay(2 + Math.floor(Math.random() * 4))'''
new = '''/* NON-VACUITY BREAK: snapshot backoff omitted */'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\ssnapshot\sretries\swait\swith\sbounded\sjitter\swithout\staking\slocks$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-pre-decision-state-retry'
guards = 'a failed state barrier before the decision is retryable with nothing written'
file = 'src/store/mutate.ts'
old = '''kind: 'publication-sync',
        retryable: true,'''
new = '''kind: 'publication-sync',
        retryable: false, /* NON-VACUITY BREAK */'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\spre-decision-state\ssync\sfailure\sis\sa\styped\sretryable\spublication\srefusal$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-pre-decision-config-retry'
guards = 'a failed decision temp-file sync is retryable before its rename'
file = 'src/store/mutate.ts'
old = '''operation === 'publishRoster' && error instanceof AtomicSyncError'''
new = '''false /* NON-VACUITY BREAK */'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\spre-decision-config\ssync\sfailure\sis\sa\styped\sretryable\spublication\srefusal$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-sync-decision-directory'
guards = 'post-decision failures require replaying the same plan rather than treating the operation as uncommitted'
file = 'src/store/mutate.ts'
old = '''operation === 'publishRoster' && progress.publicationDecided'''
new = '''false /* NON-VACUITY BREAK */'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\sdecision-directory\ssync\sfailure\sis\sa\styped\sretryable\spublication\srefusal$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-sync-replay-config'
guards = 'post-decision failures require replaying the same plan rather than treating the operation as uncommitted'
file = 'src/store/mutate.ts'
old = '''operation === 'publishRoster' && progress.publicationDecided'''
new = '''false /* NON-VACUITY BREAK */'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\sreplay-config\ssync\sfailure\sis\sa\styped\sretryable\spublication\srefusal$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-sync-cleanup-state'
guards = 'post-decision failures require replaying the same plan rather than treating the operation as uncommitted'
file = 'src/store/mutate.ts'
old = '''operation === 'publishRoster' && progress.publicationDecided'''
new = '''false /* NON-VACUITY BREAK */'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\scleanup-state\ssync\sfailure\sis\sa\styped\sretryable\spublication\srefusal$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-sync-cleaned-config'
guards = 'post-decision failures require replaying the same plan rather than treating the operation as uncommitted'
file = 'src/store/mutate.ts'
old = '''operation === 'publishRoster' && progress.publicationDecided'''
new = '''false /* NON-VACUITY BREAK */'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\scleaned-config\ssync\sfailure\sis\sa\styped\sretryable\spublication\srefusal$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-torn-survivor-manual'
guards = 'a torn surviving row requires an explicit normal-operation completion before publication'
file = 'src/store/publication.ts'
old = '''`Row ${tornSurvivor.id} has an interrupted write; complete it with a normal store operation before publishing.`,
                false,'''
new = '''`Row ${tornSurvivor.id} has an interrupted write; complete it with a normal store operation before publishing.`,
                true, /* NON-VACUITY BREAK */'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\ssurviving\storn\srow\srequires\sexplicit\scompletion\sinstead\sof\sblind\sretry$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-carry-invalid-roster'
guards = 'publication retains unnamed and invalid raw roster rows after its ordered valid survivors'
file = 'src/store/publication.ts'
old = '''...preserved,'''
new = '''/* NON-VACUITY BREAK: carried raw rows omitted */'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\spublication\scarries\sunnamed\sand\sinvalid\sroster\srows\sverbatim\safter\sordered\ssurvivors$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-add-before-repair-endpoint-mismatch'
guards = 'add decides this refusal before repairing any interrupted row'
file = 'src/store/rows.ts'
old = '''const orphan = matchingInterruptedAdd(rt, tx, input, incoming)
          const rows = tx.rows()'''
new = '''const orphan = matchingInterruptedAdd(rt, tx, input, incoming)
          if (!orphan && mode === 'rotate') await tx.completeTorn() // NON-VACUITY BREAK
          const rows = tx.rows()'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\sadd\sendpoint-mismatch\srefusal\sleaves\storn\ssiblings\sand\sboth\sfiles\sunchanged$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-add-before-repair-merge-rejection'
guards = 'add decides this refusal before repairing any interrupted row'
file = 'src/store/rows.ts'
old = '''const orphan = matchingInterruptedAdd(rt, tx, input, incoming)
          const rows = tx.rows()'''
new = '''const orphan = matchingInterruptedAdd(rt, tx, input, incoming)
          if (!orphan && mode === 'rotate') await tx.completeTorn() // NON-VACUITY BREAK
          const rows = tx.rows()'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\sadd\smerge-rejection\srefusal\sleaves\storn\ssiblings\sand\sboth\sfiles\sunchanged$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-add-before-repair-bound-projection-rejection'
guards = 'add decides this refusal before repairing any interrupted row'
file = 'src/store/rows.ts'
old = '''const orphan = matchingInterruptedAdd(rt, tx, input, incoming)
          const rows = tx.rows()'''
new = '''const orphan = matchingInterruptedAdd(rt, tx, input, incoming)
          if (!orphan && mode === 'rotate') await tx.completeTorn() // NON-VACUITY BREAK
          const rows = tx.rows()'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\sadd\sbound-projection-rejection\srefusal\sleaves\storn\ssiblings\sand\sboth\sfiles\sunchanged$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-add-before-repair-id-exists'
guards = 'add decides this refusal before repairing any interrupted row'
file = 'src/store/rows.ts'
old = '''const orphan = matchingInterruptedAdd(rt, tx, input, incoming)
          const rows = tx.rows()'''
new = '''const orphan = matchingInterruptedAdd(rt, tx, input, incoming)
          if (!orphan && mode === 'rotate') await tx.completeTorn() // NON-VACUITY BREAK
          const rows = tx.rows()'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\sadd\sid-exists\srefusal\sleaves\storn\ssiblings\sand\sboth\sfiles\sunchanged$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-add-before-repair-invalid-row'
guards = 'add decides this refusal before repairing any interrupted row'
file = 'src/store/rows.ts'
old = '''const orphan = matchingInterruptedAdd(rt, tx, input, incoming)
          const rows = tx.rows()'''
new = '''const orphan = matchingInterruptedAdd(rt, tx, input, incoming)
          if (!orphan && mode === 'rotate') await tx.completeTorn() // NON-VACUITY BREAK
          const rows = tx.rows()'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\sadd\sinvalid-row\srefusal\sleaves\storn\ssiblings\sand\sboth\sfiles\sunchanged$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-add-before-repair-unbound-credential'
guards = 'add decides this refusal before repairing any interrupted row'
file = 'src/store/rows.ts'
old = '''const orphan = matchingInterruptedAdd(rt, tx, input, incoming)
          const rows = tx.rows()'''
new = '''const orphan = matchingInterruptedAdd(rt, tx, input, incoming)
          if (!orphan && mode === 'rotate') await tx.completeTorn() // NON-VACUITY BREAK
          const rows = tx.rows()'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\sadd\sunbound-credential\srefusal\sleaves\storn\ssiblings\sand\sboth\sfiles\sunchanged$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-add-before-repair-type-mismatch'
guards = 'add decides this refusal before repairing any interrupted row'
file = 'src/store/rows.ts'
old = '''const orphan = matchingInterruptedAdd(rt, tx, input, incoming)
          const rows = tx.rows()'''
new = '''const orphan = matchingInterruptedAdd(rt, tx, input, incoming)
          if (!orphan && mode === 'rotate') await tx.completeTorn() // NON-VACUITY BREAK
          const rows = tx.rows()'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\sadd\stype-mismatch\srefusal\sleaves\storn\ssiblings\sand\sboth\sfiles\sunchanged$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-add-before-repair-identity-mismatch'
guards = 'add decides this refusal before repairing any interrupted row'
file = 'src/store/rows.ts'
old = '''const orphan = matchingInterruptedAdd(rt, tx, input, incoming)
          const rows = tx.rows()'''
new = '''const orphan = matchingInterruptedAdd(rt, tx, input, incoming)
          if (!orphan && mode === 'rotate') await tx.completeTorn() // NON-VACUITY BREAK
          const rows = tx.rows()'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\sadd\sidentity-mismatch\srefusal\sleaves\storn\ssiblings\sand\sboth\sfiles\sunchanged$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-add-before-repair-epoch-exhausted'
guards = 'add decides this refusal before repairing any interrupted row'
file = 'src/store/rows.ts'
old = '''const orphan = matchingInterruptedAdd(rt, tx, input, incoming)
          const rows = tx.rows()'''
new = '''const orphan = matchingInterruptedAdd(rt, tx, input, incoming)
          if (!orphan && mode === 'rotate') await tx.completeTorn() // NON-VACUITY BREAK
          const rows = tx.rows()'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\sadd\sepoch-exhausted\srefusal\sleaves\storn\ssiblings\sand\sboth\sfiles\sunchanged$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-torn-target-enable-replace'
guards = 'provider-state planning uses the projected replacement epoch rather than the raw old entry epoch'
file = 'src/store/provider-state.ts'
old = '''const epoch = row.credentialEpoch ?? 1
  const account = tx.stateAccount(id)'''
new = '''const epoch = tx.entry(id)?.credentialEpoch ?? 1 /* NON-VACUITY BREAK */
  const account = tx.stateAccount(id)'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\sfenced\senable\splans\sthe\ssame\saccount\sand\sstamp\sfor\sa\storn\starget\sreplace$']
expect_message = 'unbound-credential'

[[control]]
id = 'store-final-torn-target-enable-transition'
guards = 'provider-state planning preserves the genuine credential epoch while completing a pending target transition'
file = 'src/store/provider-state.ts'
old = '''nextAccount[CREDENTIAL_STAMP_KEY] = { ...rawStamp, providerState: digest }'''
new = '''nextAccount[CREDENTIAL_STAMP_KEY] = { ...rawStamp, providerState: digest, credentialEpoch: row.torn ? epoch + 1 : epoch } /* NON-VACUITY BREAK */'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\sfenced\senable\splans\sthe\ssame\saccount\sand\sstamp\sfor\sa\storn\starget\stransition$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-torn-target-disable-replace'
guards = 'provider-state planning uses the projected replacement epoch rather than the raw old entry epoch'
file = 'src/store/provider-state.ts'
old = '''const epoch = row.credentialEpoch ?? 1
  const account = tx.stateAccount(id)'''
new = '''const epoch = tx.entry(id)?.credentialEpoch ?? 1 /* NON-VACUITY BREAK */
  const account = tx.stateAccount(id)'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\sfenced\sdisable\splans\sthe\ssame\saccount\sand\sstamp\sfor\sa\storn\starget\sreplace$']
expect_message = 'unbound-credential'

[[control]]
id = 'store-final-torn-target-disable-transition'
guards = 'provider-state planning preserves the genuine credential epoch while completing a pending target transition'
file = 'src/store/provider-state.ts'
old = '''nextAccount[CREDENTIAL_STAMP_KEY] = { ...rawStamp, providerState: digest }'''
new = '''nextAccount[CREDENTIAL_STAMP_KEY] = { ...rawStamp, providerState: digest, credentialEpoch: row.torn ? epoch + 1 : epoch } /* NON-VACUITY BREAK */'''
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\sfenced\sdisable\splans\sthe\ssame\saccount\sand\sstamp\sfor\sa\storn\starget\stransition$']
expect_message = 'error: expect('

[[control]]
id = 'store-final-projected-api-endpoint'
guards = 'an accepted API re-add plans against the completed endpoint before repairing raw config'
file = 'src/store/rows.ts'
old = "projected?.type === 'api'"
new = "projected?.type === 'api' && projected.baseURL === '' /* NON-VACUITY BREAK */"
test_file = 'test/store/staged-replacement.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/store/staged-replacement.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/store/staged-replacement.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^final\saudit\saccepted\sAPI\sre-add\splans\sthe\sprojected\storn\sendpoint\sand\sepoch$']
expect_message = 'endpoint-mismatch'

# --- shared quota wording and menu grouping (0.13.0) ---
# Two promises to plugins. First, every dialog, sidebar and auth menu shows
# quota through one formatter (`src/quota/format.ts`), so the wording cannot
# drift: a window the provider did not report is left out, a stale reading
# says its age, and a window is named by its length (`5h`, `7d`). The rows
# `quota-format-omits-unreported-windows`, `quota-format-marks-stale-readings`
# and `quota-format-names-windows-by-length` each break one of those.
# Second, a menu option always does something, and text that does nothing
# is a group header or a line, never an option. `commands-seam-carries-row-group`
# drops an item's group at the seam, `commands-builtin-accounts-grouped` drops
# the built-in Accounts header, `commands-pi-actionless-rows-are-text` lets Pi
# offer rows that do nothing, and `commands-builtin-quota-rows-act` strips the
# action from the built-in quota rows (OpenCode would hide such rows).

[[control]]
id = 'quota-format-omits-unreported-windows'
guards = 'a window the provider did not report is left out of the quota text instead of appearing as a figure'
file = 'src/quota/format.ts'
old = "limit.kind === 'reading' && limit.remainingPercent !== undefined,"
new = "true /* NON-VACUITY BREAK */,"
test_file = 'test/quota/format.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/quota/format.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/quota/format.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^shared\squota\swording\sa\swindow\sthe\sprovider\sdid\snot\sreport\sis\sleft\sout,\snever\swritten\sas\snot\sreported$']
expect_message = 'error: expect('

[[control]]
id = 'quota-format-marks-stale-readings'
guards = 'a quota reading older than fifteen minutes says how old it is, so a stale figure is never shown as current'
file = 'src/quota/format.ts'
old = 'if (age > (options.staleAfterMs ?? QUOTA_STALE_AFTER_MS))'
new = 'if (false /* NON-VACUITY BREAK */)'
test_file = 'test/quota/format.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/quota/format.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/quota/format.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^shared\squota\swording\sa\sreading\solder\sthan\sfifteen\sminutes\sis\smarked\swith\sits\sage\sin\sboth\sforms$']
expect_message = 'checked 3h ago'

[[control]]
id = 'quota-format-names-windows-by-length'
guards = 'a general window is named by its stored length (5h, 7d), never by the provider slot label'
file = 'src/quota/format.ts'
old = 'return lengthName(limit.windowMinutes)'
new = 'return limit.label /* NON-VACUITY BREAK */'
test_file = 'test/quota/format.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/quota/format.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/quota/format.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^shared\squota\swording\swindows\sare\snamed\sby\stheir\slength\sand\sread\sin\spercent\sleft,\sshortest\sfirst$']
expect_message = 'error: expect('

[[control]]
id = 'quota-text-parts-match-structured-windows'
guards = 'quotaTextParts keeps the established wording by formatting quotaWindowParts rather than deriving a parallel representation'
file = 'src/quota/format.ts'
old = "const reset = full && part.resetIn ? `, resets ${part.resetIn}` : ''"
new = "const reset = '' /* NON-VACUITY BREAK */"
test_file = 'test/quota/format.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/quota/format.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/quota/format.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^shared\squota\swording\squotaTextParts\sstays\sin\sparity\swith\sstructured\swindow\sparts\sacross\sfixtures$']
expect_message = 'resets 2h'

[[control]]
id = 'quota-reset-since-reading-boundary'
guards = 'a reset at the reading time is not new, while a reset at now has arrived since the reading'
file = 'src/quota/format.ts'
old = 'Number.isFinite(at) && at > checkedAt && at <= now,'
new = 'Number.isFinite(at) && at > checkedAt && at < now, /* NON-VACUITY BREAK */'
test_file = 'test/quota/format.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/quota/format.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/quota/format.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^shared\squota\swording\sa\sreset\sat\snow\scounts\sas\ssince\sreading,\sbut\sa\sreset\sbefore\sit\sdoes\snot$']
expect_message = 'resetSinceReading'

[[control]]
id = 'quota-age-threshold-is-strict'
guards = 'the age marker appears only when the oldest shown reading is strictly older than the stale threshold'
file = 'src/quota/format.ts'
old = 'if (age > (options.staleAfterMs ?? QUOTA_STALE_AFTER_MS)) {'
new = 'if (age >= (options.staleAfterMs ?? QUOTA_STALE_AFTER_MS)) { /* NON-VACUITY BREAK */'
test_file = 'test/quota/format.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/quota/format.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/quota/format.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^shared\squota\swording\sage\sis\sincluded\sonly\swhen\sthe\sstale\sthreshold\sis\sexceeded$']
expect_message = 'checked 15m ago'

[[control]]
id = 'commands-seam-carries-row-group'
guards = 'an item group crosses the command seam, so a renderer can draw the header instead of an unlabelled run of rows'
file = 'src/commands/seam.ts'
old = '''    ...(item.group !== undefined ? { group: String(item.group) } : {}),'''
new = '''    /* NON-VACUITY BREAK */'''
test_file = 'test/commands/seam.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/commands/seam.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/commands/seam.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^command\spayload\sseam\sa\splugin\ssection’s\sgroups\sand\sstatuses\scross\sthe\sseam,\sand\snothing\selse\srides\salong$']
expect_message = 'error: expect('

[[control]]
id = 'commands-builtin-accounts-grouped'
guards = 'the built-in Accounts rows sit under their own header ahead of the Actions header'
file = 'src/commands/builtins.ts'
old = '''      group: 'Accounts','''
new = '''      /* NON-VACUITY BREAK */'''
test_file = 'test/commands/sections.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/commands/sections.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/commands/sections.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^command\smenu\ssections\sbuilt-in\ssections\slist\saccounts\sand\sthen\sactions\sunder\sgroup\sheaders,\swith\ssummaries\sonly\sas\sshort\slines$']
expect_message = 'error: expect('

[[control]]
id = 'commands-pi-actionless-rows-are-text'
guards = 'the Pi renderer never offers a row that has no actions as an option, so nothing selectable does nothing'
file = 'src/commands/pi.ts'
old = '''          .filter((item) => item.actions.length > 0)'''
new = '''          .filter(() => true /* NON-VACUITY BREAK */)'''
test_file = 'test/commands/pi.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/commands/pi.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/commands/pi.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^Pi\srenderer\sthe\sPi\srenderer\sshows\sgroup\sheaders\sand\srows\swithout\sactions\sas\stitle\stext\sit\scannot\sselect$']
expect_message = 'error: expect('

[[control]]
id = 'commands-builtin-quota-rows-act'
guards = 'every built-in quota row carries a real action, so no OpenCode dialog hides it as a disabled option and no renderer offers a row that does nothing'
file = 'src/commands/builtins.ts'
old = '''      actions: [
        {
          id: 'check',
          label: 'Check this account','''
new = '''      actions: [].slice(1) /* NON-VACUITY BREAK */ || [
        {
          id: 'check',
          label: 'Check this account','''
test_file = 'test/commands/sections.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/commands/sections.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/commands/sections.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^command\smenu\ssections\sno\sbuilt-in\ssection\semits\san\sitem\swithout\sactions,\sand\san\saccount\sthat\scannot\sbe\schecked\sis\sa\squota\sline$']
expect_message = 'does nothing when chosen'

[[control]]
id = 'claustrum-enrollment-approved-missing-token-remains-vault'
guards = 'an approved ceremony with no token remains in vault mode, so callers refuse with the vault-unavailable message instead of falling back to local accounts'
file = 'src/claustrum/enrollment.ts'
old = '''  if (
    status.state === 'approved' ||
    (status.state === 'blocked' && status.code === 'missing_token')
  ) {
    return 'vault'
  }'''
new = '''  if (
    status.state === 'approved' ||
    (status.state === 'blocked' && status.code === 'missing_token')
  ) {
    return 'local' // NON-VACUITY BREAK
  }'''
test_file = 'test/claustrum/enrollment.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/claustrum/enrollment.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/claustrum/enrollment.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^enrollmentAuthority\suses\svault\sauthority\sfor\sapproved\sstate\swhen\sthe\stoken\sis\smissing$']
expect_message = '/Expected: "vault"\s+Received: "local"/'

[[control]]
id = 'claustrum-enrollment-approved-corrupt-token-remains-vault'
guards = 'an approved ceremony with a corrupt token remains in vault mode, so callers refuse with the vault-unavailable message instead of falling back to local accounts'
file = 'src/claustrum/enrollment.ts'
old = '''      return state.phase === 'approved' && state.proposedName === proposedName
        ? 'vault'
        : 'unreadable''''
new = '''      return 'unreadable' // NON-VACUITY BREAK'''
test_file = 'test/claustrum/enrollment.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/claustrum/enrollment.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/claustrum/enrollment.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^enrollmentAuthority\suses\svault\sauthority\sfor\sapproved\sstate\swhen\sthe\stoken\sis\scorrupt$']
expect_message = '/Expected: "vault"\s+Received: "unreadable"/'

[[control]]
id = 'claustrum-enrollment-unreadable-state-does-not-fall-back'
guards = 'an unreadable enrollment state refuses authority instead of silently selecting local accounts'
file = 'src/claustrum/enrollment.ts'
old = '''    } catch {
      return 'unreadable'
    }
  }

  if ('proposedName' in status'''
new = '''    } catch {
      return 'local' // NON-VACUITY BREAK
    }
  }

  if ('proposedName' in status'''
test_file = 'test/claustrum/enrollment.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/claustrum/enrollment.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/claustrum/enrollment.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^enrollmentAuthority\streats\sa\scorrupt\sstate\sfile\swithout\sa\stoken\sas\sunreadable$']
expect_message = '/Expected: "unreadable"\s+Received: "local"/'

# --- Claustrum disconnect (0.13.0) ---
# Disconnect removes the token and then the ceremony state under the ceremony
# lock. Keeping the state leaves the host in vault mode with no token, which
# refuses every request; skipping the shared lock lets a disconnect race a
# reconcile() that is writing a token; removing a state file that fails the
# safety checks would act on a file that is not provably this host's.

[[control]]
id = 'claustrum-disconnect-removes-state'
guards = 'disconnect removes the approved ceremony state as well as the token, so the host leaves vault mode instead of staying approved-but-broken'
file = 'src/claustrum/enrollment.ts'
old = 'const removedState = await removeIfPresent(paths.statePath)'
new = 'const removedState = false // NON-VACUITY BREAK'
test_file = 'test/claustrum/enrollment.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/claustrum/enrollment.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/claustrum/enrollment.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^disconnectClaustrumEnrollment\sremoves\sthe\stoken\sand\sthe\sstate\sso\senrollmentAuthority\sreports\slocal$']
expect_message = '/Expected: "local"\s+Received: "vault"/'

[[control]]
id = 'claustrum-disconnect-takes-ceremony-lock'
guards = 'disconnect takes the same ceremony lock as reconcile() and deletes nothing while another process holds it'
file = 'src/claustrum/enrollment.ts'
old = '''    // reconcile() can never land after this removes the files.
    name: 'ceremony','''
new = '''    // reconcile() can never land after this removes the files.
    name: 'disconnect', // NON-VACUITY BREAK'''
test_file = 'test/claustrum/enrollment.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/claustrum/enrollment.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/claustrum/enrollment.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^disconnectClaustrumEnrollment\sreturns\sbusy\swhile\sthe\sceremony\slock\sis\sheld\sand\sdeletes\snothing$']
expect_message = '/Expected: "busy"\s+Received: "disconnected"/'

[[control]]
id = 'claustrum-disconnect-refuses-unsafe-state'
guards = 'disconnect removes a malformed state of its own but refuses a state file that fails the safety checks (symlink, wrong owner, not owner-only), leaving both files'
file = 'src/claustrum/enrollment.ts'
old = '''        !(error instanceof ClaustrumConsumerError) ||
        error.kind !== 'invalid-state'
      )
        throw error'''
new = '''        !(error instanceof ClaustrumConsumerError) ||
        false // NON-VACUITY BREAK
      )
        throw error'''
test_file = 'test/claustrum/enrollment.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/claustrum/enrollment.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/claustrum/enrollment.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^disconnectClaustrumEnrollment\srefuses\san\sunsafe\sstate\sfile\sand\sleaves\sboth\sfiles\sunchanged$']
expect_message = 'Expected promise that rejects'

# --- OpenCode 2 vault activation method (0.13.0) ---
# The vault method must call the plugin's activation, never its pool login,
# hand the host only this integration's placeholder, fail the host login when
# activation refuses, and refresh only its own placeholder.

[[control]]
id = 'opencode2-vault-calls-activate'
guards = 'choosing the vault method runs the plugin activation that checks vault mode'
file = 'src/opencode2/integration.ts'
old = '.then(() => vault.activate({ integrationID, methodID }))'
new = '.then(() => undefined) // NON-VACUITY BREAK: skip activation'
test_file = 'test/opencode2/integration.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; exec bun test test/opencode2/integration.test.ts -t "$1"', 'mutation', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/integration.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^registerOpenCode2AuthMethods\svault\sactivation\sthe\svault\smethod\sactivates\swithout\sa\spool\slogin\sand\shands\sthe\shost\sa\splaceholder$']
expect_message = '/-\s+"activate"/'

[[control]]
id = 'opencode2-vault-never-pool-login'
guards = 'the vault method writes nothing to the plugin pool'
file = 'src/opencode2/integration.ts'
old = '.then(() => vault.activate({ integrationID, methodID }))'
new = '.then(() => vault.activate({ integrationID, methodID })).then(() => options.onLogin(undefined as T, { integrationID, methodID })) // NON-VACUITY BREAK: also run the pool login'
test_file = 'test/opencode2/integration.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; exec bun test test/opencode2/integration.test.ts -t "$1"', 'mutation', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/integration.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^registerOpenCode2AuthMethods\svault\sactivation\sthe\svault\smethod\sactivates\swithout\sa\spool\slogin\sand\shands\sthe\shost\sa\splaceholder$']
expect_message = '/\+\s+"onLogin"/'

[[control]]
id = 'opencode2-vault-hands-own-placeholder'
guards = "the vault method hands the host this integration's placeholder"
file = 'src/opencode2/integration.ts'
old = '''          .then(() => placeholderFor(methodID)),'''
new = '''          .then(() => placeholderCredential({ integrationID: 'other', methodID, now: now() })), // NON-VACUITY BREAK: another integration's placeholder'''
test_file = 'test/opencode2/integration.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; exec bun test test/opencode2/integration.test.ts -t "$1"', 'mutation', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/integration.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^registerOpenCode2AuthMethods\svault\sactivation\sthe\svault\smethod\sactivates\swithout\sa\spool\slogin\sand\shands\sthe\shost\sa\splaceholder$']
expect_message = '/Expected: true\s+Received: false/'

[[control]]
id = 'opencode2-vault-refusal-fails-login'
guards = 'a refused activation fails the host login and hands it no placeholder'
file = 'src/opencode2/integration.ts'
old = '.then(() => vault.activate({ integrationID, methodID }))'
new = '.then(() => vault.activate({ integrationID, methodID })).catch(() => undefined) // NON-VACUITY BREAK: swallow the refusal'
test_file = 'test/opencode2/integration.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; exec bun test test/opencode2/integration.test.ts -t "$1"', 'mutation', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/integration.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^registerOpenCode2AuthMethods\svault\sactivation\sa\srefused\svault\sactivation\sfails\sthe\shost\slogin\swith\sits\smessage\sand\sno\splaceholder$']
expect_message = 'expect(received).toBeUndefined()'

[[control]]
id = 'opencode2-vault-refresh-renews'
guards = 'vault refresh issues a fresh placeholder'
file = 'src/opencode2/integration.ts'
old = '''        return placeholderFor(methodID)
      },'''
new = '''        return credential // NON-VACUITY BREAK: keep the expired placeholder
      },'''
test_file = 'test/opencode2/integration.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; exec bun test test/opencode2/integration.test.ts -t "$1"', 'mutation', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/integration.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^registerOpenCode2AuthMethods\svault\sactivation\svault\srefresh\srenews\sonly\sthe\svault\smethod.s\sown\splaceholder$']
expect_message = '/\+\s+"expires": 1831535999999/'

[[control]]
id = 'opencode2-vault-refresh-own-method'
guards = "vault refresh refuses a placeholder stored under another of the plugin's methods"
file = 'src/opencode2/integration.ts'
old = '''          !isPlaceholderCredential(credential, integrationID) ||
          credential.methodID !== methodID'''
new = '''          !isPlaceholderCredential(credential, integrationID) // NON-VACUITY BREAK: accept any method's placeholder'''
test_file = 'test/opencode2/integration.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; exec bun test test/opencode2/integration.test.ts -t "$1"', 'mutation', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/integration.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^registerOpenCode2AuthMethods\svault\sactivation\svault\srefresh\srenews\sonly\sthe\svault\smethod.s\sown\splaceholder$']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'opencode2-vault-refresh-own-integration'
guards = "vault refresh refuses another integration's placeholder and a real login"
file = 'src/opencode2/integration.ts'
old = '''          !isPlaceholderCredential(credential, integrationID) ||
          credential.methodID !== methodID'''
new = '''          credential.methodID !== methodID // NON-VACUITY BREAK: accept any credential under the vault method ID'''
test_file = 'test/opencode2/integration.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; exec bun test test/opencode2/integration.test.ts -t "$1"', 'mutation', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/opencode2/integration.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^registerOpenCode2AuthMethods\svault\sactivation\svault\srefresh\srenews\sonly\sthe\svault\smethod.s\sown\splaceholder$']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'claustrum-disconnect-rechecks-lease'
guards = 'disconnect rechecks ceremony-lock ownership after removing the token and before deleting state written by a successor'
file = 'src/claustrum/enrollment.ts'
old = '''    const removedToken = await removeIfPresent(paths.tokenPath)
    await lock.assertOwned()
    const removedState = await removeIfPresent(paths.statePath)'''
new = '''    const removedToken = await removeIfPresent(paths.tokenPath)
    const removedState = await removeIfPresent(paths.statePath) // NON-VACUITY BREAK'''
test_file = 'test/claustrum/enrollment.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/claustrum/enrollment.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/claustrum/enrollment.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^disconnectClaustrumEnrollment\srejects\sa\slost\sceremony\slease\swithout\sdeleting\ssuccessor\sstate$']
expect_message = 'Expected promise that rejects'

# --- Pi provider-slot custody ---
# These rows use exact test filters so collateral failures cannot count as catches.
# Replay each row with Bun 1.3.14 and 1.4.2; messages below are version-neutral.
[[control]]
id = 'pi-slot-restore-bytes'
guards = 'restore raw JSON, not a reserialized credential'
file = 'src/pi-slot/slot.ts'
old = 'replaceEntry(auth, provider, stash.entryJson),'
new = 'replaceEntry(auth, provider, JSON.stringify(stash.entry)), /* NON-VACUITY BREAK */'
test_file = 'test/pi-slot/slot.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/slot.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/slot.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sround\strip\spreserves\sexact\sprovider\sand\sother\sprovider\sbytes$']
expect_message = 'expect(received).toBe(expected)'

[[control]]
id = 'pi-slot-stash-before-swap'
guards = 'original stash is durable before auth replacement'
file = 'src/pi-slot/slot.ts'
old = '''await atomicWrite(
            stashPath,
            JSON.stringify(saved),
            assertLock,
            hooks?.beforeRename,
          )'''
new = 'void saved /* NON-VACUITY BREAK */'
test_file = 'test/pi-slot/slot.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/slot.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/slot.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\scrash\scrash-enter\safter\sauth-written\sconverges\swithout\sloss$']
expect_message = 'missing-stash'

[[control]]
id = 'pi-slot-resume-entry'
guards = 'stash plus original resumes the interrupted entry'
file = 'src/pi-slot/slot.ts'
old = "if (stash && digest(auth.entry) !== stash.sha256)"
new = "if (stash && digest(auth.entry) === stash.sha256) return /* NON-VACUITY BREAK */\n        if (stash && digest(auth.entry) !== stash.sha256)"
test_file = 'test/pi-slot/slot.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/slot.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/slot.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\scrash\scrash-enter\safter\sstash-written\sconverges\swithout\sloss$']
expect_message = 'placeholder'

[[control]]
id = 'pi-slot-restore-before-delete'
guards = 'restore auth before deleting the stash'
file = 'src/pi-slot/slot.ts'
old = 'replaceEntry(auth, provider, stash.entryJson),'
new = "replaceEntry(auth, provider, (await deleteStash(assertLock), stash.entryJson)), /* NON-VACUITY BREAK */"
test_file = 'test/pi-slot/slot.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/slot.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/slot.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\scrash\scrash-exit\safter\sstash-deleted\sconverges\swithout\sloss$']
expect_message = 'missing-stash'

[[control]]
id = 'pi-slot-foreign-exit'
guards = 'foreign login leaves both files unchanged on exit'
file = 'src/pi-slot/slot.ts'
old = '} else if (digest(auth.entry) !== stash.sha256) {'
new = '} else if (false /* NON-VACUITY BREAK */) {'
test_file = 'test/pi-slot/slot.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/slot.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/slot.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sforeign\slogin\sexit\sconflict\spreserves\sboth\sfiles$']
expect_message = 'conflict'

[[control]]
id = 'pi-slot-foreign-enter'
guards = 'a stash cannot authorize replacing a different login'
file = 'src/pi-slot/slot.ts'
old = 'if (stash && digest(auth.entry) !== stash.sha256)'
new = 'if (false /* NON-VACUITY BREAK */)'
test_file = 'test/pi-slot/slot.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/slot.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/slot.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sforeign\slogin\senter\srefuses\scredential\sfree\sand\sunchanged$']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'pi-slot-placeholder-command'
guards = 'placeholder must never execute a Pi command'
file = 'src/pi-slot/slot.ts'
old = "placeholderKey.startsWith('!') ||"
new = 'false /* NON-VACUITY BREAK */ ||'
test_file = 'test/pi-slot/slot.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/slot.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/slot.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\splaceholder\srefuses\sall\sPi\scommand\sand\sinterpolation\ssyntax$']
expect_message = 'invalid-options'

[[control]]
id = 'pi-slot-placeholder-template'
guards = 'placeholder must never interpolate or unescape Pi config values'
file = 'src/pi-slot/slot.ts'
old = "placeholderKey.includes('$') ||"
new = 'false /* NON-VACUITY BREAK */ ||'
test_file = 'test/pi-slot/slot.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/slot.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/slot.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\splaceholder\srefuses\sall\sPi\scommand\sand\sinterpolation\ssyntax$']
expect_message = 'invalid-options'

[[control]]
id = 'pi-slot-empty-removal'
guards = 'originally empty slot must not retain a placeholder'
file = 'src/pi-slot/slot.ts'
old = 'if (next !== null) {'
new = "if (next === null) return text /* NON-VACUITY BREAK */\n    if (next !== null) {"
test_file = 'test/pi-slot/slot.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/slot.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/slot.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sempty\sslot\sround\strip\sdeletes\sonly\sthe\splaceholder$']
expect_message = 'expect(received).toBe(expected)'

[[control]]
id = 'pi-slot-pi-lock'
guards = 'helper must wait for Pi real proper-lockfile writer'
file = 'src/pi-slot/lock.ts'
old = 'const identity = await acquire(path, STALE)'
new = 'const identity = await stat(path).then((observed) => ({ dev: observed.dev, ino: observed.ino, mtime: observed.mtime.getTime() }), () => ({ dev: 0, ino: 0, mtime: Date.now() })) /* NON-VACUITY BREAK: bypass acquisition */'
test_file = 'test/pi-slot/slot.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/slot.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/slot.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\swaits\sfor\sreal\sPi\swriter\sand\spreserves\sboth\swrites$']
expect_message = 'Expected: false'

[[control]]
id = 'pi-slot-helper-lock'
guards = 'real Pi writer must wait for helper lock'
file = 'src/pi-slot/lock.ts'
old = 'const identity = await acquire(path, STALE)'
new = 'const identity = await stat(path).then((observed) => ({ dev: observed.dev, ino: observed.ino, mtime: observed.mtime.getTime() }), () => ({ dev: 0, ino: 0, mtime: Date.now() })) /* NON-VACUITY BREAK: bypass acquisition */'
test_file = 'test/pi-slot/slot.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/slot.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/slot.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sreal\sPi\swriter\swaits\sfor\shelper\sand\spreserves\sboth\swrites$']
expect_message = 'Expected: false'

[[control]]
id = 'pi-slot-stale-boundary'
guards = 'a fresh lock cannot be removed as stale'
file = 'src/pi-slot/lock.ts'
old = 'if (!(mtime < Date.now() - stale)) throw held()'
new = 'if (false /* NON-VACUITY BREAK */) throw held()'
test_file = 'test/pi-slot/slot.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/slot.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/slot.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sstale\slock\suses\smkdir\stakeover\sand\sfresh\slock\stimes\sout\sunchanged$']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'pi-slot-renewal'
guards = 'live holders refresh directory mtime before staleness'
file = 'src/pi-slot/lock.ts'
old = 'timer = setTimeout(() => {'
new = 'timer = setTimeout(() => { return /* NON-VACUITY BREAK */;'
test_file = 'test/pi-slot/slot.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/slot.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/slot.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sholder\srenews\smtime\sand\sdetects\sa\sreplaced\slock$']
expect_message = 'toBeGreaterThan'

[[control]]
id = 'pi-slot-compromise'
guards = 'mtime mismatch compromises ownership and prevents removing a replacement'
file = 'src/pi-slot/lock.ts'
old = '''if (
      !sameDirectory(observed, identity) ||
      observed.mtime.getTime() !== mtime
    ) {'''
new = 'if (false /* NON-VACUITY BREAK */) {'
test_file = 'test/pi-slot/slot.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/slot.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/slot.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sholder\srenews\smtime\sand\sdetects\sa\sreplaced\slock$']
expect_message = 'Expected: true'

[[control]]
id = 'pi-slot-stash-integrity'
guards = 'stash digest and raw JSON must agree with the saved original'
file = 'src/pi-slot/slot.ts'
old = 'stash.sha256 !== digest(stash.entry) ||'
new = 'false /* NON-VACUITY BREAK */ ||'
test_file = 'test/pi-slot/slot.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/slot.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/slot.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sinvalid\sstash\srefuses\sboth\stransitions\sunchanged$']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'pi-slot-import-graph'
guards = 'published helper must not depend on external runtime packages'
file = 'src/pi-slot/slot.ts'
old = "import { createHash } from 'node:crypto'"
new = "import { createHash } from 'node:crypto'\nimport 'jsonc-parser' /* NON-VACUITY BREAK */"
test_file = 'test/pi-slot/slot.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/slot.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/slot.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\spublished\simport\sgraph\spermits\sonly\snode\sbuiltins,\scommon\sauth\sfiles\sand\sexternal\sWindows\sprivate-files$']
expect_message = 'Expected: true'

# Pi read-swap and stale-holder fencing. Run these exact filters on both Bun versions.
[[control]]
id = 'pi-slot-read-symlink-swap'
guards = 'a pathname changed to a symlink after fstat is refused'
file = 'src/pi-slot/slot.ts'
old = '''if (
      !current.isFile() ||
      current.dev !== stat.dev ||
      current.ino !== stat.ino
    ) {'''
new = 'if (false /* NON-VACUITY BREAK */) {'
test_file = 'test/pi-slot/races.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/races.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/races.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sraces\srefuses\ssymlink\ssubstituted\safter\sdescriptor\scheck$']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'pi-slot-read-file-swap'
guards = 'a different regular inode after fstat is refused even with identical bytes'
file = 'src/pi-slot/slot.ts'
old = '''if (
      !current.isFile() ||
      current.dev !== stat.dev ||
      current.ino !== stat.ino
    ) {'''
new = 'if (false /* NON-VACUITY BREAK */) {'
test_file = 'test/pi-slot/races.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/races.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/races.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sraces\srefuses\sfile\ssubstituted\safter\sdescriptor\scheck$']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'pi-slot-release-successor'
guards = 'release with a changed mtime cannot remove a successor lock'
file = 'src/pi-slot/lock.ts'
old = '''if (
        expired() ||
        !sameDirectory(observed, identity) ||
        mtime !== observed.mtime.getTime()
      ) {'''
new = 'if (false /* NON-VACUITY BREAK */) {'
test_file = 'test/pi-slot/races.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/races.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/races.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sraces\spaused\srelease\spreserves\ssuccessor\sdirectory\sand\sreports\scompromise$']
expect_message = 'Expected: 1'

[[control]]
id = 'pi-slot-renew-successor'
guards = 'a resumed renewer checks mtime before touching a successor lock'
file = 'src/pi-slot/lock.ts'
old = '''if (
      !sameDirectory(observed, identity) ||
      observed.mtime.getTime() !== mtime
    ) {'''
new = 'if (false /* NON-VACUITY BREAK */) {'
test_file = 'test/pi-slot/races.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/races.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/races.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sraces\spaused\srenewal\spreserves\ssuccessor\sdirectory\safter\scompromise$']
expect_message = 'expect(received).toBe(expected)'

[[control]]
id = 'pi-slot-compromised-auth-rename'
guards = 'the rename boundary rejects a compromised auth write with both files unchanged'
file = 'src/pi-slot/slot.ts'
old = '''await beforeRename?.(path)
      assertLock()'''
new = '''await beforeRename?.(path)
      /* NON-VACUITY BREAK: omit the rename fence */'''
test_file = 'test/pi-slot/races.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/races.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/races.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sraces\scompromised\slease\srefuses\sauth\srename\swithout\schanging\sfiles$']
expect_message = 'expect(received).toEqual(expected)'

[[control]]
id = 'pi-slot-compromised-stash-rename'
guards = 'the rename boundary rejects a compromised stash write before creating the stash'
file = 'src/pi-slot/slot.ts'
old = '''await beforeRename?.(path)
      assertLock()'''
new = '''await beforeRename?.(path)
      /* NON-VACUITY BREAK: omit the rename fence */'''
test_file = 'test/pi-slot/races.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/races.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/races.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sraces\scompromised\slease\srefuses\sstash\srename\swithout\schanging\sfiles$']
expect_message = 'Expected promise that rejects'

[[control]]
id = 'pi-slot-release-missing'
guards = 'a vanished lock is reported as compromise rather than a normal release'
file = 'src/pi-slot/lock.ts'
old = '''if (errorCode(error) !== 'ENOENT') throw error
        compromise()'''
new = '''if (errorCode(error) !== 'ENOENT') throw error
        /* NON-VACUITY BREAK: ignore a vanished lock */'''
test_file = 'test/pi-slot/races.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/races.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/races.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sraces\smissing\sdirectory\scompromises\srelease$']
expect_message = 'Expected: 1'

[[control]]
id = 'pi-slot-release-inode'
guards = 'release detects a different directory inode even when its mtime collides'
file = 'src/pi-slot/lock.ts'
old = 'return observed.dev === identity.dev && observed.ino === identity.ino'
new = 'return true /* NON-VACUITY BREAK */'
test_file = 'test/pi-slot/races.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/races.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/races.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sraces\srelease\srefuses\ssuccessor\swith\scolliding\smtime$']
expect_message = 'Expected: 1'

[[control]]
id = 'pi-slot-renew-inode'
guards = 'renewal detects a different directory inode even when its mtime collides'
file = 'src/pi-slot/lock.ts'
old = 'return observed.dev === identity.dev && observed.ino === identity.ino'
new = 'return true /* NON-VACUITY BREAK */'
test_file = 'test/pi-slot/races.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/races.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/races.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sraces\srenewal\srefuses\ssuccessor\swith\scolliding\smtime$']
expect_message = 'Expected: 1'

# --- Pi sync writer compatibility (0.14.1) ---
# Replayed with Bun 1.3.14 and 1.4.2; expected messages match both Bun versions' assertion output.
[[control]]
id = 'pi-slot-sync-renewal-086'
guards = 'Pi 0.86.1 sync writer cannot reclaim a helper held across its 10s stale threshold'
file = 'src/pi-slot/lock.ts'
old = 'const UPDATE = 3_000'
new = 'const UPDATE = 15_000 /* NON-VACUITY BREAK: async-only renewal interval */'
test_file = 'test/pi-slot/slot.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/slot.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/slot.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sreal\sPi\s0\.86\.1\ssync\swriter\sstays\sexcluded\spast\s10\sseconds$']
expect_message = 'Expected: 0'

[[control]]
id = 'pi-slot-sync-renewal-104'
guards = 'Pi 1.0.4 sync writer cannot reclaim a helper held across its 10s stale threshold'
file = 'src/pi-slot/lock.ts'
old = 'const UPDATE = 3_000'
new = 'const UPDATE = 15_000 /* NON-VACUITY BREAK: async-only renewal interval */'
test_file = 'test/pi-slot/slot.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/slot.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/slot.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sreal\sPi\s1\.0\.4\ssync\swriter\sstays\sexcluded\spast\s10\sseconds$']
expect_message = 'Expected: 0'

[[control]]
id = 'pi-slot-renewal-loss-bound'
guards = 'loss of confirmed renewal for 10s compromises a lease even with matching directory identity'
file = 'src/pi-slot/lock.ts'
old = 'const RENEWAL_STALE = 10_000'
new = 'const RENEWAL_STALE = 30_000 /* NON-VACUITY BREAK: async-only loss bound */'
test_file = 'test/pi-slot/races.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/races.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/races.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sraces\sexpired\srenewal\sleaves\smatching\sdirectory\suntouched$']
expect_message = 'Expected: 1'

[[control]]
id = 'pi-slot-expired-renewal'
guards = 'a resumed owner must not touch mtime after its 10s lease expires'
file = 'src/pi-slot/lock.ts'
old = '''async function update() {
    assertFresh()
    if (released) return
    let observed: Stats
    try {
      // Durable writes can occupy every async filesystem worker in fsync.
      // Renew on the calling thread so their queue cannot consume the lease.
      observed = statSync(path)
    } catch (error) {
      retry(error)
      return
    }
    assertFresh()
    if (released) return'''
new = '''async function update() {
    /* NON-VACUITY BREAK: omit expiry checks before renewal */
    if (released) return
    let observed: Stats
    try {
      // Durable writes can occupy every async filesystem worker in fsync.
      // Renew on the calling thread so their queue cannot consume the lease.
      observed = statSync(path)
    } catch (error) {
      retry(error)
      return
    }
    if (released) return'''
test_file = 'test/pi-slot/races.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/races.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/races.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sraces\sexpired\srenewal\sleaves\smatching\sdirectory\suntouched$']
expect_message = 'expect(after.mtimeMs).toBe(before.mtimeMs)'

[[control]]
id = 'pi-slot-expired-auth-rename'
guards = 'beforeRename checks lease expiry even without a renewal callback'
file = 'src/pi-slot/slot.ts'
old = 'assertFresh?.()'
new = '/* NON-VACUITY BREAK: omit expiry check from write assertions */'
test_file = 'test/pi-slot/races.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/races.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/races.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sraces\sexpired\slease\srefuses\sauth\srename\swith\smatching\sdirectory$']
# The write goes through, so release later finds the lease expired and the
# refusal still arrives; the unchanged-bytes check is what catches the break.
expect_message = 'expect(await readFile(f.authPath)).toEqual(auth)'

[[control]]
id = 'pi-slot-expired-stash-rename'
guards = 'beforeRename checks lease expiry before committing the original credential stash'
file = 'src/pi-slot/slot.ts'
old = 'assertFresh?.()'
new = '/* NON-VACUITY BREAK: omit expiry check from write assertions */'
test_file = 'test/pi-slot/races.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/races.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/races.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sraces\sexpired\slease\srefuses\sstash\srename\swith\smatching\sdirectory$']
# The write goes through, so release later finds the lease expired and the
# refusal still arrives; the unchanged-bytes check is what catches the break.
expect_message = 'expect(await readFile(f.authPath)).toEqual(auth)'

[[control]]
id = 'pi-slot-expired-release'
guards = 'release leaves an expired lease directory for staleness cleanup instead of removing it'
file = 'src/pi-slot/lock.ts'
old = 'const expired = () => lastUpdate + RENEWAL_STALE < Date.now()'
new = 'const expired = () => false /* NON-VACUITY BREAK: release ignores lease expiry */'
test_file = 'test/pi-slot/races.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/races.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/races.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sraces\sexpired\srelease\sleaves\smatching\sdirectory\suntouched$']
expect_message = 'Expected: 1'

[[control]]
id = 'pi-slot-expired-exit-cleanup'
guards = 'exit cleanup leaves an expired lease directory instead of removing it'
file = 'src/pi-slot/lock.ts'
old = '      if (identity.renewedAt + RENEWAL_STALE < Date.now()) continue'
new = '      /* NON-VACUITY BREAK: exit cleanup ignores lease expiry */'
test_file = 'test/pi-slot/races.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/races.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/races.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\sraces\sexpired\sexit\scleanup\sleaves\smatching\sdirectory\suntouched$']
expect_message = 'ENOENT'

# Both Bun versions use this stable label for a failed command-string equality;
# the assertion diff may vary without changing which test caught the mutation.
[[control]]
id = 'auth-menu-windows-oauth-url'
guards = 'Windows opener preserves every OAuth URL character in its encoded PowerShell command'
file = 'src/auth-menu/login.ts'
old = '''const command = `Start-Process '${url.replaceAll("'", "''")}'`'''
new = '''const command = `Start-Process '${url}'` /* NON-VACUITY BREAK */'''
test_file = 'test/auth-menu/login.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/auth-menu/login.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/auth-menu/login.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^auth\smenu\sbrowser\sopener\sWindows\sencodes\san\sOAuth\sURL\sintact\swithout\sa\sshell$']
expect_message = 'expect(received).toEqual(expected)'

[[control]]
id = 'auth-menu-windows-opener-does-not-wait'
guards = 'Windows opener launches PowerShell unreferenced without waiting, so a slow cold start is never killed before the browser opens'
file = 'src/auth-menu/login.ts'
old = 'child.unref()'
new = 'void child /* NON-VACUITY BREAK */'
test_file = 'test/auth-menu/login.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/auth-menu/login.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/auth-menu/login.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^auth\smenu\sbrowser\sopener\sWindows\sencodes\san\sOAuth\sURL\sintact\swithout\sa\sshell$']
expect_message = 'expect(received).toEqual(expected)'

[[control]]
id = 'any-signal-dispose-removes-listeners'
broad_command = ['bun', 'test', 'test/util/any-signal.test.ts', '--reporter=junit', '--reporter-outfile=any-signal-broad.xml']
broad_report = 'any-signal-broad.xml'
broad_id = '{name}'
guards = 'disposing a combined signal removes every listener from each source signal'
file = 'src/util/any-signal.ts'
old = "source.removeEventListener('abort', listener)"
new = 'void listener /* NON-VACUITY BREAK */'
test_file = 'test/util/any-signal.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/util/any-signal.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/util/any-signal.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['dispose removes every source listener across repeated combines']
expect_message = 'Expected: 0'

[[control]]
id = 'any-signal-first-abort-reason'
broad_command = ['bun', 'test', 'test/util/any-signal.test.ts', '--reporter=junit', '--reporter-outfile=any-signal-broad.xml']
broad_report = 'any-signal-broad.xml'
broad_id = '{name}'
guards = 'the first source signal to abort supplies the combined signal reason'
file = 'src/util/any-signal.ts'
old = 'const listener = () => abort(source.reason)'
new = 'const listener = () => abort(signals[0]!.reason) /* NON-VACUITY BREAK */'
test_file = 'test/util/any-signal.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/util/any-signal.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/util/any-signal.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['keeps the reason from the first signal that aborts']
expect_message = 'Expected: "second reason"'

[[control]]
id = 'any-signal-handles-pre-aborted-input'
broad_command = ['bun', 'test', 'test/util/any-signal.test.ts', '--reporter=junit', '--reporter-outfile=any-signal-broad.xml']
broad_report = 'any-signal-broad.xml'
broad_id = '{name}'
guards = 'an input already aborted before combination aborts the result immediately'
file = 'src/util/any-signal.ts'
old = 'controller.abort(alreadyAborted.reason)'
new = 'void alreadyAborted.reason /* NON-VACUITY BREAK */'
test_file = 'test/util/any-signal.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/util/any-signal.test.ts', '-t', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/util/any-signal.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['immediately aborts when an input is already aborted']
expect_message = 'Expected: true'

# These controls disable common-auth's Windows verification, publication and lease guards.
# Actual NTFS RPC-token refusal propagation is checked separately by test/windows/mutations.ps1.

[[control]]
id = "private-refusal"
guards = "refusal predicates prevent writes and name path and stage"
file = "src/fs/private-files.ts"
old = "if (!result.ok) {"
new = "if (!result.ok && Boolean(false) /* NON-VACUITY BREAK */) {"
test_file = "test/fs/windows-private-files.test.ts"
runner = "command"
command = ['sh', '-c', 'git diff --stat; bun test "$1" -t "$2"', 'sh', "test/fs/windows-private-files.test.ts", '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/windows-private-files.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ["refusal predicates prevent writes and name path and stage"]

[[control]]
id = "private-migration-owner"
guards = "foreign ownership and reparse points are never migrated"
file = "src/fs/private-files.ts"
old = "].includes(reason as typeof api.EXTRA_ACE)"
new = "].includes(api.EXTRA_ACE /* NON-VACUITY BREAK */)"
test_file = "test/fs/windows-private-files.test.ts"
runner = "command"
command = ['sh', '-c', 'git diff --stat; bun test "$1" -t "$2"', 'sh', "test/fs/windows-private-files.test.ts", '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/windows-private-files.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ["foreign ownership and reparse points are never migrated"]

[[control]]
id = "private-deadline"
guards = "elapsed deadline includes IO and lease cap prevents a new attempt"
file = "src/fs/private-files.ts"
old = '''
    if (now() >= deadline) break
    if (delay)
      await (options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))))(
        Math.min(delay, Math.max(0, deadline - now())),
      )
    if (now() >= deadline) break
    await options.beforeRename?.()
    if (now() >= deadline) break'''
new = '''
    if (Boolean(false) /* NON-VACUITY BREAK */) break
    if (delay)
      await (options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))))(
        Math.min(delay, Math.max(0, deadline - now())),
      )
    if (Boolean(false) /* NON-VACUITY BREAK */) break
    await options.beforeRename?.()
    if (Boolean(false) /* NON-VACUITY BREAK */) break'''
test_file = "test/fs/windows-private-files.test.ts"
runner = "command"
command = ['sh', '-c', 'git diff --stat; bun test "$1" -t "$2"', 'sh', "test/fs/windows-private-files.test.ts", '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/windows-private-files.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ["elapsed deadline includes IO and lease cap prevents a new attempt"]

[[control]]
id = "private-native-retry"
guards = "native ACL errors and nonsharing codes are terminal"
file = "src/fs/private-files.ts"
old = "detail.win32Code === 32 || detail.win32Code === 33"
new = "Boolean(true) /* NON-VACUITY BREAK */"
test_file = "test/fs/windows-private-files.test.ts"
runner = "command"
command = ['sh', '-c', 'git diff --stat; bun test "$1" -t "$2"', 'sh', "test/fs/windows-private-files.test.ts", '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/windows-private-files.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ["native ACL errors and nonsharing codes are terminal"]

[[control]]
id = "private-fence"
guards = "fencing reruns before retry and stops publication"
file = "src/fs/private-files.ts"
old = "await options.beforeRename?.()"
new = "/* NON-VACUITY BREAK: disable the per-attempt lease fence */"
test_file = "test/fs/windows-private-files.test.ts"
runner = "command"
command = ['sh', '-c', 'git diff --stat; bun test "$1" -t "$2"', 'sh', "test/fs/windows-private-files.test.ts", '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/windows-private-files.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ["fencing reruns before retry and stops publication"]

[[control]]
id = "private-publication"
guards = "postpublication verify refusal never reports not published"
file = "src/fs/private-files.ts"
old = "error.published = published"
new = "error.published = false /* NON-VACUITY BREAK */"
test_file = "test/fs/windows-private-files.test.ts"
runner = "command"
command = ['sh', '-c', 'git diff --stat; bun test "$1" -t "$2"', 'sh', "test/fs/windows-private-files.test.ts", '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/windows-private-files.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ["postpublication verify refusal never reports not published"]

[[control]]
id = "private-stage-ownership"
guards = "failure before publication keeps old bytes and cleans only its own stage"
file = "src/fs/private-files.ts"
old = "await createPrivateBytes(stage, bytes)"
new = "created = true /* NON-VACUITY BREAK */; await createPrivateBytes(stage, bytes)"
test_file = "test/fs/windows-private-files.test.ts"
runner = "command"
command = ['sh', '-c', 'git diff --stat; bun test "$1" -t "$2"', 'sh', "test/fs/windows-private-files.test.ts", '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/windows-private-files.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ["failure before publication keeps old bytes and cleans only its own stage"]

[[control]]
id = "private-lease-contention"
guards = "Windows lease acquire does not convert access or sharing errors into success"
file = "src/fs/refresh-file-lock.ts"
old = "if (code === 'EEXIST') {"
new = "if (['EEXIST', 'EBUSY', 'EPERM', 'EACCES'].includes(code ?? '') /* NON-VACUITY BREAK */) {"
test_file = "test/fs/windows-private-files.test.ts"
runner = "command"
command = ['sh', '-c', 'git diff --stat; bun test "$1" -t "$2"', 'sh', "test/fs/windows-private-files.test.ts", '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/windows-private-files.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ["Windows lease acquire does not convert access or sharing errors into success"]

[[control]]
id = "private-lease-release"
guards = "Windows lease release does not convert access or sharing errors into success"
file = "src/fs/refresh-file-lock.ts"
old = '''
        } catch (error) {
          if (windowsPrivateFiles) throw error
          return
        }
        await backoff()'''
new = '''
        } catch (error) {
          if (Boolean(false) /* NON-VACUITY BREAK */) throw error
          return
        }
        await backoff()'''
test_file = "test/fs/windows-private-files.test.ts"
runner = "command"
command = ['sh', '-c', 'git diff --stat; bun test "$1" -t "$2"', 'sh', "test/fs/windows-private-files.test.ts", '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/windows-private-files.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ["Windows lease release does not convert access or sharing errors into success"]

[[control]]
id = "private-external"
guards = "external fence rejects an inlined native loader and a missing import"
file = "scripts/check-private-files-external.ts"
old = "'private-files-win32-'"
new = "'UNMATCHABLE NON-VACUITY BREAK'"
test_file = "test/fs/private-files-external.test.ts"
runner = "command"
command = ['sh', '-c', 'git diff --stat; bun test "$1" -t "$2"', 'sh', "test/fs/private-files-external.test.ts", '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/private-files-external.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ["external fence rejects an inlined native loader and a missing import"]

[[control]]
id = "private-stage-directory"
guards = "Windows atomic stage stays in the verified destination directory"
file = "src/fs/private-files.ts"
old = "if (dirname(stage) !== dirname(path))"
new = "if (Boolean(false) /* NON-VACUITY BREAK */)"
test_file = "test/fs/windows-private-files.test.ts"
runner = "command"
command = ['sh', '-c', 'git diff --stat; bun test test/fs/windows-private-files.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/windows-private-files.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ["Windows atomic stage stays in the verified destination directory"]

[[control]]
id = "private-watchdog-cancellation"
guards = "Windows watchdog cancels the caller wait and kills its own helper"
file = "test/windows/watchdog.mjs"
old = "state.abort.abort()"
new = "/* NON-VACUITY BREAK: do not interrupt the pending caller await */"
test_file = "test/fs/windows-watchdog.test.mjs"
runner = "command"
command = ['sh', '-c', 'git diff --stat; bun test test/fs/windows-watchdog.test.mjs -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/fs/windows-watchdog.test.mjs", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ["Windows watchdog cancels the caller wait and kills its own helper"]

[[control]]
id = "private-logger-append"
guards = "steady Windows logger flushes append new bytes without reading or replacing the existing log"
file = "src/logger/engine.ts"
old = '''    await privateOperation(file, 'log-append', () =>
      handle.appendFile(text, 'utf8'),
    )'''
new = '''    const rewrite = await import('../fs/private-files.js'); /* NON-VACUITY BREAK */
    await rewrite.writePrivateAtomic(file, (await rewrite.readPrivateText(file)) + text);
    await privateOperation(file, 'log-append', () => handle.appendFile('', 'utf8'))'''
test_file = "test/logger/windows-append.test.ts"
runner = "command"
command = ['sh', '-c', 'git diff --stat; bun test test/logger/windows-append.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/logger/windows-append.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ["Windows logger steady flushes append without reading or rewriting the log"]
expect_message = "steady flushes must not read the log"

[[control]]
id = 'private-safe-parent-not-owner-only'
guards = 'safe containing directories do not need the secret file owner-only template'
file = 'src/fs/private-files.ts'
old = 'const result = await (await loadBackend()).verifySafeParent(path, options)'
new = 'const result = await (await loadBackend()).verifyOwnerOnly(path).then((r) => r.ok ? { ok: true as const } : { ok: false as const, path, level: undefined as string | undefined, reason: r.refusal.reason }) /* NON-VACUITY BREAK */'
test_file = 'test/fs/windows-private-files.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/fs/windows-private-files.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/fs/windows-private-files.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^Windows\sprivate\sIO\slogic\ssafe\sexisting\sparents\sdo\snot\srequire\sowner-only\spermissions\sor\srepair$']

[[control]]
id = 'private-migration-safe-parent'
guards = 'legacy secret permission repair checks its containing directory before calling the backend'
file = 'src/fs/private-files.ts'
old = '''await verifySafeDirectory(dirname(path))
        await api.securePrivatePath(path, kind)'''
new = '''/* NON-VACUITY BREAK: skip the safe parent before in-place repair */
        await api.securePrivatePath(path, kind)'''
test_file = 'test/fs/windows-private-files.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/fs/windows-private-files.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/fs/windows-private-files.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^Windows\sprivate\sIO\slogic\sin-place\ssecuring\srefuses\swritable\sparents\sbefore\sbackend\srepair$']
expect_message = 'Received promise that resolved'

[[control]]
id = 'private-ubuntu-parent-exception'
guards = 'POSIX enrollment accepts Ubuntu private-group 0775 ancestors without requiring owner-only directory permissions'
file = 'src/claustrum/enrollment.ts'
old = '!privateGroup'
new = 'true /* NON-VACUITY BREAK: refuse even a proven private group */'
test_file = 'test/claustrum/enrollment-ancestors.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/claustrum/enrollment-ancestors.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/claustrum/enrollment-ancestors.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^Ubuntu\sumask\s0002\sconfig\slayout\spasses\senrollment\sancestry\sunchanged$']

[[control]]
id = 'posix-store-no-ancestor-policy'
guards = 'POSIX store writes below a foreign-owned group-writable ancestor without loading or consulting the Windows ancestry policy'
file = 'src/fs/atomic-write.ts'
old = 'await mkdir(dirname(path), { recursive: true })'
new = '''await mkdir(dirname(path), { recursive: true })
  await (await import('./private-files.js')).verifySafeDirectory(dirname(path)) /* NON-VACUITY BREAK */'''
test_file = 'test/store/posix-parents.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/store/posix-parents.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/store/posix-parents.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^POSIX\sstore\swrites\sbelow\sa\sgroup-writable\sancestor\sowned\sby\sanother\suid$']
expect_message = 'Private file refused at safe-parent'

# --- Optional insula background quota ---

[[control]]
id = 'insula-account-id-join'
guards = 'only the exact trimmed insula account joins the vault-served account_id, never a different account with matching display metadata'
file = 'src/claustrum/insula.ts'
old = 'entry.account.trim() !== accountId'
new = 'false /* NON-VACUITY BREAK: accept a different account. */'
test_file = 'test/claustrum/insula.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/claustrum/insula.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/claustrum/insula.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^wrong\saccount_id\sinsula\squota\sfalls\sback\sto\sthe\sown\spoll$']
expect_message = 'account-work'

[[control]]
id = 'insula-provider-join'
guards = 'accounts in another insula provider namespace cannot suppress the plugin own poll'
file = 'src/claustrum/insula.ts'
old = 'entry.provider !== provider ||'
new = '/* NON-VACUITY BREAK: ignore the provider namespace. */'
test_file = 'test/claustrum/insula.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/claustrum/insula.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/claustrum/insula.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^wrong\sprovider\sinsula\squota\sfalls\sback\sto\sthe\sown\spoll$']
expect_message = 'account-work'

[[control]]
id = 'insula-fetched-at-age'
guards = 'a reading four minutes old falls back even when the usage.get response just arrived'
file = 'src/claustrum/insula.ts'
old = 'now - fetchedAt >= MAX_AGE'
new = 'false /* NON-VACUITY BREAK: ignore producer reading age. */'
test_file = 'test/claustrum/insula.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/claustrum/insula.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/claustrum/insula.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^old\sinsula\squota\sfalls\sback\sto\sthe\sown\spoll$']
expect_message = 'account-work'

[[control]]
id = 'insula-stale-is-not-current'
guards = 'the presence of stale prevents suppressing the own poll even with a young fetchedAt'
file = 'src/claustrum/insula.ts'
old = 'entry.stale !== undefined ||'
new = '/* NON-VACUITY BREAK: ignore stale. */'
test_file = 'test/claustrum/insula.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/claustrum/insula.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/claustrum/insula.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^stale\sinsula\squota\sfalls\sback\sto\sthe\sown\spoll$']
expect_message = 'account-work'

[[control]]
id = 'insula-degraded-is-not-current'
guards = 'errorClass is a degraded verdict and cannot become current merely because usage and a young timestamp remain'
file = 'src/claustrum/insula.ts'
old = 'entry.errorClass !== undefined ||'
new = '/* NON-VACUITY BREAK: ignore errorClass. */'
test_file = 'test/claustrum/insula.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/claustrum/insula.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/claustrum/insula.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^degraded\sinsula\squota\sfalls\sback\sto\sthe\sown\spoll$']
expect_message = 'account-work'

[[control]]
id = 'insula-refusal-fallback'
guards = 'a refused insula route immediately clears even a current cache, so the plugin own poll runs'
file = 'src/claustrum/insula.ts'
old = '''        // Refusal is absence, even if the previous reading was still young.
        this.#entries = []'''
new = '        // NON-VACUITY BREAK: keep the previously current cache on refusal.'
test_file = 'test/claustrum/insula.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/claustrum/insula.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/claustrum/insula.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^insula\srefusal\sinvalidates\sa\spreviously\scurrent\scache$']
expect_message = 'account-work'

[[control]]
id = 'insula-once-per-minute'
guards = 'several projects sharing one principal cannot perform another usage.get before the minute boundary'
file = 'src/claustrum/insula.ts'
old = 'now - lastAttempt < MINUTE'
new = 'now - lastAttempt < 1 /* NON-VACUITY BREAK: forget the minute bound. */'
test_file = 'test/claustrum/insula.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/claustrum/insula.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/claustrum/insula.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^several\sprojects\sshare\sone\sinsula\susage.get\sper\sminute\sand\srelease\sindependently$']
expect_message = '/Expected: 1\s+Received: 2/'

[[control]]
id = 'insula-route-lookup-observes-peer-replacement'
guards = 'background route lookup reads the committed roster so a peer known-account replacement cannot keep the old route matched to insula'
file = 'src/claustrum/consumer.ts'
old = '''      const roster = await readVaultRoster(this.#options.rosterPath)
      const row = roster?.rows.find((entry) => entry.routeId === routeId)'''
new = '''      // NON-VACUITY BREAK: ignore peer replacements and use the old local snapshot.
      const roster = this.#roster
      const row = roster?.rows.find((entry) => entry.routeId === routeId)'''
test_file = 'test/claustrum/insula.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/claustrum/insula.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/claustrum/insula.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^route\slookup\smisses\safter\sa\speer\scommits\sa\sknown\saccount\sreplacement$']
expect_message = 'error: expect(received).toBeUndefined()'

[[control]]
id = 'insula-deadline-does-not-hold-host-open'
guards = 'the whole-call deadline timer is unreferenced so an optional pending insula lookup cannot hold an otherwise idle host process open'
file = 'src/claustrum/insula.ts'
old = '        timer.unref?.()'
new = '        // NON-VACUITY BREAK: retain the timer reference at shutdown.'
test_file = 'test/claustrum/insula.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/claustrum/insula.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/claustrum/insula.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^a\spending\sinsula\sdeadline\sdoes\snot\skeep\san\sotherwise\sidle\shost\sprocess\salive$']
expect_message = 'Expected: < 2000'

[[control]]
id = 'insula-account-quota-fenced-on-account'
guards = 'a background account reading lands only on a route still bound to that exact known account'
file = 'src/claustrum/roster.ts'
old = '''      row.accountIdentity === undefined ||
      row.accountIdentity !== input.accountIdentity'''
new = '''      false /* NON-VACUITY BREAK: write any account's reading. */'''
test_file = 'test/claustrum/insula.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/claustrum/insula.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/claustrum/insula.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^an\saccount\squota\swrite\sis\srefused\sfor\sanother\saccount\sor\san\sunbound\sroute$']
expect_message = 'Expected: false'

[[control]]
id = 'setup-pi-folder-without-cli-is-skipped'
guards = 'a leftover Pi folder without the pi CLI is left out of setup instead of failing the run for OpenCode'
file = 'src/setup/command.ts'
old = "(host) => detection[host].installed && !(host === 'pi' && piWithoutCli),"
new = "(host) => detection[host].installed /* NON-VACUITY BREAK: keep Pi without its CLI. */,"
test_file = 'test/setup/command.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/setup/command.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/command.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sflow\sa\sPi\sfolder\swithout\sthe\spi\sCLI\sis\sskipped\sand\snever\sblocks\sOpenCode$']
expect_message = 'Received'

[[control]]
id = 'setup-dry-run-without-terminal-plans'
guards = 'a dry run without a terminal plans the --yes path instead of refusing, since it changes nothing'
file = 'src/setup/command.ts'
old = 'options.yes || (options.dryRun && !isInteractive(terminal))'
new = 'options.yes /* NON-VACUITY BREAK: refuse a non-interactive dry run. */'
test_file = 'test/setup/command.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/setup/command.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/command.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sflow\sa\sdry\srun\swithout\sa\sterminal\splans\sthe\s--yes\spath\sinstead\sof\srefusing$']
expect_message = 'Setup requires a TTY or --yes.'

# --- timestamped quota counters ---
[[control]]
id = 'quota-counters-newest-wins'
guards = 'An older counter cannot overwrite a newer per-name count, independent of observation time'
file = 'src/quota/merge.ts'
old = 'if (existing === undefined || counter.checkedAt >= existing.checkedAt) {'
new = 'if (true /* NON-VACUITY BREAK */) {'
test_file = 'test/quota/counters.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/quota/counters.test.ts -t "$1"', 'sh', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/quota/counters.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^quota\scounters\sthe\snewest\scounter\swins\sin\seither\sarrival\sorder\susing\sits\sown\stimestamp$']

[[control]]
id = 'quota-counters-absent-name-retained'
guards = 'A partial observation cannot erase a counter whose name it did not report'
file = 'src/quota/merge.ts'
old = 'const counters = new Map(Object.entries(stored ?? {}))'
new = '''const counters = new Map(Object.entries(stored ?? {}))
  for (const name of counters.keys()) {
    if (observed !== undefined && !Object.hasOwn(observed, name)) counters.delete(name) // NON-VACUITY BREAK
  }'''
test_file = 'test/quota/counters.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/quota/counters.test.ts -t "$1"', 'sh', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/quota/counters.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^quota\scounters\san\sabsent\scounter\sname\sleaves\sthe\sstored\scount\salone$']

[[control]]
id = 'setup-callbacks-receive-chosen-generation'
guards = 'plugin callbacks receive the OpenCode generation setup registers, so OpenCode 2 sign-in does not go to OpenCode 1 login storage'
file = 'src/setup/command.ts'
old = '''      opencodeGeneration: generation,
      mode,'''
new = '''      opencodeGeneration: '1' /* NON-VACUITY BREAK: ignore the chosen generation. */,
      mode,'''
test_file = 'test/setup/command.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/setup/command.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/command.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sflow\scallbacks\sreceive\sthe\sOpenCode\sgeneration\schosen\swith\s--opencode\sand\sthe\smode$']
expect_message = 'opencodeGeneration'

[[control]]
id = 'quota-merge-decodes-stored-counters'
guards = 'a malformed stored counter that reads hide cannot make every later quota write refuse'
file = 'src/quota/merge.ts'
old = 'const decoded = stored === undefined ? undefined : decodeQuotaMap(stored)'
new = 'const decoded = stored === undefined ? undefined : (decodeQuotaMap({ limits: [] }) && (stored as QuotaMap)) /* NON-VACUITY BREAK */'
test_file = 'test/store/quota-codec.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/store/quota-codec.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/store/quota-codec.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^a\slater\squota\swrite\sdrops\sa\smalformed\sstored\scounter\sinstead\sof\srefusing$']

[[control]]
id = 'setup-before-sign-in-runs-first'
guards = 'a plugin can refuse a host (for example missing consent) before any enrollment, sign-in or registration happens'
file = 'src/setup/command.ts'
old = '      await plugin.beforeSignIn?.(host, context)'
new = '      void 0 /* NON-VACUITY BREAK: skip beforeSignIn. */'
test_file = 'test/setup/command.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/setup/command.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/command.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sflow\sbeforeSignIn\sruns\sfirst\sand\sa\srefusal\sstops\sthe\shost\sbefore\sanything\schanges$']

[[control]]
id = 'setup-fence-judges-the-executable'
guards = 'the process fence judges what a process executes, so a shell command line that mentions an opencode folder does not block setup'
file = 'src/setup/process-fence.ts'
old = '  if (!RUNTIMES.has(name)) return null'
new = '  if (!RUNTIMES.has(name)) return rest.map(executableName).find((n) => HOSTS.has(n)) ?? null /* NON-VACUITY BREAK */'
test_file = 'test/setup/fence.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/setup/fence.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/fence.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sprocess\sfence\sa\sshell\swhose\scommand\sline\smentions\san\sopencode\sfolder\sis\snot\sa\srunning\shost$']

[[control]]
id = 'setup-context-carries-selected-hosts'
guards = 'the first beforeSignIn sees every selected host, so a plugin can check cross-host conditions before any host changes'
file = 'src/setup/command.ts'
old = '      hosts: Object.freeze([...hosts]),'
new = '      hosts: Object.freeze(hosts.slice(0, 1)) /* NON-VACUITY BREAK */,'
test_file = 'test/setup/command.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/setup/command.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/command.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sflow\sthe\sfirst\sbeforeSignIn\ssees\severy\sselected\shost\sbefore\sany\shost\schanges$']

[[control]]
id = 'setup-fence-skips-runtime-option-values'
guards = 'a host started with a value-taking runtime option (node --require x opencode) is still recognized, so setup cannot run beside it'
file = 'src/setup/process-fence.ts'
old = "      if (!argument.includes('=') && VALUE_OPTIONS.has(argument)) index++"
new = "      void VALUE_OPTIONS /* NON-VACUITY BREAK: treat option values as the script. */"
test_file = 'test/setup/fence.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/setup/fence.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/fence.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sprocess\sfence\sruntime\soptions\swith\svalues\sare\snot\smistaken\sfor\sthe\shost\sscript$']

[[control]]
id = 'setup-context-carries-pi-agent-dir'
guards = "setup callbacks get Pi's own agent folder from PI_CODING_AGENT_DIR, so a plugin never inspects or writes the wrong Pi auth.json"
file = 'src/setup/command.ts'
old = '      piAgentDir: detection.pi.directory,'
new = "      piAgentDir: detection.opencode.directory /* NON-VACUITY BREAK */,"
test_file = 'test/setup/command.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/setup/command.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/command.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ["^setup\\sflow\\scallbacks\\sget\\sPi's\\sown\\sagent\\sfolder\\sfrom\\sPI_CODING_AGENT_DIR,\\snot\\sa\\splugin\\spath$"]

[[control]]
id = 'quota-decode-keeps-valid-map-identity'
guards = 'a valid stored quota map keeps its object identity through decoding, as before counters existed, so identity-based change detection in plugins is unaffected'
file = 'src/quota/map.ts'
old = '  if (isQuotaMap(value)) return value'
new = '  if (isQuotaMap(value)) return { ...value } /* NON-VACUITY BREAK */'
test_file = 'test/quota/counters.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/quota/counters.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/quota/counters.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^quota\scounters\sdecoding\sreturns\sa\svalid\smap\sas\sthe\ssame\sobject$']

[[control]]
id = 'setup-dry-run-skips-powershell'
guards = 'a Windows dry run never starts PowerShell, which writes a startup cache into the user profile; it only counts Node and Bun programs'
file = 'src/setup/process-fence.ts'
old = '    if (windows && runtimes.length && options.inspectRuntimes !== false) {'
new = '    if (windows && runtimes.length) { /* NON-VACUITY BREAK */'
test_file = 'test/setup/fence.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/setup/fence.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/fence.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sprocess\sfence\sa\sWindows\spreview\snever\sstarts\sPowerShell\sand\sonly\scounts\sNode\sand\sBun$']

[[control]]
id = 'setup-dry-run-uses-preview'
guards = 'a dry run previews hosts instead of running the full inspection, so it changes nothing'
file = 'src/setup/command.ts'
old = """      const preview = fence.previewRunningHosts
        ? await fence.previewRunningHosts(env)"""
new = """      const preview = false
        ? { hosts: [], uncheckedRuntimes: 0 } /* NON-VACUITY BREAK */"""
test_file = 'test/setup/command.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/setup/command.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/command.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sflow\sa\sdry\srun\spreviews\srunning\shosts\swithout\sthe\sfull\sinspection$']

[[control]]
id = 'setup-vault-question-cancel-stops'
guards = 'cancelling the vault question (Escape or Ctrl-C) stops setup before any sign-in, registration or migration, instead of reading as a local sign-in'
file = 'src/setup/command.ts'
old = '    if (choice === null) {'
new = "    if ((choice as unknown) === 'never') { /* NON-VACUITY BREAK */"
test_file = 'test/setup/command.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/setup/command.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/command.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sflow\sCtrl-C\sat\sthe\svault\squestion\sstops\ssetup\sbefore\sanything\schanges$']

[[control]]
id = 'setup-enrollment-report-is-recorded'
guards = 'a setup failure reports each host as setup recorded it (a host never asked is not connected), not from a fresh probe of its files after the failure'
file = 'src/setup/command.ts'
old = "    let outcome = recorded.get(host) ?? 'not-enrolled'"
new = "    let outcome: SetupEnrollmentOutcome = 'unknown' /* NON-VACUITY BREAK: ignore the record and probe every host. */"
test_file = 'test/setup/command.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/setup/command.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/command.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sflow\sa\sfailure\safter\sOpenCode\senrolled\sand\sbefore\sPi\snames\sthe\sconnected\shost$']
expect_message = 'Pi: unknown, check with ck auth status'

[[control]]
id = 'setup-no-enrollment-lines-before-enrollment'
guards = 'a setup failure before any host enrollment began keeps its error unchanged, with no per-host vault lines'
file = 'src/setup/command.ts'
old = '      if (enrollment.size === 0) throw error'
new = '      if (false as boolean) throw error /* NON-VACUITY BREAK: report hosts before any enrollment. */'
test_file = 'test/setup/command.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/setup/command.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/command.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sflow\sa\sfailure\sbefore\sany\senrollment\sstep\sleaves\sthe\serror\sunchanged$']
expect_message = 'not-enrolled'

[[control]]
id = 'setup-enrollment-never-inspects-the-thrown-value'
guards = 'reporting the vault outcome after a setup failure never reads, rewrites or stringifies the thrown value'
file = 'src/setup/command.ts'
old = '        recordSetupEnrollment(error, report)'
new = '        recordSetupEnrollment(error, report); void String(error) /* NON-VACUITY BREAK: stringify the thrown value. */'
test_file = 'test/setup/command.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/setup/command.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/command.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^setup\sflow\sa\sfailure\safter\senrollment\srethrows\sa\sproxy\sthat\srecords\severy\stouch\suntouched$']

[[control]]
id = 'quota-reset-span-two-units-never-later'
guards = 'a reset span shows its two largest whole units, floored, so it is never shown later than the real reset'
file = 'src/quota/format.ts'
old = '    const hours = Math.floor(minutes / 60)'
new = '    const hours = Math.round(minutes / 60) /* NON-VACUITY BREAK */'
test_file = 'test/quota/format.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/quota/format.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/quota/format.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^shared\squota\swording\sa\sreset\sshows\sits\stwo\slargest\sunits\sand\sis\snever\sshown\slater\sthan\sit\sis$']

[[control]]
id = 'quota-span-minutes-round-down'
guards = 'a span rounds its minutes down, so a reset 2h29m40s away reads 2h29m and never later than real'
file = 'src/quota/format.ts'
old = '  const minutes = Math.max(1, Math.floor(ms / 60_000))'
new = '  const minutes = Math.max(1, Math.round(ms / 60_000)) /* NON-VACUITY BREAK */'
test_file = 'test/quota/format.test.ts'
runner = 'command'
command = ['bun', 'test', 'test/quota/format.test.ts', '-t', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/quota/format.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^shared\squota\swording\sa\sreset\sshows\sits\stwo\slargest\sunits\sand\sis\snever\sshown\slater\sthan\sit\sis$']

[[control]]
id = 'pi-slot-renewal-stat-pool'
guards = 'renewal stat bypasses async workers held in durable fsync'
file = 'src/pi-slot/lock.ts'
old = '      observed = statSync(path)'
new = '      observed = await stat(path) /* NON-VACUITY BREAK: queue behind fsync */'
test_file = 'test/pi-slot/renewal.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/renewal.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/renewal.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\srenewal\scompletes\swhile\sdurable\sfsyncs\ssaturate\sthe\sasync\spool$']
expect_message = '"queuedStat": 4'

[[control]]
id = 'pi-slot-renewal-utimes-pool'
guards = 'renewal utimes bypasses async workers held in durable fsync'
file = 'src/pi-slot/lock.ts'
old = 'utimesSync(path, next, next)'
new = 'await utimes(path, next, next) /* NON-VACUITY BREAK: queue behind fsync */'
test_file = 'test/pi-slot/renewal.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/renewal.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/renewal.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\srenewal\scompletes\swhile\sdurable\sfsyncs\ssaturate\sthe\sasync\spool$']
expect_message = '"queuedUtimes": 4'

[[control]]
id = 'pi-slot-renewal-confirm-expiry'
guards = 'a stalled synchronous utimes cannot confirm an expired lease'
file = 'src/pi-slot/lock.ts'
old = '''// A metadata syscall can itself stall; never confirm an expired lease.
    assertFresh()'''
new = '/* NON-VACUITY BREAK: confirm renewal despite expiry during utimes */'
test_file = 'test/pi-slot/renewal.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/pi-slot/renewal.test.ts -t "$1"', 'sh', '{test}']
list_command = ["bun", "scripts/list-bun-tests.mjs", "test/pi-slot/renewal.test.ts", "{test}"]
test_count_pattern = 'Ran {count} test'
expect_red = ['^pi\sslot\srenewal\srefuses\sexpiry\sduring\ssynchronous\sutimes$']
expect_message = '"compromised": 0'

[[control]]
id = 'setup-command-runner-settles-on-spawn-error'
guards = 'A setup command that never starts settles on its spawn error without waiting for a close event'
file = 'src/setup/command-runner.ts'
old = 'if (child.pid === undefined) settle(null, null)'
new = '/* NON-VACUITY BREAK */'
test_file = 'test/setup/command-runner-spawn-error.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/setup/command-runner-spawn-error.test.ts -t "$1"', 'sh', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/setup/command-runner-spawn-error.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^a\scommand\sthat\snever\sstarts\ssettles\son\sits\sspawn\serror\swithout\sa\sclose\sevent$']
expect_message = 'hung'

# --- narrow quota form (formatQuota form 'narrow': one short line per account) ---
[[control]]
id = 'quota-narrow-left-once'
guards = 'The narrow quota line says left once, after its last piece, not after every window'
file = 'src/quota/format.ts'
old = 'index === pieces.length - 1 ? `${piece} left` : piece,'
new = '`${piece} left`, // NON-VACUITY BREAK: say left after every piece'
test_file = 'test/quota/format.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/quota/format.test.ts -t "$1"', 'sh', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/quota/format.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^narrow\squota\swording\seach\swindow\sreads\sits\sname\sand\spercent,\swith\sleft\sonce\sat\sthe\send$']
expect_message = 'left · 7d 66% left'

[[control]]
id = 'quota-narrow-stale-flag'
guards = 'isQuotaStale reports a reading the compact form would mark with its age, so a narrow line without the age can still be dimmed'
file = 'src/quota/format.ts'
old = 'return scopedWindowParts(quota, options).age !== undefined'
new = "return scopedWindowParts(quota, options).age === 'NON-VACUITY BREAK: never stale'"
test_file = 'test/quota/format.test.ts'
runner = 'command'
command = ['sh', '-c', 'git diff --stat; bun test test/quota/format.test.ts -t "$1"', 'sh', '{test}']
list_command = ['bun', 'scripts/list-bun-tests.mjs', 'test/quota/format.test.ts', '{test}']
test_count_pattern = 'Ran {count} test'
expect_red = ['^narrow\squota\swording\sa\sstale\sreading\sadds\sno\sage;\sisQuotaStale\sreports\sit\sso\sthe\sline\scan\sbe\sdimmed$']
expect_message = 'Received: false'