fix(conformance): 18 assertions read as coverage and checked nothing — the count branch short-circuited past text/attr/value - #822
Merged
Conversation
…— the count branch short-circuited past text/attr/value
Ruling 2a (bryan, user-voice S395 "your recs"): limb (c) SEQUENCED — this is limb (a);
the authoring gate (b) is a separate landing.
THE DEFECT. `runAnchored` opened every assertion with
`if (typeof a.count === "number") { …compare count…; continue; }`. The `continue` was
UNCONDITIONAL, so `text`/`attr`/`value` on that same assertion were never evaluated.
PA-measured twice, and independently by the reviewer: 18 inert assertions across 15 case
files. §62.2 makes the conformance corpus THE VERSIONED LANGUAGE CONTRACT, so the
contract was weaker than it read at 18 points and a compiler could have regressed the
rendered output of all 18 with the suite fully green.
⚑ THE BRIEF SAID "remove the continue". THAT WOULD HAVE BEEN WRONG, and the agent
deviated with a stated reason. A naive deletion falls through to `querySelector()` →
`!el` → "no match" for every count-ONLY assertion — and the corpus carries 62 `count: 0`
assertions that assert ABSENCE. All 62 would have gone red. The sets are cleanly
disjoint: every one of the 18 is `count: 1`. So the short-circuit is retained and made
CONDITIONAL on the assertion actually carrying a first-match check.
PA HARDENING on the S239 MEDIUM: `count: 0` now short-circuits regardless. An assertion
`{count: 0, text: "…"}` is self-contradictory, and without that limb it would skip the
short-circuit, hit `querySelector`, get null, and push a spurious "no match" on top of a
count check that PASSED. Corpus-zero today — but limb (b), which would forbid the shape
outright, is deferred, so nothing prevents it being authored. The prior comment
over-claimed that the hazard was handled; it now guards rather than claims.
BITE PROOF, and the pre-fix column is the load-bearing one:
corrupt one text + one attr, fix in -> exactly those two red, real values reported
same corruptions, pre-fix normalize.ts -> 893/893, BOTH VIOLATIONS INVISIBLE
restored -> green
PA re-proved it independently THROUGH THE GATED BRIDGE after the hardening: corrupting a
formerly-inert assertion yields
`selector .eb-notfound: text expected "PA-BITE-WRONG", got "Item missing not found"`.
The 18 were EMPIRICALLY inert, not theoretically.
⚑ A REVIEW FINDING WAS FALSIFIED RATHER THAN FILED. The S239 pass reported MEDIUM that
the corpus "is gated nowhere" — not in pre-commit, pre-push or ci.yml, all of which
target `compiler/tests/…`. PA-checked and it is FALSE:
`compiler/tests/conformance/corpus-bridge.test.js` exists for exactly this reason — it
lives UNDER the gated root and imports `loadCases`/`runCase`/`runCaseRuntime` from the
top-level `conformance/run.ts`, asserting every case over both halves. PA-executed on
this branch: 894 pass / 0 fail. The reviewer probed for the corpus FILE being named in a
gate rather than for the corpus being EVALUATED by one — the wrong-referent class. Filing
it would have put a false HIGH on the board.
WHAT THE ARC ALSO ESTABLISHED, and it sharpens limb (b): of the 18, only TWO were
redundantly covered by their case's whole-tree `dom`. SIXTEEN were entirely unguarded —
including all eight error-boundary fallback-text cases and both
`error-match-failable-ok-arm-rt` arms. The contract exposure was real, not notional.
VERIFICATION. Conformance 894/0, PA-run on the branch and again after the hardening.
Full suite failure-set identical to base BY NAME (the 55 are pre-existing browser /
dev-server / happy-dom). The gap entry's "adjudicate the 18 one at a time" is now doubly
falsified — independently re-measured RED 0, under the REAL fix rather than the
strip-`count` proxy.
Base-drift filtered at landing: the agent's branch predates peter's #821, so a wholesale
pull would have reverted hand-off.md, changelog.md, delta-log.md, known-gaps.md and
deleted a routed inbox message. Verified 0 such paths staged.
provenance: ruling:user-voice-scrml.md S395 — "your recs" adopting limb (c) sequenced
Agent branch: worktree-agent-a97db485ed9deefda @ 50177da1
bryanmaclee
added a commit
that referenced
this pull request
Sep 3, 2026
…at `/` — one gated path now, not two (#823) * fix(§52.13): `scrml dev` served a protected document unauthenticated at `/` — one gated path now, not two Closes g-dev-root-path-fallback-serves-a-protected-document-unauthenticated (HIGH, security). Ruling 2b (bryan, user-voice S395 "your recs"): limb (b). Ruling to SPLIT the §52.13 case variant into its own arc (bryan, "your rec"). THE LEAK. `scrml dev` served an auth="required" document's rendered content to an unauthenticated `GET /` whenever the protected document was not named index.html. PA-reproduced two-sided: entry secure.scrml → `GET /` 200 with SECRET DASHBOARD in the body; entry index.scrml (the control) → 302 both before and after. The leak reproduced on BOTH root-resolution paths — the single-input entry candidate and the sorted-readdir scan. THE FIX IS A DELETION. `registeredProtectedDocs` was read at exactly one place, inside the gated candidate loop; the `pathname === "/"` branch sat AFTER that loop and returned HTML from two paths, neither consulting the gate. dev.js:1027 ALREADY folded `/`→/index.html into the loop's candidates (which is why the index.scrml control gated correctly), so the defect was an ADDITIONAL ungated branch, not a missing fold. Deleted it; `/`'s candidates moved into the one gated loop. Two serving paths → one. Net on compiler/src: +94/-61. ⚑ WHAT WAS MEASURED AND THEN NOT SHIPPED. Literal deletion of the root candidates took `scrml dev app.scrml` from 200 to 404 at `/` — and `/` is the ONLY URL dev prints — while stranding resolveRootEntryCandidate as dead code still covered by its own tests. Per the brief's STOP clause the agent measured, refused, and reported instead of shipping it. ⚑ AND WHAT WAS SPLIT BACK OUT, RULED. Making §52.13's case variant filesystem-independent requires gating on the REQUEST PATH — necessarily a SECOND place that decides protection, because it cannot know what the resolution loop would pick. Three adversarial rounds found three distinct divergences (answering for absent documents; hijacking a request the loop would serve publicly; ignoring candidate resolution priority), each fix converging the pre-gate toward BEING the loop. That reintroduced the exact shape ruling 2b chose limb (b) to remove — FORK RULE row 4, "(b) removes a second code path". bryan ruled SPLIT. The pre-gate is gone, mustExistIn and the {guard, rel} registry value went with it, and the JSDoc at :214 became true again by reversion rather than by editing. ⚑ THE SPLIT CLOSED A DEV/PROD DIVERGENCE RATHER THAN OPENING ONE, which is stronger than the ruling claimed: build.js:541 also gates on relative(SERVE_DIR, candidate).toLowerCase() — the resolved file, not the request path. Dev now matches prod's model exactly. VERIFICATION. - Two-sided leak control, PA-run by executing the new tests against base dev.js: `GET /` leaked=TRUE at base, 302 on the fix. Not asserted — executed. - Structural guard PA-verified to BITE: module-wide (so extracting serving into a helper cannot make it vacuous), expects exactly 2 `return new Response(injectHotReloadScript(` sites with the reason stated for each, and reports "expected 2, received 4" against main. - commands suite 256 pass / 0 fail — the suite that runs in NO blocking job on any platform, which is precisely how a §52.13 assertion sat silently RED on Linux for months. Full suite vs base: one removed, zero added; the removed entry is that assertion. - 9-scenario root-path ordering byte-identical; prod entry re-emitted byte-identical; compiler/src diff vs origin/main is dev.js alone. ⚑ A HAZARD IN THE PA'S OWN INSTRUCTION, CAUGHT BY THE AGENT. I directed `test.failing` on the knowingly-red case-variant test. `.failing` passes when the body fails for ANY reason, so that would have MASKED A LEAK: if `/SECURE.html` ever returned the markup, `expect(leaked).toBe(false)` fails and `.failing` swallows it as expected. Split instead into a HARD test asserting the platform-invariant half (never leaks, whatever status) and a `.failing` test carrying only the genuinely-unruled STATUS. The durable form, recorded: a mechanism that makes a red acceptable also makes a red invisible — every time you suppress a signal, check what else was riding on it. FILED, NOT FIXED — a new HIGH, PA-verified byte-identical on origin/main so pre-existing: loadServerRoutes catches an import() failure with console.error + continue, so a .server.js that fails at module-init never registers its guard and the auth="required" document is then served IN FULL, unauthenticated (agent-reproduced twice: an appended throw, and a duplicate-declaration syntax error). This falsifies "fail-open is gone by construction"; the invariant is narrowed to "every path that RESOLVES a serve-dir document passes the gate". Fix direction recorded: fail CLOSED on a module-load error — "unknown" must not resolve to "public". Base-drift filtered: the agent's branch predates #820/#822, so a wholesale pull would have reverted docs/changes/s395-runanchored-continue/, known-gaps.md, delta-log.md and dpa-queue.md. Verified 0 such paths staged. provenance: ruling:user-voice-scrml.md S395 — "your recs" (limb b) + "your rec" (the split) Agent branch: worktree-agent-a21f5afd26f7c6d3c @ 7c1fbf86 * chore(facts): regen after the dev-root auth-gate landing
bryanmaclee
added a commit
that referenced
this pull request
Sep 3, 2026
…reen while wrong (#824) Ran concurrently with S396-peter throughout. Five rulings given, four code arcs landed, the review floor drained twice to zero, maps refreshed. ONE ARC HELD on a ruling, worktree retained. ⚑ THE SESSION'S REAL OUTPUT IS NOT THE LANDINGS. Nine separate checks read green or authoritative while being wrong, and every one was caught by RUNNING something rather than by remembering. Three were my own claims. TWO WERE CAUGHT BY GATES I DID NOT WRITE. Three were agents' own instruments, found by those agents. RULINGS · the trailing-`else` question — direction stands, and the reported "inverted ruling" was MY OWN mis-description: §17.6.4 has always said a missing `else` is valid. I relayed a hand-off's framing into the boot report without opening the section. · the `~` arm-body question — limb (a) ratified, limb (c) BANKED as dpa-040, not closed. · 2a / 2b / 2c — the runAnchored fix (sequenced), the dev-root auth gate (limb b), and the tracking-job sequence with its first step folded in. · SPLIT the dev-auth arc when its §52.13 half turned out to require a second decider. LANDED #815 the §17.6.2 value-form sugar binds its result at a binding site — it bound null forever. #818 a branch-declared function is ROUTED before it is COLLECTED; closing the client half alone put a `server fn` BODY into client.js. #822 18 conformance assertions read as coverage and checked nothing. ⚑ MY BRIEF WAS WRONG — a naive `continue` deletion would have reddened 62 count:0 ABSENCE assertions — and the agent deviated with a stated reason. Only 2 of the 18 were covered elsewhere; 16 were entirely unguarded. #823 `scrml dev` served a protected document unauthenticated at `/`. The fix is a DELETION: two serving paths become one. #816 #819 #820 continuity + filings; #817 the overdue wrap-6c maps refresh, which corrected three premises in my own concurrently-dispatched brief. ⚑ HELD, NOT LANDED — the `~` build, worktree RETAINED at agent-ac264a1015c0da19d @ c2ad6f49. Four fix rounds, four adversarial passes, 7 SPEC loci reconciled. Blocked on bryan's revert-vs-press-on for the READ half, whose widening PA-verifiably DELETES A DOM LIFT (base emits _scrml_lift/createTextNode, the branch pushes into a dead array, exit 0). Resume the agent; do not re-dispatch. FINDINGS WORTH CARRYING · SUPPRESSING A SIGNAL SUPPRESSES WHATEVER RODE ON IT — three instances, one of them my own instruction. The `tracking` job's routine red concealed a REAL §52.13 assertion failing on Linux (compiler/tests/commands/ runs in NO blocking job on any platform). A knowingly-red assertion placed FIRST in a test turned the four after it into dead code that still read as coverage. And I instructed `test.failing` on that test — which passes when the body fails for ANY reason, so it would have MASKED A LEAK. The agent's formulation is the keeper: a mechanism that makes a red acceptable also makes a red invisible. · A FIX THAT NEEDS A SECOND DECIDER IS THE FORK RULE SAYING NO. Three rounds found three distinct divergences between the dev pre-gate and the resolution loop; the split then CLOSED a dev/prod divergence rather than opening one. · A REVIEW FINDING WAS FALSIFIED RATHER THAN FILED — the first time this session verification prevented a FABRICATED finding instead of catching a missed one. The corpus IS gated; corpus-bridge.test.js reaches it from inside the gated root. · TWO SHARED-DOC CONCURRENCY HAZARDS, both caught by machinery: conflicting @generated gap counts (resolved by regenerating from the merged population — the union, not a pick), and duplicate delta-log sequence numbers with peter (caught by the cloud gate's step 14; a duplicate makes the flogence bridge DROP the second entry from the digest). · BASE-DRIFT nearly reverted landed work FOUR times. · EVERY ONE of the five agent deviations from my instructions this session was correct. WRAP STEPS: hand-off rewritten (S396-peter's rotated to handOffs/hand-off-282.md, his live items carried) · changelog block · delta-log [2040]-[2045], sequence gate PASS · review floor 6 OWED -> 0 · inbox: TWO items deliberately left unarchived because both await bryan (the E-ROUTE-004 fork and the ~11-day-old FSP Initialize deliberation), both summarised in the hand-off · suite 30945 pass / 54 fail — ONE FEWER than base, the §52.13 assertion · worktrees: four landed swept, one retained · maps refreshed to 2d8dd8c, watermark verified via state.ts not by reading the file · @generated + facts gates PASS.
bryanmaclee
added a commit
that referenced
this pull request
Sep 3, 2026
… them mine (#826) The wrap-6c refresh completed after #824/#825 landed partial writes. This is the settled output, plus the `master-list.md` @generated:recent-sessions regen the wrap commit staled (state.ts --check was FAILING on it; now PASS). ⚑ FOUR PREMISES FAILED ON MEASUREMENT, AND THE FIRST WAS IN MY OWN BRIEF. 1. I briefed "compiler/tests/commands/ runs in NO blocking job on any platform." WRONG on the pre-push clause: `.git/hooks/pre-push:96` DOES name it, in a suite its own comment calls blocking. The CONCLUSION survives by a different mechanism — `RUN_SUITE` is 1 only on a release-tag push or a ref-diff failure, so a normal code push skips it entirely, and the source-controlled hook (`scripts/git-hooks/pre-push:87`) never names it at all. The map states the MECHANISM now, not my slogan. I had repeated the slogan in three PR bodies and a hand-off; it was right about the outcome and wrong about why. 2. `test.map.md` carried FOUR count cells wrong at their own watermark — Unit 909→925, Integration 213→216, Browser 98→102, Commands 14→17 — identical at `ad7b65dc`, with zero test files added in the window. The prior pass applied DELTAS to a base it never re-measured, so a correct total sat on four wrong components. Its Integration gate column was also wrong: integration blocks a COMMIT, not a merge. 3. `auth.map.md`'s anchor was DELETED, not moved — `:1046-1048` exists in no form. A line-drift repair would have produced a confidently wrong map. 4. The `gate` "14 steps" figure was ambiguous (12 `- name:` + 2 `- uses:`); stated both ways. ⚑ ALL THREE FACTUAL ERRORS FOUND THIS PASS WERE IN THE MAP SET, NOT IN THE DOCS IT AUDITS. MAPPED: #818 — invariant 82's `collect.ts` prohibition RETIRED (that arc closed both halves together), and the ORDER it protected promoted to invariant 86, including the third `collectWorkerBodyFunctionIds` walk whose omission would have false-fired E-ROUTE-004's sibling. #822 (domain §62.2) and #823 (domain §52.13, auth row 3, dev.js structure entry). The two routing facts I asked for are invariants 87 and 88. STAMP: `8e278c73`, deliberately NOT the branch tip. Reaching a literal `maps: current` would require stamping an unpushed branch SHA — the S326/S328/S331 orphaned-stamp hazard, since branch tips squash-merge under a different SHA. The mapper stamped the furthest commit satisfying all three MAP-STAMP checks (== origin/main, == merge-base, source diff EMPTY, is-ancestor exit 0). Headers now state the two-SHA split explicitly: source delta walked is `ad7b65dc..2d8dd8c`; watermark is `8e278c73`. NON-COMPLIANCE, standing items re-verified and both STILL LIVE — with a wording correction worth more than the finding: N12's "never in ANY map" is no longer true (`structure.map.md:196` names `docs/audits/`), so the accurate claim is "NAMED, never SCANNED". Its "two self-declare superseded" figure holds, but a `grep -li superseded` returns 9 and over-counts 4.5×. N14 confirmed again: `collapseIfChains` is at `:18871`, `:18885` is `let i = 0;`, and the same entry's OTHER citation is correct — which is what makes the wrong one read as trustworthy. NEW, needs a human: `docs/articles/` sits outside EVERY compile gate. `snippet-gate.js`'s SNIPPET_CORPUS covers only tutorial/readme/website and gates `.scrml` FILES, not fenced blocks — so the 6 `scrml` blocks in the enum article at publish state have nothing telling anyone if they stop compiling.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ruling 2a (bryan, user-voice S395 "your recs"): limb (c) sequenced — this is limb (a); the authoring gate (b) is a separate landing.
The defect
runAnchoredopened every assertion withif (typeof a.count === "number") { …; continue; }. Thatcontinuewas unconditional, sotext/attr/valueon the same assertion were never evaluated. 18 inert assertions across 15 case files — measured by me twice and independently by the reviewer.§62.2 makes the conformance corpus the versioned language contract, so the contract was weaker than it read at 18 points, and a compiler could have regressed the rendered output of all 18 with the suite fully green.
⛑ My brief said "remove the
continue". That would have been wrong.The agent deviated with a stated reason, and it was right. A naive deletion falls through to
querySelector()→!el→"no match"for every count-only assertion — and the corpus carries 62count: 0assertions that assert ABSENCE. All 62 would have gone red. The sets are cleanly disjoint (all 18 arecount: 1), so the short-circuit is retained and made conditional.PA hardening on the S239 MEDIUM:
count: 0now short-circuits regardless.{count: 0, text: "…"}is self-contradictory, and without that limb it would skip the short-circuit and push a spurious"no match"on top of a count check that passed. Corpus-zero today — but limb (b), which would forbid the shape, is deferred.Bite proof — the pre-fix column is the load-bearing one
text+ oneattr, fix innormalize.tsI re-proved it independently through the gated bridge after the hardening:
selector .eb-notfound: text expected "PA-BITE-WRONG", got "Item missing not found". The 18 were empirically inert, not theoretically.⛑ A review finding was falsified rather than filed
The S239 pass reported MEDIUM that the corpus "is gated nowhere" — not in pre-commit, pre-push or
ci.yml, all of which targetcompiler/tests/…. PA-checked, and it is false.compiler/tests/conformance/corpus-bridge.test.jsexists for exactly this purpose: it lives under the gated root and importsloadCases/runCase/runCaseRuntimefrom the top-levelconformance/run.ts, asserting every case over both halves. PA-executed on this branch: 894 pass / 0 fail.The reviewer probed for the corpus file being named in a gate rather than for the corpus being evaluated by one — the wrong-referent class. Filing it would have put a false HIGH on the board.
What the arc also established
Of the 18, only two were redundantly covered by their case's whole-tree
dom. Sixteen were entirely unguarded — including all eighterror-boundaryfallback-text cases and botherror-match-failable-ok-arm-rtarms. The contract exposure was real, not notional. This sharpens the priority argument for limb (b) without changing its scope.Verification
Conformance 894/0, PA-run on the branch and again after the hardening. Full-suite failure set identical to base by name. The gap entry's "adjudicate the 18 one at a time" is now doubly falsified — independently re-measured RED 0, under the real fix rather than the strip-
countproxy.Base-drift filtered: the agent's branch predates peter's #821, so a wholesale pull would have reverted
hand-off.md,changelog.md,delta-log.md,known-gaps.mdand deleted a routed inbox message. Verified 0 such paths staged.provenance: ruling:user-voice-scrml.md S395🤖 Generated with Claude Code
https://claude.ai/code/session_019eHiNS6uvnGPFz55fzinNJ