fix(trace): REQ-PTT-04 was born scope-bound; bind its CLI half (#1405) - #1415
Merged
Merged
Conversation
One `// VERIFIES: REQ-PTT-04` in openpulse-cli. Reachability 281/363 (0.77) -> 363/363 (1.00). I INTRODUCED THE DEFECT I HAD JUST BEEN FIXING. REQ-PTT-04 shipped yesterday (#1412) with three bindings — ardop, kiss, daemon — none of whose test binaries can link openpulse-cli. So cli/radio.rs and cli/commands/calibrate.rs, 82 of its 363 mutants, were unreachable by construction: a fresh instance of #1405, created in the same week #1405 was filed. Re-measuring the enforced set after the merge is what surfaced it, not review. The binding target was checked for vacuity first: the_cli_never_keys_the_rig_by_ hand is a source scan over include_str!'d CLI sources, and its sibling the_scan_actually_covers_the_files_that_key validates that scan against a PLANTED bare `.assert_ptt(` call, so it cannot go vacuous. It is also the acceptance method REQ-PTT-04's own registered text names. A LIMIT OF THE METRIC, demonstrated by this very change: the ratio reached 1.00 while the kill-power of those 82 mutants did not meaningfully change. A source scan makes mutants LINKABLE, not KILLABLE — a mutation of calibrate.rs's logic does not introduce a bare `.assert_ptt(`. Reachability is necessary for a mutation verdict to mean anything and not sufficient for it to be strong; #1405's check reports the necessary condition only and should say so. Implements: REQ-PTT-04 Review: none — applying #1405's own triage pattern to a requirement added two commits ago; the binding target was read and its planted-violation control confirmed before binding. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0188ATCj6DZ9aRVQ2vSirua6
dc0sk
added a commit
that referenced
this pull request
Sep 19, 2026
…1405) (#1420) `req-mutation.sh` mutates every file in a requirement's scope and runs its bound tests under cargo-mutants `--test-package`. A test binary cannot link code outside its own package closure, so a mutant in an unlinkable package is unkillable BY CONSTRUCTION and can only be recorded MISSED. The script's verdict is `killed > 0`, so REQ-FUN-11 passed on the strength of one linkable file while 401 of its 408 mutants could never die — a PASS that was partly about the ownership map. A GRANDFATHERED RATCHET, which is the repo's existing third mode (reachability.sh, NOT-GRANDFATHERED), because the issue's fail-or-warn pair are both wrong here: failing is red-on-arrival (#1074) with three requirements blocked on #1234, and warning repeats DANGLING-CODE, which correctly detects CAP-70's dead path and has never failed a build. NEW unlinkable code fails; the 15 baselined pairs warn; `baseline - current` also FAILS, because #1371 found 74 of 86 orphan-baseline entries stale in one pass under a header that merely asked for pruning. Semantics VERIFIED against cargo-mutants 27.1.0 rather than inferred: `lab.rs` passes only the `--test-package` list (the mutated package is not added) and `cargo.rs` runs `cargo test --package=<p> --no-default-features`, so linkable is P + P's normal/dev/build deps, then normal/build transitively. Deliberately NOT `_workspace_graph()`, which filters dev and optional edges because its question is production reach; a test target does link its own package's dev-deps. Excluding optional edges was right for the wrong reason — the rule is really feature resolution rooted at P under `--no-default-features` — so it is now a CHECKED precondition, not a constant: a graph-self-test probe fails when any internal dep spec activates an optional internal edge. Also: a file that is a `bin` root is linkable only from its own package (a dependent's tests never build a dependency's bin); `unwired` is in scope so REQ-CTL-04's three files do not all fail the day #1234 lands; findings carry best-effort `cargo mutants --list` counts, never a silent 0 (#1279), because the spread is 46x (186 mutants in linksec/async_channel.rs against 4 in modem/envelope_codec.rs). Named UNLINKABLE, not UNREACHABLE: reachability.sh already uses "reachable" for production reach, and a second sense invites exactly the over-read this avoids. Linkability is NECESSARY, NOT SUFFICIENT (#1415) — stated in the finding text, the baseline header and the code. It cannot see a vacuous binding in the right package, nor cfg-gated code inside a linkable file. Sabotage-verified in both directions, each failing its own case, with the unmodified-tree positive control still passing: scope file no bound test's package can link -> UNLINKABLE-FROM-BINDING baseline entry that is no longer unlinkable -> STALE-LINK-BASELINE Verification-objective: a requirement's mutation verdict must not be silently bounded by its own scope; scope code no bound test can link is reported and ratcheted Claude-Session: https://claude.ai/code/session_0188ATCj6DZ9aRVQ2vSirua6 Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One
// VERIFIES: REQ-PTT-04inopenpulse-cli. Reachability 281/363 (0.77) → 363/363 (1.00).I introduced the defect I had just been fixing
REQ-PTT-04 shipped yesterday (#1412) with three bindings — ardop, kiss, daemon — none of whose test binaries can link
openpulse-cli. Socli/radio.rsandcli/commands/calibrate.rs, 82 of its 363 mutants, were unreachable by construction: a fresh instance of #1405, created in the same week #1405 was filed.Re-measuring the enforced set after the merge is what surfaced it — not review, and not the gate.
The binding target was checked for vacuity first
Per the rule that caught
tampered_fragment_fails_verificationin #1406:the_cli_never_keys_the_rig_by_handis a source scan overinclude_str!'d CLI sources, rejecting bare.assert_ptt(calls.the_scan_actually_covers_the_files_that_keyvalidates that scan against a planted bare call, so it cannot go vacuous.A limit of the reachability metric, demonstrated by this change
The ratio reached 1.00 and the kill-power of those 82 mutants did not meaningfully change. A source scan makes mutants linkable, not killable — a mutation of
calibrate.rs's logic does not introduce a bare.assert_ptt(, so the scan will not catch it.Reachability is necessary for a mutation verdict to mean anything, and not sufficient for it to be strong. If #1405's check is ever built, it reports the necessary condition only and should say so in its own output. Recorded in the ledger so the number is not read as more than it is.
Verification
trace check ok · ledger order ok · doc stamps ok · review lint ok · fmt ok ·
openpulse-cli --test ptt_goes_through_shared_ptt2 passed / 0 failed.Implements: REQ-PTT-04
Review: none — applying #1405's own triage pattern to a requirement added two commits ago; the binding target was read and its planted-violation control confirmed before binding.
🤖 Generated with Claude Code
https://claude.ai/code/session_0188ATCj6DZ9aRVQ2vSirua6