From 0debd8196fb22696d8871c3c95907bc1e325b17a Mon Sep 17 00:00:00 2001 From: Amplifier <240397093+microsoft-amplifier@users.noreply.github.com> Date: Sun, 6 Sep 2026 07:29:33 -0700 Subject: [PATCH 1/3] Core 10 residual: delete dead `_oldest_ready_item`; Tier-A runs undeferred The last deferral in either conformance kit is gone, and it is gone by deleting the thing it named rather than by widening a check. WHAT WAS TRUE: `webapp._oldest_ready_item` (webapp.py:902-917, 16 lines) called `bd.list(lane=A.LANE_WORK, status="open")` with no limit at all and had ZERO callers -- one occurrence of the name in `src/`, its own definition. OSV1-015 read CONFORMS anyway, because Core 10 scores calls "reached from a view" and dead code is reached by nothing; the Tier-A kit's census is source-wide with no reachability analysis, so it went on reporting the call and its good half was `xfail(strict=True)` naming the row. MEASURED, before -> after: make test-conformance-a 41 passed / 1 xfailed -> 42 passed / 0 xfailed 0 XPASS, 0 failed pytest ledger/checks -q 60 passed -> 60 passed make ledger-mutate 69/69 proven -> 69/69, none unproven ruff check / format clean -> clean (191 files) pyright src tests 0 errors -> 0 errors make test -- -> 1558 passed / 3 skipped + 127 passed, exit 0 (no documented flake hit) WHAT MOVED WITH IT: * the `xfail(strict=True)` marker on `test_antigoals_enforced`, and the Tier-A module docstring's deferral table row. The docstring keeps the mechanism and records that the kit now carries no deferral. * `tests/unit/test_view_query_bounds.py`: `_UNREACHED_EXEMPTIONS` and `test_the_exempted_uncapped_helpers_are_still_reached_by_nothing`, which existed only to re-earn that one exemption. Deleted rather than left iterating an empty set -- a guard over nothing passes forever while proving nothing. * `test_row_osv1_015`'s two exemption assertions, replaced by something stronger and name-free: `all_listing_calls()`, a source-wide census of webapp.py/webbrowse.py/webtrust.py requiring an explicit finite limit on EVERY listing call, reached or not. Measured population, 4 of 4 explicit: webapp.py:3848, webapp.py:4743, webbrowse.py:412, webbrowse.py:719. The reachability audit is unchanged and still runs first. * OSV1-006's three webapp.py register pins, -16 (1127/1823/1826 -> 1111/1807/1810). A line-number re-pin, not a re-derivation: re-measured from the census, same eight sites, same three expressions, no growth. Second such re-pin; the register's own comment records the first (+182). TIER-B DOCSTRINGS, docstrings only, no assertion touched (so `make test-conformance-b` is not required and was not run): Conformance 1 Bad, Conformance 3 Bad, and Conformance 4 Good+Bad re-quoted from the current FROZEN contract text. All four had pre-RC-2 wording; RC-2 (2026-09-05) had reworded them onto the measured defects these very fixtures reported -- hue outside the token set, disclosure + live-region node identity, element-level overflow past `clientWidth`. Every refreshed quote verified verbatim against `contracts/operator-surface.v1.md`. LEDGER: OSV1-015 stays CONFORMS (disposition did not move and never was in question); its "THE OTHER UNCAPPED CALL" residual paragraph is replaced by a dated 2026-09-06 note recording the deletion, what it bought, and the knock-on re-pin. `ledger/reconcile-report.md` gains a "## 2026-09-06 zhv" section and one Changelog bullet. No `contracts/` byte was touched. RESIDUAL, out of this lane's scope and named rather than fixed: OSV1-030's notes still call Tier-A's `test_antigoals_enforced` "the one remaining deferral in either kit" -- true when written, false as of this commit. --- ledger/checks/test_operator_rows.py | 86 ++++++++++--- ledger/reconcile-report.md | 26 ++++ ledger/rows.yaml | 46 +++++-- src/amplifier_work_tracker/webapp.py | 16 --- .../operator_surface/browser/test_tier_b.py | 115 +++++++++++------- .../operator_surface/test_tier_a.py | 49 ++++---- tests/unit/test_view_query_bounds.py | 30 ++--- 7 files changed, 233 insertions(+), 135 deletions(-) diff --git a/ledger/checks/test_operator_rows.py b/ledger/checks/test_operator_rows.py index a3dee7f..7b4e3e3 100644 --- a/ledger/checks/test_operator_rows.py +++ b/ledger/checks/test_operator_rows.py @@ -557,9 +557,17 @@ def test_row_osv1_005() -> None: #: that as the failure to avoid, because two censuses disagree silently. EXEMPTION_REGISTER: frozenset[str] = frozenset( { - "webapp.py:1127", # flex:{n} 1 0 -- state-bar segment ratio - "webapp.py:1823", # width:{today_w}px -- throughput bar, today - "webapp.py:1826", # width:{prior_w}px -- throughput bar, prior 6d + "webapp.py:1111", # flex:{n} 1 0 -- state-bar segment ratio + "webapp.py:1807", # width:{today_w}px -- throughput bar, today + "webapp.py:1810", # width:{prior_w}px -- throughput bar, prior 6d + # -16 lines on 2026-09-06 (was 1127/1823/1826), the SECOND re-pin of the + # same three sites and for the same reason as the +182 note below: an + # edit higher in webapp.py moves a line-number pin. work_item_pipeline-zhv + # deleted the 16-line dead `_oldest_ready_item` (webapp.py:902-917), which + # sits above all three. RE-MEASURED, not transcribed: the census observed + # exactly {webapp.py:1111, 1807, 1810} and 16 is exactly the deletion, so + # all three are accounted for and none is a NEW site. Same eight sites, + # same three expressions -- the register did not grow. # +182 lines on 2026-09-05 at the wave-4 union (was 4197/4216/4223 on # main @065da04), and RE-MEASURED here rather than transcribed from any # lane: three lanes each inserted CSS ABOVE these three sites in the same @@ -1183,11 +1191,15 @@ def test_row_osv1_014() -> None: } ) -#: A helper that makes an unbounded listing call but is reached by NO route. -#: Dead code is not "reached from a view", so the clause as written does not -#: condemn it -- but the exemption is re-earned every run below, by proving it -#: is still dead. -_UNREACHED_UNCAPPED = ("_oldest_ready_item", WEBAPP) +#: THE UNREACHED-UNCAPPED EXEMPTION IS GONE as of 2026-09-06. It named one +#: helper -- `webapp._oldest_ready_item`, an unbounded listing call reached by +#: no route -- and this probe re-earned it every run by proving the function +#: was still dead. work_item_pipeline-zhv deleted the function, so there is +#: nothing left to exempt and nothing left to re-earn. What replaced those two +#: assertions is STRONGER and carries no name: the census below now runs over +#: EVERY listing call in the route modules, reached or not, and requires an +#: explicit limit on all of them -- so a future dead-code exemption has to be +#: argued for rather than inherited. def _module_int_constants(path) -> dict[str, int]: # type: ignore[no-untyped-def] @@ -1299,6 +1311,30 @@ def view_listing_calls() -> list[tuple[str, int, str, object]]: return found +def all_listing_calls() -> list[tuple[str, int, object]]: + """`(module, line, limit)` for EVERY listing call in the route modules -- + reached from a view or not. + + The census `view_listing_calls` cannot be: it scores what a GET handler + reaches, which is what Core 10's own wording asks, and that is precisely + why a limit-less call in dead code slipped past it for two waves. This + reading has no reachability step to argue with, so it also has no + exemption to re-earn. + """ + found: list[tuple[str, int, object]] = [] + for path in ROUTE_MODULES: + tree = ast.parse(read(path)) + consts = _module_int_constants(path) + for node in ast.walk(tree): + if ( + isinstance(node, ast.Call) + and isinstance(node.func, ast.Attribute) + and node.func.attr in _BOUNDED_READS + ): + found.append((path.name, node.lineno, _limit_passed(node, consts))) + return found + + def test_row_osv1_015() -> None: """Core 10 CONFORMS: every adapter listing call a read-only route reaches passes an explicit, finite limit -- MEASURED here, not asserted from a @@ -1312,6 +1348,13 @@ def test_row_osv1_015() -> None: `limit=0` is bd's own "unlimited" (`adapter.Beads.list`'s docstring says so outright) and an omitted `limit` leaves bd's default in place implicitly -- the clause asks for an EXPLICIT bound, so both are failures. + + RETARGETED AGAIN 2026-09-06 (work_item_pipeline-zhv). The two assertions + that re-earned the `_oldest_ready_item` exemption every run are gone with + the function they guarded, replaced by `all_listing_calls()`: a source-wide + census of the route modules that requires an explicit limit on EVERY + listing call, reached or not. Strictly stronger than what it replaced, and + it names no function -- an exemption cannot be inherited from it. """ calls = view_listing_calls() assert any(m == "webbrowse.py" and h == "project_view" for m, _, h, _ in calls), ( @@ -1328,16 +1371,23 @@ def test_row_osv1_015() -> None: + "\n This surface re-renders every 20 seconds; an unbounded read here runs " "three times a minute per open tab." ) - name, module = _UNREACHED_UNCAPPED - app = read(module) - assert app.count(name) == 1, ( - f"OSV1-015 (Core 10): `{name}` now has {app.count(name) - 1} caller(s). It " - f"calls `bd.list(...)` with NO limit at all -- being reached by nothing was " - f"the only reason it did not violate this clause. Give it a bound or delete it." - ) - assert contains(WEBAPP, 'items = bd.list(lane=A.LANE_WORK, status="open")'), ( - "OSV1-015 (Core 10): the uncapped `bd.list` in `_oldest_ready_item` is gone -- " - "welcome, and the row's exemption just changed. Re-derive." + everything = all_listing_calls() + assert everything, ( + f"OSV1-015 (Core 10): the source-wide census now matches NO listing call at " + f"all in {[p.name for p in ROUTE_MODULES]} -- a census that finds nothing " + f"passes forever while proving nothing. Re-derive this row." + ) + unbounded = [c for c in everything if c[2] is None or (isinstance(c[2], int) and c[2] <= 0)] + assert not unbounded, ( + "OSV1-015 (Core 10): a listing call in a route module passes no explicit, " + "finite limit:\n " + + "\n ".join(f"{m}:{ln} -> limit={lim!r}" for m, ln, lim in unbounded) + + "\n\nThis is the STRONGER reading, adopted 2026-09-06 when " + "work_item_pipeline-zhv deleted `_oldest_ready_item`. Reachability is what " + "Core 10's own wording scores, and it is asserted above; this second pass " + "asserts there is no limit-less call left for a reachability argument to " + "excuse. If a new one is genuinely unreachable, do not re-open an exemption " + "here -- bound it or delete it." ) diff --git a/ledger/reconcile-report.md b/ledger/reconcile-report.md index d715d8a..8a66ad2 100644 --- a/ledger/reconcile-report.md +++ b/ledger/reconcile-report.md @@ -2245,7 +2245,33 @@ no `docs/VISION.md` byte and no `contracts/custody-coordination.v1.md` byte was touched; `LAST_RUN.json` was neither regenerated nor edited; the live service was never contacted. No item was filed and none closed. +## 2026-09-06 zhv + +- **Core 10's last residual is closed by deletion, not by argument.** + `work_item_pipeline-zhv` deleted the dead `webapp._oldest_ready_item` + (webapp.py:902–917, 16 lines, zero callers, an uncapped `bd.list`), so + `OSV1-015` no longer holds CONFORMS partly by a reachability argument; + `make test-conformance-a` went **41 passed / 1 xfailed → 42 passed / 0 + xfailed / 0 XPASS / 0 failed**, the Tier-A good half `test_antigoals_enforced` + now runs undeferred, and **neither conformance kit carries a deferral**. + Disposition unchanged (CONFORMS). `test_row_osv1_015`'s two exemption + assertions are replaced by a stronger, name-free source-wide census + (`all_listing_calls()`: every listing call in the three route modules carries + an explicit finite limit — 4 of 4 measured); `OSV1-006`'s three webapp.py + register pins re-measured −16 (1127/1823/1826 → 1111/1807/1810), same eight + sites, register did not grow. Tier-B kit docstrings for Conformance 1 Bad, + 3 Bad and 4 Good+Bad re-quoted to the post-RC-2 contract text (docstrings + only; no assertion changed). Residual, not fixed here and out of this lane's + scope: `OSV1-030`'s notes still say Tier-A's `test_antigoals_enforced` is + "the one remaining deferral in either kit" — true when written, false as of + this line. + ## Changelog +- **2026-09-06 — Core 10 residual closed (`work_item_pipeline-zhv`).** Dead + `webapp._oldest_ready_item` deleted; `OSV1-015` stays CONFORMS with its + exemption paragraph replaced by a dated note and its probe retargeted onto a + source-wide limit census; Tier-A runs 42 passed / 0 xfailed / 0 XPASS. See + §"2026-09-06 zhv". - **2026-09-06 — AMENDMENT, `contracts/operator-surface.v1.md` v2 applied to the LOCKED text, mandatory full re-review.** Owner's word, literal: *"Ratified"* — the sibling proposal `operator-surface.v2-candidate.md` was diff --git a/ledger/rows.yaml b/ledger/rows.yaml index 48a1b15..633ede8 100644 --- a/ledger/rows.yaml +++ b/ledger/rows.yaml @@ -2653,14 +2653,44 @@ covers the truncation note; both were confirmed to go red against `limit=0` and against a removed `limit=` before this row was flipped. - THE OTHER UNCAPPED CALL, AND WHY IT IS STILL NOT SCORED: webapp.py:909, - inside `_oldest_ready_item`, calls `bd.list(lane=A.LANE_WORK, - status="open")` with no `limit` at all -- but the function has ZERO - callers (the only occurrence of the name in `src/` is its own definition). - Dead code is not "reached from a view", so the check as written does not - condemn it. Unchanged from seed, and the probe still re-earns that - exemption every run by proving the function is still uncalled -- the - instant it gains a caller, this row goes red. + THE OTHER UNCAPPED CALL IS GONE -- 2026-09-06, work_item_pipeline-zhv. + From seed until this date this row carried a named residual: webapp.py:909, + inside `_oldest_ready_item`, called `bd.list(lane=A.LANE_WORK, + status="open")` with no `limit` at all. It was never scored, because the + function had ZERO callers and dead code is not "reached from a view", and + the probe re-earned that exemption every run by proving it was still + uncalled. The dead function was deleted instead (webapp.py:902-917, 16 + lines; grep confirmed one occurrence in `src/`, its own definition, before + the deletion and none after). Disposition does not move: it was CONFORMS + before and is CONFORMS now -- what changed is that the clause no longer + holds by a reachability ARGUMENT anywhere in these three modules. + + WHAT THE DELETION BOUGHT, measured on this tree: + * `make test-conformance-a` 42 passed, 0 xfailed, 0 XPASS, 0 failed (was + 41 passed / 1 xfailed). The Tier-A good half `test_antigoals_enforced` + was the LAST deferral in either kit; its `xfail(strict=True)` named + this residual by name and is deleted, in this same change, exactly as + the marker's own reason instructed. + * This probe's two exemption assertions went with the function they + guarded and are replaced by something STRONGER and name-free: + `all_listing_calls()`, a source-wide census of webapp.py/webbrowse.py/ + webtrust.py requiring an explicit finite limit on EVERY listing call, + reached or not. Measured population: webapp.py:3848 + (`attention_items_from_rows`), webapp.py:4743 (`recent_activity_feed`), + webbrowse.py:412 (`bd.list`), webbrowse.py:719 (`bd.activity`) -- all + four explicit, zero unbounded. The reachability audit is unchanged and + still runs first; this is the second pass that leaves no limit-less + call for a reachability argument to excuse. + * Product-side, `tests/unit/test_view_query_bounds.py` lost its + `_UNREACHED_EXEMPTIONS` register and the test that re-earned it, rather + than keeping a guard that iterates an empty set -- which would pass + forever while proving nothing. + + KNOCK-ON, recorded because it is a line-number pin and not a re-derivation: + deleting 16 lines above them moved OSV1-006's three webapp.py register + entries by -16 (1127/1823/1826 -> 1111/1807/1810). Re-measured from the + census, not transcribed; same eight sites, same three expressions, the + register did not grow. - id: OSV1-016 title: the theme choice is persisted in localStorage and applied at first paint diff --git a/src/amplifier_work_tracker/webapp.py b/src/amplifier_work_tracker/webapp.py index 665aadf..078aada 100644 --- a/src/amplifier_work_tracker/webapp.py +++ b/src/amplifier_work_tracker/webapp.py @@ -899,22 +899,6 @@ def _global_oldest(summaries: list[A.ProjectSummary]) -> tuple[str, float] | Non return max(candidates, key=lambda c: c[1]) -def _oldest_ready_item(bd: A.Beads) -> A.Item | None: - """The single oldest ready (open, tagged `LANE_WORK`) item in one - project -- used only for the hero's attribution line (which real item - is the N-day-old one). One extra, project-scoped `bd list` call; never - a workspace-wide fan-out. Returns `None` (never a guess) if the project - can't be read or has no dated ready item.""" - try: - items = bd.list(lane=A.LANE_WORK, status="open") - except A.BeadsError: - return None - dated = [i for i in items if i.created_at is not None] - if not dated: - return None - return min(dated, key=lambda i: i.created_at) # type: ignore[arg-type,return-value] - - def _ledger_hero_html(ready_total: int | None, n_projects: int, burn_days: float | None) -> str: """The overview's restrained ready-count hero -- READY TO CLAIM, at `--fig-size-ledger` (62px), a deliberate 3.8x demotion from the diff --git a/tests/conformance/operator_surface/browser/test_tier_b.py b/tests/conformance/operator_surface/browser/test_tier_b.py index 0f4a7fd..d641142 100644 --- a/tests/conformance/operator_surface/browser/test_tier_b.py +++ b/tests/conformance/operator_surface/browser/test_tier_b.py @@ -243,14 +243,18 @@ def test_calm_sweep_catches_the_reinstated_retired_palette( """BAD half B of Conformance 1 -- the contract's own named defect. **Bad:** the same page with the retired-palette region reinstated -- a - hardcoded amber outside the token set -- is reported as alarm-coloured - pixels on a calm page. - - Recorded honestly: `#D9A253` is a DIFFERENT hue from `--alarm` (#f59e0b), - far enough away that the token sweep does not classify it as `--alarm` at - all. So the sweep carries a third bucket for it, and this test asserts on - THAT bucket -- rather than pretending a tolerance wide enough to swallow - the retired amber would still be a `--alarm` measurement. + hardcoded amber outside the token set -- is reported as pixels of a hue + outside the token set on a calm page: `#D9A253` is far enough from + `--alarm` that the sweep counts it in its own bucket rather than as + alarm colour. + + Quote refreshed 2026-09-06 to the contract's post-RC-2 wording. The + measured fact behind it is unchanged and was this fixture's own finding: + `#D9A253` is a DIFFERENT hue from `--alarm` (#f59e0b), far enough away that + the token sweep does not classify it as `--alarm` at all, so the sweep + carries a third bucket for it and this test asserts on THAT bucket. RC-2 + moved that reading INTO the clause rather than leaving the kit to + reinterpret it -- the assertion below is untouched. """ page = context_factory(calm_app).new_page() goto(page, calm_app, calm_app.url("L0"), theme=theme) @@ -754,19 +758,24 @@ def test_naive_replacement_loses_the_open_disclosure( """BAD half of Conformance 3, as the contract literally words it, RUN. **Bad:** a whole-body innerHTML replacement that recreates the region - loses all four; the snapshot shows offset zero, the disclosure closed, - the pause flag cleared, and a fresh live region with nothing announced. + -- the open disclosure closes and every tagged live region is replaced + by a fresh node (chromium preserves scroll and the pause flag by + itself; a reflowing replacement loses scroll too). The same arrangement and the same snapshot probe, but the swap is a naive `document.body.innerHTML = ...` with no capture/restore -- the surface minus `captureState`/`restoreState`. - Measured, and recorded rather than glossed: it does NOT lose all four. - On chromium 148 a synchronous whole-body replacement preserves - `window.scrollY` by itself, so the contract's own bad half does not - discriminate on the scroll half. It does lose the open disclosure, which - is what this test asserts; the scroll half is discriminated by - `test_naive_replacement_with_reflow_loses_the_scroll_offset` below. + Quote refreshed 2026-09-06 to the contract's post-RC-2 wording, which is + this fixture's own measurement folded back into the clause. The pre-RC-2 + text said the naive replacement "loses all four"; run on chromium 148 it + does not -- a synchronous whole-body replacement preserves `window.scrollY` + and the pause flag by itself, so those two arms did not discriminate. It + does lose the open disclosure and every tagged live region, which is what + this test asserts; the scroll half is discriminated by + `test_naive_replacement_with_reflow_loses_the_scroll_offset` below. RC-2 + wrote both facts into the contract instead of leaving the kit to + reinterpret it -- the assertions below are untouched. """ page, before, arrangement = _arrange_swap_scenario(context_factory, calm_app, "L0") page.bring_to_front() @@ -969,18 +978,23 @@ def _measure(level: str, width: int, theme: str) -> dict[str, Any]: @pytest.mark.parametrize("level", LEVELS) @pytest.mark.parametrize("width", VIEWPORTS) def test_no_horizontal_overflow(perception, level, width): - """Conformance 4's LITERAL metric: "`scrollWidth == clientWidth`". - - Recorded honestly, because this metric is vacuous on this surface: the - stylesheet sets `overflow-x: clip` on `html` and `body`, so content wider - than the viewport is clipped and `scrollWidth` never grows. The check - still runs (the clause names it, and a future stylesheet that drops the - clip must not silently start overflowing), and the artifact records the - computed `overflow-x` next to the numbers so nobody reads this pass as - "nothing extends past the viewport". That question is asked by - `test_no_element_extends_past_the_viewport` below, which clipping cannot - hide from -- and by the bad half, which demonstrates that a 900px element - at a 430px viewport does NOT move this metric at all. + """`scrollWidth == clientWidth` -- Conformance 4's metric UNTIL 2026-09-05. + + The clause no longer words it this way. RC-2 reworded Conformance 4's good + half to the measured defect -- "no element's border box extends past + `clientWidth` at any viewport" -- which is asserted by + `test_no_element_extends_past_the_viewport` below. This test is kept, and + is now defence in depth rather than the clause's own metric. + + Recorded honestly, because this metric is vacuous on this surface, and that + is exactly why the clause moved off it: the stylesheet sets `overflow-x: + clip` on `html` and `body`, so content wider than the viewport is clipped + and `scrollWidth` never grows. It still runs (a future stylesheet that + drops the clip must not silently start overflowing), and the artifact + records the computed `overflow-x` next to the numbers so nobody reads this + pass as "nothing extends past the viewport" -- and the bad half + demonstrates that a 900px element at a 430px viewport does NOT move this + metric at all. """ m = perception(level, width, "dark")["measurement"]["overflow"] assert m["scroll_width"] == m["client_width"], ( @@ -995,14 +1009,19 @@ def test_no_horizontal_overflow(perception, level, width): @pytest.mark.parametrize("level", LEVELS) @pytest.mark.parametrize("width", VIEWPORTS) def test_no_element_extends_past_the_viewport(perception, level, width): - """The measurement `overflow-x: clip` cannot hide. - - Conformance 4 asks whether the page fits its viewport. `scrollWidth` - answers "is there anything to scroll to", which a clip suppresses; an - element's own border box running past `clientWidth` answers the question - actually asked. Two horizontal-overflow defects are already recorded - in-code as previously observed at <=480px and 415px (`webtheme.py:1838`, - `:2624-2630`) -- this is the check that sees them. + """GOOD half of Conformance 4, overflow arm -- the clause's own metric + since the 2026-09-05 RC-2 true-up. + + **Good:** no element's border box extends past `clientWidth` at any + viewport [...] + + The measurement `overflow-x: clip` cannot hide. Conformance 4 asks whether + the page fits its viewport. `scrollWidth` answers "is there anything to + scroll to", which a clip suppresses; an element's own border box running + past `clientWidth` answers the question actually asked -- which is why RC-2 + reworded the clause onto it. Two horizontal-overflow defects are already + recorded in-code as previously observed at <=480px and 415px + (`webtheme.py:1838`, `:2624-2630`) -- this is the check that sees them. """ m = perception(level, width, "dark")["measurement"]["overflow"] assert m["elements_beyond_viewport"] == 0, ( @@ -1157,17 +1176,19 @@ def test_overflow_check_catches_an_injected_wide_element( calm_app: AppServer, context_factory, artifacts, browser_info ): """BAD half of Conformance 4, overflow arm -- and the reason the clause's - own metric had to be supplemented. - - **Bad:** a fixture with a fixed-width element wider than 430px emits - `scrollWidth > clientWidth`. - - Run, and the result recorded as measured: a 900px fixed-width element at a - 430px viewport does NOT move `scrollWidth` on this surface, because - `overflow-x: clip` swallows it. The element-level metric catches it. The - assertion therefore lands on the metric that discriminates, and the - artifact carries BOTH readings so the clause's literal wording is shown to - be non-discriminating here rather than quietly reinterpreted. + metric moved. + + **Bad:** in a fixture with a fixed-width element wider than 430px, + that element extends past `clientWidth` [...] + + Quote refreshed 2026-09-06 to the contract's post-RC-2 wording. The + pre-RC-2 text asked for `scrollWidth > clientWidth`; run, and recorded as + measured, a 900px fixed-width element at a 430px viewport does NOT move + `scrollWidth` on this surface, because `overflow-x: clip` swallows it. The + element-level metric catches it, so the assertion lands there -- and the + artifact carries BOTH readings. RC-2 reworded the clause onto the metric + that discriminates rather than leaving the kit to reinterpret the literal + one; the assertion below is untouched. """ page = context_factory(calm_app, width=430, height=900).new_page() goto(page, calm_app, calm_app.url("L0"), theme="dark") diff --git a/tests/conformance/operator_surface/test_tier_a.py b/tests/conformance/operator_surface/test_tier_a.py index e9e376c..dde7c92 100644 --- a/tests/conformance/operator_surface/test_tier_a.py +++ b/tests/conformance/operator_surface/test_tier_a.py @@ -21,17 +21,18 @@ ## `xfail(strict=True)` is a ledger row, never a skip -One clause does not hold on today's code, and it has an open `ledger/` row -saying so. Its good half is `pytest.mark.xfail(strict=True)` with the row id -in the reason -- never `skip`, never deleted: - - antigoals.enforced OSV1-015 `_oldest_ready_item` calls `bd.list` - with no limit (the row's own recorded - residual -- see the marker's reason) - -`strict=True` is load-bearing: when the fix lands the test XPASSes, which -FAILS the run. That failure is the instruction -- delete the marker and flip -the row, in the same change. +Where a clause does not hold on today's code and an open `ledger/` row says +so, that check's good half is `pytest.mark.xfail(strict=True)` with the row id +in the reason -- never `skip`, never deleted. `strict=True` is load-bearing: +when the fix lands the test XPASSes, which FAILS the run. That failure is the +instruction -- delete the marker and flip the row, in the same change. + +**This kit carries no deferral as of 2026-09-06.** The last one was +`test_antigoals_enforced`, against OSV1-015's recorded residual (a limit-less +`bd.list` in the caller-less `webapp._oldest_ready_item`); the dead function +was deleted in work_item_pipeline-zhv and the marker went with it. The +mechanism is documented here, not retired -- the next honestly-red row has an +obvious place to put its marker. ## One census, one register @@ -1105,19 +1106,21 @@ def test_antigoals_enforced_bad_half_state_that_dies_on_refresh() -> None: ) -@pytest.mark.xfail( - strict=True, - reason="OSV1-015 (Core 10) records the residual this good half still sees: " - "`_oldest_ready_item` (webapp.py:909) calls `bd.list` with no limit at all. " - "The row reads CONFORMS because that function has NO callers and the clause " - "scores calls `reached from a view`; this kit's Core 10 reading is " - "source-wide and has no reachability analysis, so it still reports the call. " - "Delete the dead function (or teach this check reachability, one census) and " - "the marker goes with it. The two defects this marker used to name are both " - "CLOSED: `limit=0` (OSV1-015, work_item_pipeline-8vv) and the theme dying on " - "refresh (OSV1-016, work_item_pipeline-dg3).", -) def test_antigoals_enforced() -> None: + """GOOD half of Core 10, undeferred since 2026-09-06. + + WAS `xfail(strict=True)` against OSV1-015's recorded residual: a + limit-less `bd.list` in `webapp._oldest_ready_item`, a function with + zero callers. The row read CONFORMS because the clause scores calls + `reached from a view` and dead code is reached by nothing; this kit's + census is source-wide and has no reachability analysis, so it went on + reporting the call. work_item_pipeline-zhv deleted the dead function, + which is the resolution the marker itself named -- so the good half now + runs on the real manifest and the real `src/`, and the marker is gone. + The two defects it used to name were already CLOSED: `limit=0` + (OSV1-015, work_item_pipeline-8vv) and the theme dying on refresh + (OSV1-016, work_item_pipeline-dg3). + """ problems = check_antigoals_enforced(S.read(S.PYPROJECT)) assert not problems, "Core 10 (`antigoals.enforced`):\n " + "\n ".join(problems) diff --git a/tests/unit/test_view_query_bounds.py b/tests/unit/test_view_query_bounds.py index 289144e..adc6d90 100644 --- a/tests/unit/test_view_query_bounds.py +++ b/tests/unit/test_view_query_bounds.py @@ -53,10 +53,13 @@ } ) -#: Helpers that make a listing call but are NOT reached from any route -- dead -#: code, which the clause as written does not condemn. Each one is re-checked -#: below to still BE dead: the exemption expires the moment it gains a caller. -_UNREACHED_EXEMPTIONS = frozenset({("webapp.py", "_oldest_ready_item")}) +#: THERE IS NO EXEMPTION LIST any more, and that is the point. Until +#: 2026-09-06 this module carried one entry -- `webapp._oldest_ready_item`, a +#: limit-less `bd.list` in a function with zero callers -- with a test below +#: that re-earned the exemption every run by proving it was still dead. The +#: function was deleted (work_item_pipeline-zhv), so the exemption and its +#: guard went with it rather than being left standing over an empty set, which +#: would have passed forever while proving nothing. #: How deep the name-following goes. Matches the ledger's own route audit. _DEPTH = 4 @@ -230,25 +233,6 @@ def test_every_listing_call_reached_from_a_read_only_route_passes_a_finite_limit ) -def test_the_exempted_uncapped_helpers_are_still_reached_by_nothing(): - """The exemption list is not a permanent pardon. - - `_oldest_ready_item` calls `bd.list(...)` with no limit at all and is - exempt above for ONE reason: nothing calls it, so it is not "reached from - a view". The instant it gains a caller that reason evaporates -- and this - test is what notices, rather than the audit quietly continuing to skip it. - """ - for module_name, func_name in sorted(_UNREACHED_EXEMPTIONS): - source = (_SRC / module_name).read_text(encoding="utf-8") - occurrences = source.count(func_name) - assert occurrences == 1, ( - f"{module_name}: `{func_name}` now appears {occurrences}x (its own " - f"definition plus {occurrences - 1} reference(s)). It makes an UNCAPPED " - f"adapter listing call and was exempt from the bound audit only because " - f"it was dead code. Give it an explicit limit, or delete it." - ) - - # ------------------------------------------------------- the bound itself From 0e9086c9155f9013a61de87c67562a3cf5baec11 Mon Sep 17 00:00:00 2001 From: Amplifier <240397093+microsoft-amplifier@users.noreply.github.com> Date: Sun, 6 Sep 2026 07:32:46 -0700 Subject: [PATCH 2/3] manager: OSV1-030 prose true-up (no deferral left in either kit); candidate Status -> RATIFIED; return log + plan --- contracts/operator-surface.v2-candidate.md | 2 +- docs/workflow/OWNER-RETURN-LOG.md | 2 ++ docs/workflow/PLAN.md | 1 + ledger/rows.yaml | 6 ++++++ 4 files changed, 10 insertions(+), 1 deletion(-) diff --git a/contracts/operator-surface.v2-candidate.md b/contracts/operator-surface.v2-candidate.md index 7b38109..32609da 100644 --- a/contracts/operator-surface.v2-candidate.md +++ b/contracts/operator-surface.v2-candidate.md @@ -6,7 +6,7 @@ target: contracts/operator-surface.v1.md **Date:** 2026-09-06 **Author:** agent:converge-manager via proposal-drafter -**Status:** PROPOSED — awaiting the owner's word +**Status:** RATIFIED by owner 2026-09-06 ("Ratified") — applied to operator-surface.v1.md via PR #90 (main a8951bd) **Against:** `contracts/operator-surface.v1.md`, Status FROZEN, `main` @ `279a6ef` **Evidence source:** `.amplifier/converge/operator-surface-freeze9-review.md` — the Freeze 9 external review (independent reviewer, not the author): pass-1 findings 4, 6, 7, 8 and 9, and diff --git a/docs/workflow/OWNER-RETURN-LOG.md b/docs/workflow/OWNER-RETURN-LOG.md index 0c4fa18..2948332 100644 --- a/docs/workflow/OWNER-RETURN-LOG.md +++ b/docs/workflow/OWNER-RETURN-LOG.md @@ -21,3 +21,5 @@ One entry per return of the intent steward (clock-stamped) or per unprompted bri - This PR: v2 candidate (6 changes, evidence = Freeze 9 review), `lvn` prose repair (OSV1-024/025 + `test_row_osv1_025` docstring), `docs/workflow/{PLAN,OWNER-RETURN-LOG}.md`. - Queue: `zhv` (Core 10 residual, ready), `1y2` (external), `lvn` (held → resolving on merge). + +## 2026-09-06 13:30 - they came back with the word: "yes" (priority for zhv) diff --git a/docs/workflow/PLAN.md b/docs/workflow/PLAN.md index b3dd378..14d266a 100644 --- a/docs/workflow/PLAN.md +++ b/docs/workflow/PLAN.md @@ -27,3 +27,4 @@ Regenerated each manager cycle from the repository's history and the shared queu ## Queue (work_tracker) at this cycle - ready: `1y2` (external, not this operation) + the Core 10 residual item filed this cycle. Held: `lvn` (this session, resolving on merge). - Width: 0 lanes running; nothing under width — the only lane-shaped item is the Core 10 residual, held for the owner's priority word since it is a src change on a frozen surface (kit + ledger re-derivation). +- 2026-09-06T13:30:54Z CALL priority ANSWERED "yes" — lane zhv launched (batch hw-post-lock). diff --git a/ledger/rows.yaml b/ledger/rows.yaml index 633ede8..57a55df 100644 --- a/ledger/rows.yaml +++ b/ledger/rows.yaml @@ -3569,6 +3569,12 @@ THE HOUSE PRECEDENT this follows: the custody family's CCV1-023 recorded discrimination by REVERTING each fix in turn and observing exactly the matching bad half go red while every good half stayed green. + TRUED UP 2026-09-06 (integration of work_item_pipeline-zhv): the sentence above calling + Tier-A's `test_antigoals_enforced` "THE ONE REMAINING DEFERRAL IN EITHER KIT" was true + when written and is false as of this commit -- the dead `_oldest_ready_item` is deleted + and both kits now carry ZERO xfail markers (Tier-A 42 passed / 0 xfailed). Kept as dated + history; the probe never asserted the claim, so nothing was red. + - id: OSV1-031 title: >- Freeze 5 -- every Core clause reads CONFORMS or NOT-ASSERTABLE From be6e51d03964b6aefedfca6fb9ef7c3c01af8456 Mon Sep 17 00:00:00 2001 From: Amplifier <240397093+microsoft-amplifier@users.noreply.github.com> Date: Sun, 6 Sep 2026 07:34:36 -0700 Subject: [PATCH 3/3] manager: CHECK-RECORD for lane/zhv merge (own re-run: Tier-A 42/0, ledger 60, harness 69/69, pyright 0, hash match) --- docs/workflow/CHECK-RECORD.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/docs/workflow/CHECK-RECORD.md b/docs/workflow/CHECK-RECORD.md index 183466a..20caa4d 100644 --- a/docs/workflow/CHECK-RECORD.md +++ b/docs/workflow/CHECK-RECORD.md @@ -12,3 +12,14 @@ One entry per integration, written by the MANAGER session in its own commit (nev - `sha256sum contracts/operator-surface.v1.md` = a1f304b11b17… == OSV1-000's operator-surface pin (custody pin ec4b736f… unchanged) - Status line still `**Status:** FROZEN`; candidate carries "Ratified by owner — 2026-09-06"; Changelog head is the v2 amendment entry; 12 rows carry the dated amendment note; OSV1 33 CONFORMS / 3 NOT-ASSERTABLE. - Contract reading after re-run: operator-surface.v1 **Kept** (every Core clause CONFORMS or NOT-ASSERTABLE with cadence); custody-coordination.v1 **Kept** (CCV1 rows unchanged). + +## 2026-09-06 14:34 UTC — merge of lane/zhv (Core 10 residual) +- Covers: merge commit 9c6c4f7 on `converge/zhv-core10-residual` = main a8951bd + lane/zhv 0debd81 (one lane; no pair gate needed), plus manager repair commit 0e9086c (OSV1-030 prose, candidate Status line, docs/workflow). +- Ran, in this session, on the merged tree: + - `grep -rn _oldest_ready_item src` → no occurrence (0 definitions, 0 calls); the earlier "2" was a counting artefact of `grep -rc` summing, re-measured with `-rn` + - `.venv/bin/python -m pytest ledger/checks -q` → 60 passed + - `make ledger-mutate` → ALL mutations proven 69 / 69; UNPROVEN: (none) + - `pytest tests/conformance/operator_surface/test_tier_a.py -q` → **42 passed, 0 xfailed** (was 41 / 1) + - `.venv/bin/pyright src tests` → 0 errors; `ruff check src tests ledger` → All checks passed! + - `sha256sum contracts/operator-surface.v1.md` a1f304b1… == OSV1-000 pin; contract untouched by the lane (confirmed by diff) +- Contract reading after re-run: operator-surface.v1 **Kept** — both conformance kits now carry zero xfail markers; custody-coordination.v1 **Kept**.