2 Commits

Author	SHA1	Message	Date
joakimp	dab989b068	fix(mailbox-tests): the owed-set suite's own gate refused to let it run on node 24 ... scripts/test-owed-withdrawal.sh has not executed a single assertion since the image moved to node 24. Its precondition line node --experimental-strip-types --check "$SRC" exits 2 on an unmodified extensions/pi/mempalace.ts, and the script is `set -euo pipefail` with `|| exit 2`, so all 17 assertions and both regression guards were skipped. Measured on pi-devbox v1.9.1, node v24.21.0. CAUSE, MEASURED AND NARROWER THAN IT LOOKS. The reported error names the inline type-import at mempalace.ts:92, which invites the reading "that import is unusual". It is not the import: `node --check` does not type-strip AT ALL. A file whose entire content is `const x: number = 1;` fails identically, with or without --experimental-strip-types, while `node --experimental-strip-types <same file>` executes it fine. --check has never been type-aware; execution is what gained stripping. So this gate could never validate TypeScript, on any node. WHY IT USED TO PASS -- INFERENCE, NOT MEASUREMENT. e2b060a's message records this suite running on 2026-09-09 with a control pass and four mutation kills, when the image shipped node v22.23.2; v1.9.1 ships v24.21.0. No node 22 exists on the box where this was diagnosed, so the counterfactual was not executed. Treat "22 stripped for --check and 24 stopped" as a hypothesis consistent with the record, not as a measured cause. What IS measured is the present-tense behaviour above. WHY THIS MATTERS MORE THAN A RED TEST. This suite exists because isWithdrawn is the one rule in the extension that can go wrong SILENTLY -- a wrong rule does not throw and does not log, it makes a real unanswered ask vanish from a mailbox forever. The rule shipped in e2b060a and has been baked since v1.9.1; the thing that makes its failure mode visible has been dark for the same period. The mitigating half: it failed CLOSED (exit 2, loud), never vacuously green. A gate that cannot run must not pass, and it did not. THE FIX. Strip first, then syntax-check the emitted JS: version-stable, and it still refuses malformed input. `mode: "strip"` blanks type syntax without moving anything, so offsets and line numbers survive and a reported error line still points at the right line of the original .ts (69157 B in, 69157 B out). THE EXIT CODES ARE NOW SPLIT, AND THAT IS THE POINT. 3 = the gate itself cannot run (no module.stripTypeScriptTypes, i.e. node < 22.13). 2 = the source does not parse. Collapsing the two is how this defect disguised itself: it printed "mempalace.ts does not parse" while mempalace.ts was fine, sending a reader to inspect the wrong file. Note the stripper is itself a parser, so a genuine syntax error surfaces as an exception from the strip call rather than from --check; that path is caught and reported as 2, not 3. Both remain failures. Neither passes. VERIFIED IN SIX DIRECTIONS on this image, each expectation written down first: unmutated source -> rc=0, PASSED (17/17) malformed TypeScript -> rc=2, "does not parse: Expression expected" stripper made unavailable -> rc=3, "cannot strip", and NOT "does not parse" (simulated by doctoring the runtime through NODE_OPTIONS, so the shipped line ran as shipped) M1 marker requirement removed -> FAILED: 3 (no-marker, other-thread, prose) M2 third-party guard removed -> FAILED: 1 M3 to_agent guard removed -> FAILED: 2 (broadcast and wrong-device share it) M4 ordering guard removed -> FAILED: 1 The four kill counts are the same ones e2b060a recorded, so sensitivity is restored rather than merely asserted. WORTH KNOWING FOR THE NEXT PERSON WHO MUTATES THIS: the extractor carries its own guard that rejects an isWithdrawn which no longer mentions "withdraws", so the obvious M1 (delete the marker check outright) is refused before any assertion runs -- correctly, but it looks like a crash. Mutate to `... || true` instead, which removes the requirement while keeping the key mentioned. SC2016 is disabled on the node invocation with a stated reason: the single quotes are deliberate, the payload is JavaScript and `${process.version}` must reach node rather than the shell. Checked that the file is shellcheck-clean at default severity, as it was before this change, and at the -S error severity the pi-devbox gate uses. NOT FIXED HERE. Nothing in CI runs this suite -- it is a script an operator invokes, which is precisely why a gate that fails loudly still went unnoticed across a node bump. The harness's own runner two hundred lines below still passes --experimental-strip-types, deliberately: it is a no-op on 24 and required on 22, so it keeps the suite runnable on both. And the real reason this was found at all is unrelated to CI: isWithdrawn was being exercised end-to-end on a released image against the live logstream for the first time (project/pi-devbox seq 140), and the suite was reached for as corroboration.	2026-09-14 16:27:29 +02:00
joakimp	e2b060a940	feat(mailbox): let a requester withdraw its own ask, with an explicit marker ... RFC 003 §3.3 clause 3 clears an ask only on "no event OF YOURS", and the skill states the consequence outright: "there is nothing anyone can do about it from the other end". That asymmetry is deliberate and mostly right — owed-ness is a statement about the RECIPIENT's accountability. It is wrong in exactly one case: the requester retracting its own ask. MEASURED COST. pi@mbp-m1-2020 withdrew a v1.8.13 rollout ask to pi@tor-ms22 at seq 119 — terminal `superseded`, same correlation_id, metadata.closes naming the thread, body "DO NOT SPEND A MINUTE ON v1.8.13" — and recorded it as done. It had no effect: seq 119's from_agent is mbp, so it could never satisfy a join that only inspects tor-ms22's own events. tor-ms22's next wake-up, 8h later and on the first boot of the image shipping this very derivation, still listed the ask as owed, 41h old, for a release it never installed. The failure is invisible from the sender's side, which is why it went unnoticed for 41h. WHY AN EXPLICIT MARKER RATHER THAN "ANY TERMINAL EVENT FROM THE REQUESTER". This file's standing rule is that every failure stays on the noisy-but-visible side: a resurfacing item costs one turn of human correction, a suppressed unanswered ask is silent and permanent. Under the naive rule a requester appending `applied` for its own bookkeeping — on the correlation, addressed to me, before I ever replied — would silently delete a real obligation. So release must be STATED: metadata.withdraws (canonical) or metadata.closes (already this fleet's de-facto marker), whose value must NAME the ask — its correlation_id or its event id. Prose does not count. Five further guards, each pinned by a mutation test: only the original requester; addressed to this device exactly, never '*'; terminal status; strictly after the ask by hlc; and joined by ack_of or correlation_id. This does NOT break the fixed point in §9.2. That section rejects letting terminal directed events into the owed set, because then every closure mints a fresh obligation. That is about CANDIDATES; this adds a CLEARER. A withdrawal is terminal, so it can never be a candidate, and the asserting shape (open) and the clearing shape (terminal) stay disjoint. Also fixed here, because the new rule depends on the same windowing: the `mine` query used event_list's DEFAULT `asc` order with limit 100, i.e. the OLDEST 100 events this device ever wrote. Once a device passes 100 authored events its most RECENT replies fall out of the join window and every ask it just answered resurfaces as owed. Latent, not theoretical — tor-ms22 was at ~20. Both windows are now anchored at the newest end with order: "desc". Verification: scripts/test-owed-withdrawal.sh, 17 assertions over VERBATIM fixtures from the real log (seq 112/119/120/122). It extracts the predicates from mempalace.ts by brace matching and runs the SHIPPED text rather than a pasted copy — this repo has already paid for a divergent second copy. Sensitivity proven by four mutations: removing the marker requirement flips exactly the 3 marker assertions, and disabling the third-party / broadcast / ordering guards each flip exactly their own. Control passes.	2026-09-09 08:56:56 +02:00