The sequence only knew accounts, lines, periods and closes, but that is no
longer where money moves: invoices, bills, their payments, write-offs and
voids are now first class, and the draft-state commands decide whether an
entry exists at all. Op gains each of them, on the same Ledger the store
wraps, with random parties, dates and amounts (including the raw-decimal
extremes).
The invariant after every sequence gains B-38: each control account equals
its documents as of three dates, and a control check too large to compute is
a refusal, never a difference. That is the identity that would catch a
payment tagged to the wrong document, or one that went unmatched, which the
trial balance alone cannot see.
P2 promised these two targets and never added them. `fuzz_http_mcp_request`
feeds a method, a path, headers (token present, absent, wrong, raw) and a
JSON-RPC body drawn from the real method and tool names into the in-process
router. Whatever arrives, the door answers: no token live for the book is
refused 4xx, never run (INVARIANT 8), and a live token never makes the door
fail (no 5xx on the MCP route). Whether a token is live is asked of the door
itself (`FuzzDoor::carries_a_token`), so a token smuggled in an extra header
is judged by the real rule rather than by the target's guess.
`fuzz_upload_put` declares a size and a hash and sends bytes: taken only
when both are exactly what was declared, from the token the grant names,
and only once (INVARIANT 9); a 200 for anything else is the bug.
Both join the weekly matrix in scheduled.yml; fuzz/Cargo.lock gains
ledger-mcp's dependency closure because the targets drive its router.
The local socket and the tunnel already mount the same four routes; naming
that table `router` gives the fuzz targets the very door a client reaches,
not a copy of it. `local/fuzz_door` (behind the `fuzzing` feature, off in
every shipped build) builds a book, two live tokens and that router, and
answers one request through `tower::oneshot`: no socket, no port, no clock.
The target's oracle is then the code that enforces it: INVARIANT 8 (a book
only behind a live bearer token) is checked by asking `Books::bearer`, not
by a second model of the rule that could drift from it.
The For P12 paragraphs, each left where its unit wrote it with a pointer,
consolidated into one mutation checklist per crate, each item keeping its
origin unit in brackets, so the run walks a crate at a time.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp
Each recipe mutates one crate and runs its own tests plus ledger-cli's
end-to-end suites without the viewer, as mutants-mcp does, so a mutant
in a crate whose behavior is reached only through the one executable is
still caught. Local runs only (D-59): no shard goes into scheduled.yml.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp
The interface spec gains `books.start`'s allocated `update_waiting` field
and says only the owner can accept it. The packaging and architecture
notes now describe the lease intent, the viewer's notice and "Check for
updates", and the translocated-app refusal instead of listing them as not
built. The testing record names each new test and the mutation targets it
gives P12. The plan's P11a status and As-built block record what landed
and what still waits: the Mac trial, the Windows installer (P11c's) and
signing (D-64).
A `.dmg` downloaded from the internet keeps its quarantine bit, so
Gatekeeper may run the app from a read-only copy under
`/private/var/folders/…/AppTranslocation/…` that vanishes when the app
closes. Connected from there, an agent would be pointed at a path that
will not exist the next time it runs. Connect refuses instead, before a
token is made or an agent's list is touched, and says to move the app out
of Downloads and open it again (P11a step 6).
The rule is on the path the program would give the agent
(`start::translocation_refusal` over `this_executable`), so the same check
covers the CLI's `connect` and the viewer's Connect. The test stands in
for Gatekeeper's copy on any Unix by naming a file under an
`AppTranslocation` path in `APPIMAGE`; the agent never runs and no books
home is made, while the same program at an ordinary path connects. A unit
test holds the marker to a whole path part, not letters in a name.
The host has staged a downloaded, signature-checked update since step 4,
but the only way to apply it was `wanderbooks update` at a terminal, and
nothing in the viewer or on an agent's first call said one waited. The
owner's accept is the name plan 8.0.3 allocated for it: the lease socket
gains `Intent::ApplyUpdate`, and the host installs the staged copy from a
thread and lets its existing watch for a replaced program (host.rs
INVARIANT 7) restart onto it once no call runs, so the books stay open and
every holder's session carries on. With no host running there is no call
to cut off, so the viewer applies it itself.
The viewer reads `<root>/updates/staged/meta.json` every few seconds and
shows a standing notice with "Update now"; Books gains "Check for updates"
(which looks at the feed at once, whatever the daily look last did) and
"Update to X". `books.start` gains the allocated `update_waiting` field
and a next step telling the agent to tell the human; no tool can accept.
`apply_staged` waits up to five seconds for the update lock: running the
new tests showed the host's own look can hold it for a moment after it
writes `meta.json`, and the owner's accept should wait that out rather
than answer "nothing waits".
Tests: `books_start_says_an_update_waits` and
`the_owner_accepts_a_staged_update_in_the_app` in
`crates/ledger-cli/tests/update.rs` (a bridge writes all through the
restart, each account in the chart exactly once);
`the_menu_checks_for_updates_and_a_waiting_update_shows_a_notice_that_accepts`
and `books_outside_a_data_root_have_no_update_notice` in
`crates/ledger-gui/tests/update_notice.rs`.
main's canonical default made Root::setup take std::fs::canonicalize(home),
which on Windows is \\?\C:\... with the long name. root.rs now uses
root::canonical (canonicalize, then the prefix off) at every site, so no
root, record or message keeps the prefix; Unix is unchanged (the identity),
and macOS still agrees on /tmp and /private/tmp. windows_root.rs compares
against default_root(canonical(home)), so TEMP's 8.3 short name is not in
the expectation, and asserts the root has no prefix.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp
Run 13 failed at the same helper: the store holds LockFileEx locks on
wanderbooks.lock and books.lock, which are mandatory on Windows, so
reading them is refused. tree() skips any *.lock and the live SQLite
files at any depth. The other read_dir walkers in the store, cli and gui
tests either read only metadata or copy closed books; the cli harness's
book_files already tolerates a refused read.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp
spec_store's tree() read every file under the root while a Store was
open; on Windows SQLite holds byte-range locks on its database, so the
read failed (os error 33) in two tests. The lock seam locks only
wanderbooks.lock, never data, so it is not the cause. tree() now leaves
out the live database and its -wal/-shm/-journal; the tests compare the
journal, blobs and kept-aside files.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp
P11c run 11 on Windows: `bash` there is WSL's, with no distribution, and
the cap never bit. The simulation is Unix's; the books' full-disk
behavior is the same code everywhere.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp
std's append(true) opens without FILE_WRITE_DATA, so SetEndOfFile on that
handle is refused (PermissionDenied) on Windows: the torn-line cut on open
(chain::tests::an_unfinished_last_line_is_cut_away_on_open) and the
roll-back of a failed append (chain and journal) could not truncate. Not a
rename/share-delete problem: std already opens with all three sharing
flags. chain::truncate cuts through a short-lived write handle on Windows
and the handle itself elsewhere; the journal's roll-back uses it too.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp
local.rs's archive_git handed git the canonical \\?\ path the product's
git already no longer sees. Same helper (root::plain_path). The other
Command::new("git") tests are Unix-only files (backups.rs, format_upgrade,
open_while_held) or use paths from tempfile, not canonicalize.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp
std::fs::canonicalize on Windows returns \\?\C:\..., which git refuses
("not a git repository"): every argument handed to git now has the
extended-length prefix taken off (root::without_extended_prefix, with a
unit test that runs everywhere; \\?\UNC\ becomes \\). The access-record
test's fixture is a FIFO in the log's place, which Windows has no
counterpart for; the refusal path is the same code on every system, so
the test and its helper are Unix-only. main (8f0e5f08) merged in.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp
The gate on d326894c (twice green before): after the apply, the new
host's next look staged 9.0.0 again within the test's window on the
runner, since the test's newer program is this binary with bytes
appended and its compiled version never catches up with the feed's.
The program in place and the kept previous copy are the apply.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp
The portable macOS job: a root chosen at the default (`/tmp/.../Library/
Application Support/wanderbooks`) resolved to `/private/tmp/...` and
read as somewhere else, so setup kept a record that should have gone.
The default is taken from the canonical home, as a chosen root is.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp
The gate on 8ba104a1 passed every workspace test and failed only the
server-only build: P5's `books_start_fits_8_kib_on_the_demo_books`
builds the demo books with `ledger_gui`, which the no-viewer build
does not carry. Gated on the `gui` feature like its neighbours.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp
The portable macOS job: five root tests spelled out `.local/share`
or compared a chosen root against its /tmp spelling where macOS keeps
/private/tmp. They use `platform_data_dir` and canonical paths now.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp
The portable Windows job (P11c run 6) failed ledger-core's
`where_backups_go_is_checked`: `/srv/books.git` is not an absolute path
to Windows, and `C:\books` was read as the host `C` of a networked
address. `backup.git_remote` now reads a drive path (one letter, a
colon, a slash or backslash) as a path on this computer, as git does,
and a path from `/` as rooted on every system git runs on; the test
holds the three forms on every OS.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp
Two tests raced the host: one asserted the staged copy was applied the
instant the books reopened, the other that a dropped tampered copy's
folder was gone, when the new host may look at the feed again and stage
a fresh, true copy in its place. Both wait for what they mean now (the
apply; the tampered bytes gone). Every whole-program comparison is on
the sha256, so a failure's message is a line, not two binaries (GitHub
kept nine lines of a step's log on one such message).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp
Alone, the update tests passed on the runner; inside the whole run one
fails and the step log loses its message. The CLI crate's suites run
first in a step of their own so the message survives.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp
The staged-update test fails on the runner on two runs in a row
(main a8ce2e7d, branch P11c), passes locally even on one slow core,
and the gate's step log keeps only its last lines. A step of its own
shows the message; it goes once the cause is fixed.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp
The portable macOS job: the command line handed to `script` was the
words joined by spaces, and `Library/Application Support/wanderbooks`
split into two arguments ("unknown argument: Support/wanderbooks").
Each word is single-quoted now, on every OS; a word that is a shell
operator a test means as one (the consent test's `>`) stays bare.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp
two_user.rs started its flagged servers with env_clear plus a Unix PATH
and HOME, no SystemRoot: on Windows Winsock cannot start without it, so
the --http door failed to bind (the server says so on stderr and serves
its pipes only, which is why "ready" still came). The tests now use the
harness's clean_env, as do evidence.rs's extract and the viewer's
command_line test. main (a8ce2e7d) merged in.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp
swaits
