A test suite that has never failed proves nothing at all. So every contract in this catalogue is measured the only way a test can be: by breaking the implementation on purpose, one defect at a time, and requiring the suite to notice.
A run that is stuck red catches everything and means nothing; a run that is stuck green catches nothing and looks like a clean bill of health. So each battery names one obvious defect and refuses to measure anything until two things have happened in front of it: the unmutated code passes, and that obvious defect fails. Neither half alone is a calibration.
A run also counts the tests it collected and compares them with a figure declared per file, because a configuration that quietly collects a fraction of the suite leaves every result agreeing with itself. That has happened here three times, all three by accident.
A high score does not say the code is correct. It says the tests notice the defects that were tried.
That is the whole limit of the method, and it is worth stating plainly because the number below reads like a correctness claim and is not one. What makes it worth publishing anyway is the part almost nobody else can offer: the defects that were tried are not a summary or a percentage. They are written down, named, and readable — every one of them is a committed file in this repository, with the exact edit it makes and the verdict it must produce.
every figure here is read off the batteries in this repository, where each cell carries the verdict it must produce. That is what this project asserts about its own tests. It is not yet something you have seen happen.
npm run mutation is what turns it into something you have watched happen: it injects every defect below into a working tree, runs the suite once per cell, compares what happened against what the battery pinned, and prints the total. A single cell that disagrees fails the run. One run of it over the 19 batteries took 41 min 24 s, measured at 1fb1d85; every population here is counted in defect cells, and this reading is of 660 where the figure it replaces was of 631 - so the 34 min 30 s at 3949c87 is a real past reading of different work rather than a faster version of this one, and the instrument gained a reading of its own between them. This population has one reading, so the figure above is bounded by the readings of every other population rather than by a twin of its own. The closest two of one population this machine has given are the 623 cells: 28 min 9 s at b438de2 and 29 min 2 s at 75d3358, fifty-three seconds apart on identical work. The widest is four and a half minutes, over the 621: 28 min 1 s at 6226769 and 32 min 28 s at 5bb4e97. Every reading below can only approximate the same point by comparing populations, and they do not order themselves by population either: the 618 ran at 27 min 22 s and at 28 min 42 s, the 615 at 27 min 34 s, the 614 at 34 min 6 s, and the 612 at 27 min 8 s - so the smallest population is the fastest run and the second smallest is the slowest by seven minutes, and the 614 came within half a minute of the 631 with seventeen cells fewer. The variation is the machine rather than the cells. Before this regime a cell of a contract battery collected all five contracts rather than its own: the same 612 cells ran there at 31 min 25 s, the 610 before them at 29 min 13 s, the 606 before those from 28 min 19 s to 35 min 10 s, the 605 before those from 29 min 22 s to 37 min 0 s, and the 592 before those from 25 min 8 s to 28 min 59 s. No share of any of those steps is attributed to anything, and the reason is measurable rather than modest: cli-install has run from 364 s to 484 s on identical work, a quarter of its own duration, and took 576 s in the run above - so a machine this variable cannot support an account of where any of it went. That is one run rather than how long it takes. npm run tally prints that total again from the results a replay left, measuring nothing - and refuses a set that is not one complete replay of the commit it would describe, so a figure taken over a stale or partial run cannot be produced by accident.
660 defect cells, 625 caught. The other 35 are 12 equivalent, 6 outside what the contract specifies, 4 unreachable on this catalogue, 1 a declared open class, 12 only where a lens blinded the suite. Each one is below, with the sentence its own battery carries about it.
the edit cannot change an answer, so no test could catch it. Measured rather than assumed: each one carries what was compared against what.
fixture · FX-2 on C/as-committed
adds the value to itself instead of multiplying it by two - an equivalent mutant, and the one the meta-tests need: an apparatus pointed at it for calibration has been shown able to see nothing at all, and must be refused
number-parse · P-02 on C/as-committed and C/reason-blind
memoises into a bare object, consulted after the grammar guard. It survives because the guard is in front of it: only a string the decimal grammar has already accepted reaches the cache, so the inherited keys that make P-17 a defect - constructor, toString - are not keys it can hold. Measured differentially against the reference over a corpus of 300 067 inputs, each seen once cold and once with a foreign call in between: nothing tells the two apart
number-parse · P-06 on C/as-committed and C/reason-blind
uses parseFloat instead of Number. It survives because the grammar has already run: the two differ on exactly the language the grammar exists to reject - parseFloat reads a prefix and Number refuses the whole string - and nothing that reaches this line is outside the decimal grammar. Measured differentially against the reference over a corpus of 300 067 inputs: nothing tells the two apart
number-parse · P-14 on C/as-committed and C/reason-blind
uses the global isFinite instead of Number.isFinite. It survives because the coercion the two differ by cannot happen here: value is what Number(...) just returned, so it is already a number and the global has nothing left to convert. The edit is a real defect in a module where that line takes an argument, and this is not one. Measured differentially against the reference over a corpus of 300 067 inputs: nothing tells the two apart
number-parse · P-19 on C/as-committed and C/reason-blind
memoises into a Map, consulted first - the same cache without the inherited keys. It survives because a Map has no prototype to serve from and the key is the exact string the analysis is a function of, so a hit and a miss cannot answer differently. It is the control for P-17: same position, same advance, and the only difference is the container - which is what makes P-17 a defect about Object.prototype and nothing else. Measured differentially against the reference over a corpus of 300 067 inputs, each seen once cold and once with a foreign call in between: nothing tells the two apart
number-parse · P-20 on C/as-committed and C/reason-blind
writes the trim by hand as /^\s+|\s+$/g. It survives because \s and what trim removes are the same set - WhiteSpace and LineTerminator, which is where the no-break space and the byte-order mark this contract has cases for both sit - and because the literal stays inside the call, so no lastIndex outlives one. It is the near miss of P-08, which adds the global flag to a literal at module scope and is killed by two guards. Measured differentially against the reference over a corpus of 300 067 inputs: nothing tells the two apart
packaging · A-13 on A/as-committed
stops removing the output folder before writing it, which build.ts calls the whitelist failing in the one direction a whitelist cannot catch. Measured by planting a file no source produces and building twice: it is gone with the clean and gone without it, because a stale module is one nothing imports and the prune already drops whatever the entry point cannot reach. The two are not independent here - the second dominates the first
the edit changes something a caller could observe, and the contract deliberately makes no promise about it. What this marks is the edge of the specification, not a gap in the tests.
array-group-by · M-18 on C/as-committed and C/identity-blind
rebuilds the group array on every insertion instead of pushing into it. The answer is right on every input and the cost is quadratic in the size of a group - measured, 5392 ms against 0.7 ms on the fifty-thousand-element single-group sample. It survives, and it is the mutant that found a defect in this contract's own guards: under vitest's default five-second limit it was killed by the block 4.5 shape test, which asserts a shape and was silently asserting a duration as well. A verdict eight per cent away from flipping with the speed of the machine is not a verdict, so that test now carries an explicit timeout and this cell records the truth: nothing in this contract constrains complexity
array-group-by · M-20 on C/as-committed and C/identity-blind
recycles one module-scope Map, cleared at the start of every call and handed to every caller. Pinned as a survivor on purpose: the contract requires each *group* to be a fresh array and says nothing about the Map that holds them, so a caller who keeps a result watches it empty itself on the next call. The determinism property is green here for the reason date/add@1 recorded of its D-02 - both calls return the one object, and it is compared against itself
number-parse · P-16 on C/as-committed and C/reason-blind
writes a call counter onto globalThis. It is the one survivor of this battery that is observable from outside the function, and that is why it is not filed as an equivalence: every answer is the reference's, and the counter is there to be read afterwards - measured, 900 201 after a differential run. What the contract constrains is what this function *reads* - the freedom-from-ambient-input property is about exactly that - and it says nothing about what it writes. So nothing here is contradicted, and what the cell records is the edge of the contract rather than a defect the guards missed
the rule is real and no input in this catalogue tells the two apart. A larger catalogue would reach it, so the rule is kept and the cell records that nothing here exercises it.
cli-search · S-11 on S/as-committed
searches the bare name instead of the rendered address, so 1 in number/parse@1 is a word nothing carries. It survives, and the reason is the other rule: 1 is set aside, and what remains - number, parse - names the bare name in full, so the query answers anyway. The rendered address changes what the result scores and not whether it is one, and nothing in this catalogue can order it differently. Recorded rather than deleted: the address a tool prints is the address it should match, and the argument for that is not the score.
cli-search · S-12 on S/as-committed
stops splitting camel case. It survives because the split is applied to both sides: the query and the field go through one tokeniser, so removing it from the tokeniser removes it from both and they go on agreeing - groupBy typed becomes groupby, and the alias groupBy becomes groupby too. What that measures is the catalogue rather than the code: array/group-by@1 declares group by *and* groupBy, so neither spelling depends on the split. A contract declaring only one of them would, and no mutant here can arrange that.
cli-search · S-13 on S/as-committed
lets a summary be what a query names in full. It survives because no query covers a summary: naming one in full means typing every word of a sentence, and the shortest of the five is eighty-five characters. The exclusion is a statement about which fields are deliberate, kept because it is one, and its effect is unreachable on any catalogue whose summaries are sentences.
cli-search · S-14 on S/as-committed
strips a trailing s from any word at all, so is becomes i and as becomes a. It survives because neither i nor a is carried by anything those two queries would then reach: a is a word four summaries hold, so is would answer them - and no negative query here contains is without another word that already fails. The bound is kept for the same reason a bound is always kept, and what this records is that the catalogue does not currently contain the input that would show it.
a limit this repository has written down, with its price, in the list of what it declares and nothing keeps. This is the only one of the five that is a debt.
string-slugify-spec · GS-11 on S/as-committed
the declared output alphabet widened to admit the underscore, while the implementation goes on never emitting one. It survives, and that is the finding this battery reports rather than repairs: the alphabet is checked in one direction only. Every property asks whether an answer falls outside the declared alphabet, and nothing asks whether the declared alphabet is wider than the answers need - so a contract can promise a larger surface than it keeps, and a caller who escapes on the strength of that promise is escaping more than they have to. The same hole would admit any character; the underscore is chosen because it is the one readers actually ask for
the same defect dies on the column that reads the contract as committed, and lives only where a lens took part of the suite's sight away. That difference is what the lens exists to measure: it is what a contract without that half of its surface would have caught, which is nothing.
date-add · D-11 on C/reason-blind
no-input-validity-check: drops the early rejection of an Invalid Date input. NaN reaches the final range check by every path, so the value is unchanged; only the reason moves, from invalid-date to out-of-range
date-add · R-1 on C/reason-blind
right value, wrong reason: a field that is not a whole number is reported as out-of-range
date-add · R-2 on C/reason-blind
a plausible but false reason: an unknown field is reported as field-not-whole, which is what a developer would guess if they had to guess
date-add · R-3 on C/reason-blind
collapse: every reason reported as one. This is a diagnostic carrying exactly as much information as null, and a contract that cannot kill it has bought nothing but syntax
date-add · R-4 on C/reason-blind
the pair null renders indistinguishable: invalid-date and unknown-field exchanged. Under null this defect has no observable consequence whatsoever
number-parse · P-17 on C/reason-blind
memoises into a bare object, consulted first - so an inherited key such as "constructor" is served from Object.prototype. Measured, and the one place where publishing a reason changed which guard catches a defect rather than adding one: under the bare null convention the poisoned entry was the answer, and parseNumber("constructor") returned a function, so the named case caught it on the value. Here the poisoned entry is an analysis whose ok is undefined, so parseNumber answers null - which is the right answer - and only the diagnostic still sees anything, returning undefined where the contract requires "not-decimal". The blinded column is what this contract would catch if it published no reason at all: nothing
number-parse · N-1 on C/reason-blind
right value, wrong reason: overflow reported as not-decimal
number-parse · N-2 on C/reason-blind
a plausible but false reason: the empty string reported as not-decimal, which it also is
number-parse · N-3 on C/reason-blind
collapse: every reason reported as one. The form carrying exactly as much information as null while looking like it carries more
number-parse · N-4 on C/reason-blind
the separator literal declared and never produced: the second look is dropped and every separator mistake falls back into the residual reason. No value changes, because both branches refuse - this is what the contract looked like before the literal existed, and it is the shape a later optimisation of the refusing path would reach by accident
number-parse · N-5 on C/reason-blind
the separator family widened to whitespace, so "4 2" is reported as a separator mistake. It polices the line block 4.4 draws from the other side: the family is the formatting a document emits, never the ordinary space, and without this mutant that line would be a sentence rather than a measurement
string-slugify · G-21 on S/table-blind
transliterates Cyrillic to Latin, which is what three of the four measured libraries do and the single thing this contract exists to refuse. It is the only defect in this battery that the properties do not catch, and the reason is that it is not a broken fold: it answers a well-formed, lower-case, idempotent slug that retains a subsequence and carries no absorbable mark, so every property is satisfied, every profile keeps its class and every type assertion passes. One guard in the whole suite kills it, and it is a named case of block 4.4 - which is the measurement this lens exists to take, and the answer to what a table buys a contract that has no axioms to rest on
A probe asks whether a region of a contract can be reached at all, rather than whether a defect in it is caught. It never enters the score, because a probe that survives is that question answered no — and folding it in would measure the question instead of the contract.
26 probe cells, 22 caught. The other 4 are 2 equivalent, 2 outside what the contract specifies. Each one is below, with the sentence its own battery carries about it.
the edit cannot change an answer, so no test could catch it. Measured rather than assumed: each one carries what was compared against what.
string-slugify · F-11 on S/as-committed and S/table-blind
trims the text before folding - the shape an implementation reaches when a leading separator was once a defect and trim was the fix that stayed. It survives, and that is the finding rather than a gap: every character trim removes is already a boundary, and a boundary before the first run or after the last one already produces nothing, so the edit cannot change an answer. It is a probe rather than a defect because an equivalent mutant that counted against the score would measure the question instead of the contract
the edit changes something a caller could observe, and the contract deliberately makes no promise about it. What this marks is the edge of the specification, not a gap in the tests.
string-slugify · F-9 on S/as-committed and S/table-blind
never resets the base of the run at a boundary, so a mark that opens a run is absorbed by a letter from the previous one. It asks whether anything in this contract knows that a boundary ends a run for the purposes of the absorb step, and the answer is no: nothing reddens on either column. The region is reachable - a text of the shape e! followed by a combining acute answers differently under it - and neither the table nor any arbitrary draws that shape. What is missing is a case, and it is recorded here rather than added, because a probe that turns into a case stops measuring what the contract was
Publishing these is the same decision as publishing the survivors. A guard that never goes red is either out of a battery's reach by construction, or it marks a region no defect has been written for yet — and those are different things, so each battery says which of the two each of its silent guards is. The second list is a measurement of the battery, not of the guards: what it asks for is more defects.
array-group-by-spec · signature-is-the-declared-type, signature-infers-the-element-type, signature-infers-the-key-type, signature-passes-the-index, signature-accepts-a-readonly-array, signature-returns-owned-groups, signature-refuses-a-third-argument, signature-refuses-a-non-array, signature-refuses-a-missing-key-function, no-mutation-of-arguments, support-the-key-functions-reach-every-region, every-divergence-is-justified
over the implementation rather than over the contract's declarations. This battery injects into contract.ts and edge-cases.ts, and none of these reads either: the signature block compares the reference's own generic type against types written beside it, and the properties quantify over answers this battery does not change. The reference battery witnesses all of them - S-1 to S-8 on the first nine, M-01 to M-22 on the rest.
array-group-by-spec · array/group-by@1 specific properties
over the implementation rather than over the declarations, on the five properties of block 4.3. Each compares what the reference answered against what it was asked, with helpers local to properties.test.ts; nothing in contract.ts or edge-cases.ts decides their verdict.
array-group-by · every-case-is-addressed, every-case-is-grouped, every-case-is-justified, every-profile-has-samples, every-shape-is-named-and-described, universal-properties-answered, declares-a-statement-for-every-key-function-rule, declares-the-kinds-of-key-function-rule
over the contract's own declarations rather than over the implementation. This battery injects into reference.ts, so nothing it can do reaches a guard that reads the two tables, the profile list, the key-function rules or the universal-property declarations.
array-group-by · array/group-by@1 against Map.groupBy, array/group-by@1 against Object.groupBy
over the runtime rather than over the implementation. language.test.ts runs block 4.4 against Map.groupBy, and the four divergences block 4.1 publishes against Object.groupBy, neither of which a defect injected into reference.ts can touch. It is the measurement catalogueAdmission rests on, and it is silent here by construction rather than for want of a mutant.
array-group-by · signature-is-the-declared-type
the assertion this lens replaces. identity-blind reads expectTypeOf(groupBy).toEqualTypeOf<GroupBy>() as a check that the export is a function, so on that column the guard cannot fail whatever is injected - which is the point of the lens, and the difference between the two columns is what it measures. On as-committed it is red on all eight signature defects.
date-add-spec · signature-returns-a-date-or-null, p1-valid-date-or-absent, p2-the-neutral-duration, p3-milliseconds-shift-exactly, p4-elapsed-negation-cancels, p5-calendar-keeps-the-time-of-day, p6-the-day-never-grows, p7-failure-coupling, no-mutation-of-arguments
over the implementation rather than over the contract's declarations. This battery injects into contract.ts and edge-cases.ts, and these read neither: one compares the reference's own return type against a type written beside it, and the rest quantify over answers this battery does not change. The reference battery witnesses every one of them.
date-add-spec · support-the-zone-was-restored, support-the-restore-drives-both-branches
over the harness inside properties.test.ts rather than over the declarations. These two establish that the zone property puts the ambient zone back where it found it, and the restore they police is written in that file: no declaration decides their verdict. The reference battery cannot reach them either, for the mirror reason, so they are the two guards of this contract no battery in this repository can redden - which is stated here rather than left for a reader to notice.
date-add-spec · no-ambient-input-from-the-time-zone
reads ambientTimeZoneProbes, so this battery decides what it runs under - and cannot make it fail. The property compares this implementation's answers with each other, and this implementation is zone-independent whatever list it is given; a wrong list makes it vacuous, not red. DA-13 is that list, and the guard that catches it is the one requiring the zones to disagree, which is why the two exist as a pair.
date-add · signature-duration-fields-are-optional, every-case-is-addressed, every-case-is-grouped, names-a-case-for-every-reason, settles-each-call-once, every-case-is-justified, every-expected-instant-round-trips, every-profile-has-samples, universal-properties-answered, declares-an-application-order-over-every-field, declares-a-reason-for-every-static-analysis-requirement
over the contract's own declarations rather than over the implementation. This battery injects into reference.ts, so nothing it can do reaches a guard that reads the two tables, the profile list, the application order, the static analysis requirements or the Duration type. The last of those is the one that had to move: it compares Duration against Partial<Duration>, reads both sides out of contract.ts, and was listed as a region awaiting a signature mutant until S-12 to S-15 measured that no such mutant can exist here.
date-add · support-the-zones-take-effect, support-the-zones-disagree, support-the-zone-was-restored, support-the-restore-drives-both-branches
over the harness rather than over the implementation: these establish that the runtime honours process.env.TZ and that the zone property puts it back. No defect injected into reference.ts can change either answer, which is exactly why they are the support the zone property rests on rather than part of what it measures.
date-add · a-month-total-that-is-not-exact-described, an-elapsed-total-that-is-not-exact-described, a-declared-field-carrying-a-string-described, an-input-that-is-not-a-date-described, an-input-that-is-not-a-date-with-the-empty-duration-described
the described twins of the five refusals below, silent on this column and only on it. Blinded, the suite requires a refused call to have a description and no longer requires it to be the right one, so R-1 to R-4 - the only mutants that reddened these - stop being visible. That is the lens working rather than a gap, and those cells are part of the five-defect difference this battery reports between its two columns.
number-parse-spec · signature-accepts-a-string, signature-returns-a-number-or-null, p1-finite-or-absent, p4-failure-coupling
over the implementation rather than over the contract's declarations. This battery injects into contract.ts and edge-cases.ts, and these four read neither: two compare the reference's own type against a type written beside them, and two quantify over answers this battery does not change. They are the reference battery's to witness, and it does - S-9, S-10, P-03, P-04, P-07 and X-1 among them.
number-parse · every-case-is-addressed, every-case-is-grouped, settles-each-input-once, names-a-case-for-every-reason, every-case-is-justified, every-profile-has-samples, universal-properties-answered
over the contract's own declarations rather than over the implementation. This battery injects into reference.ts, so nothing it can do reaches a guard that reads the table, the profile list or the universal-property declarations.
packaging · the-archive-is-visibly-unpublished
it reads the repository's own package.json against THE_UNPUBLISHED_VERSION in packages/cli/local-source.ts, and a battery may edit only the folder under measurement
registry-storage · every-export-that-renders-no-contract-says-why
it reads reason literals written in address.test.ts, and this battery edits production sources only - so no edit it can make reaches them
registry-storage · the-decision-to-publish-moves-no-digest
both digests it compares are answered by a child process over a checkout of a commit, and this battery edits the working tree - which is the one thing neither process reads
registry-storage · a-sentence-the-catalogue-shares-is-a-whole-sentence-where-it-lands-number-parse, a-sentence-the-catalogue-shares-is-a-whole-sentence-where-it-lands-date-add, a-sentence-the-catalogue-shares-is-a-whole-sentence-where-it-lands-array-group-by, a-sentence-the-catalogue-shares-is-a-whole-sentence-where-it-lands-string-levenshtein, a-sentence-the-catalogue-shares-is-a-whole-sentence-where-it-lands-string-slugify
the seam it reads is composed in a contract folder, and this battery edits packages/registry/ only - measured, emptying the reason in serialise.ts removes the occurrence rather than misplacing it, and the whole suite stays green
site · the-sample-really-produces-the-arm-it-is-filed-under
it compares the samples of a test-local table against encode, and a battery injects only into the folder under measurement - so neither side of what it checks is editable from here
string-levenshtein-spec · signature-is-the-declared-type, signature-accepts-two-strings, signature-returns-a-number, signature-refuses-one-string, signature-refuses-options, p1-identity, p2-discernibility, p3-symmetry, p4-triangle-inequality, p5-bounds, p6-a-whole-non-negative-number, p7-one-edit-is-one, p8-shared-affixes-cost-nothing, determinism, no-ambient-input-from-history, support-the-pairs-are-one-edit-apart, support-the-texts-reach-every-region
over the implementation rather than over the contract's declarations. This battery injects into contract.ts and edge-cases.ts, and none of these reads either: the signature block compares the reference's own type against a type written beside it, and the properties quantify over answers this battery does not change. The reference battery witnesses every one of them - S-16 to S-19 on the first five, L-01 to L-20 on the rest.
string-levenshtein · every-case-is-addressed, every-case-is-grouped, settles-each-pair-once, every-case-is-justified, every-profile-has-samples, every-class-is-named-and-described, universal-properties-answered, declares-a-property-for-every-axiom, declares-a-statement-for-every-axiom, support-the-pairs-are-one-edit-apart, support-the-texts-reach-every-region
over the contract's own declarations rather than over the implementation. This battery injects into reference.ts, so nothing it can do reaches a guard that reads the table, the profile list, the axiom list, the universal-property declarations or the arbitraries.
string-levenshtein · signature-is-the-declared-type
the assertion this lens replaces. identity-blind reads expectTypeOf(levenshtein).toEqualTypeOf<Levenshtein>() as a check that the export is a function, so on that column the guard cannot fail whatever is injected - which is the point of the lens. On as-committed it is red on all four signature defects, and the difference between the two columns is the answer to the question array/group-by@1 could only ask of a generic signature: on a monomorphic one, does the identity assertion carry anything the directives beside it do not?
string-slugify-spec · p1-two-spellings-one-slug, p2-idempotence, p3-no-absorbable-mark, p5-discarded-characters-are-interchangeable, p6-a-letter-or-a-digit-answers, p7-a-slug-is-a-fixed-point, p8-one-separator-per-gap, determinism, no-ambient-input-from-history, support-the-stacks-reach-the-hidden-base, support-the-gaps-carry-a-sigma, support-the-texts-reach-every-region
over the implementation rather than over the contract's declarations. This battery injects into contract.ts and edge-cases.ts, and none of these reads either: the properties quantify over answers this battery does not change, and the arbitrary preconditions measure generators declared in their own file. The reference battery witnesses every one of them.
string-slugify · every-case-is-addressed, every-case-is-grouped, settles-each-text-once, every-case-is-justified, every-profile-has-samples, every-class-is-named-and-described, universal-properties-answered, declares-a-property-for-every-step, declares-a-statement-for-every-step, support-the-slugs-are-well-formed, support-the-stacks-reach-the-hidden-base, support-the-gaps-carry-a-sigma, support-the-texts-reach-every-region, the-texts-that-share-one-slug
over the contract's own declarations rather than over the implementation. This battery injects into reference.ts, so nothing it can do reaches a guard that reads the table, the profile list, the rule, the universal-property declarations or the arbitraries.
string-slugify · a-non-latin-script-is-kept, cyrillic-is-kept, arabic-is-kept, an-indic-mark-is-kept, a-non-latin-digit-is-a-digit, an-astral-letter-is-kept, a-latin-diacritic-is-removed, a-decomposed-diacritic-folds-alike, a-precomposed-diacritic-folds-alike, two-stacked-marks-are-removed, a-letter-with-no-decomposition-is-kept, a-ligature-letter-is-kept, a-stroked-letter-is-kept, a-mark-the-base-absorbs-is-dropped, a-mark-reaching-its-base-across-another, a-mark-with-no-base-to-absorb-it-is-kept, a-greek-tonos-is-removed, a-final-sigma-is-not-unified, a-written-final-sigma-is-kept, the-turkish-dotted-i-loses-its-dot, the-turkish-dotless-i-is-kept, a-fullwidth-letter-is-unified, a-typographic-ligature-is-unified, a-superscript-digit-is-a-digit, a-roman-numeral-is-letters, runs-of-spaces-become-one-separator, an-existing-slug-is-unchanged, a-doubled-separator-collapses, an-underscore-is-a-boundary, a-full-stop-is-a-boundary, an-apostrophe-is-a-boundary, an-ampersand-is-not-a-word, a-currency-sign-is-not-a-word, the-empty-string, nothing-retainable, an-emoji-is-removed, a-joined-emoji-sequence-is-removed, a-lone-surrogate-is-removed, a-lone-surrogate-inside-a-word, a-plus-is-not-a-letter, a-hash-is-not-a-letter
the assertions this lens replaces. table-blind reads every case guard of block 4.4 as a comparison of the answer against itself, so on that column not one of them can fail whatever is injected - which is the point of the lens. The guard that replays the ASCII divergence is blinded by the same lens and is not listed here, because it still reddens on G-19: that mutant makes every call return the whole history of the run, and the guard dies of a string too long to build rather than of an expectation. A blinding removes a verdict, not an execution.
array-group-by-spec · determinism, no-ambient-input-from-history
reachable from here only through outputsAreEqual, which lives in contract.ts and which this battery does not mutate. Both compare two answers with the contract's declared equality, so a mutant that broke that function would redden them - and a defect of the contract's own comparison is a fifth family, not one of the four written here. The reference battery witnesses both: M-21 and M-22.
array-group-by-spec · profile-one-group-per-element, profile-single-group, profile-few-large-groups, profile-many-small-groups, profile-string-keys, profile-empty
the six benchmark profiles AG-6 and AG-7 leave alone. Each publishes a claim about the shape of the grouping its samples produce, and one mutant per profile would repeat one sentence six times; AG-6 measures that an empty list is caught and AG-7 that a profile with no description is.
array-group-by-spec · numbers-by-parity, objects-by-a-field, the-empty-array, a-single-element, numeric-keys-keep-first-occurrence-order, a-group-keeps-input-order, nan-keys-form-one-group, a-negative-zero-key-is-stored-as-a-positive-zero, a-number-and-its-string-are-different-keys, a-boolean-and-its-string-are-different-keys, two-distinct-objects-are-two-keys, one-object-used-twice-is-one-key, symbols-are-keys, undefined-and-null-are-two-keys, the-key-proto, the-key-constructor, the-keys-tostring-and-hasownproperty, a-hole-in-a-sparse-array, an-explicit-undefined-element, a-key-function-is-never-asked-twice, a-key-function-that-writes-to-its-element, an-exception-propagates-unchanged
the cases of block 4.4 that AG-5, AG-8 and AG-9 do not touch, and the six inputs only an untyped caller can pass. Every one is reachable - AG-8 and AG-9 are the proof, on this contract where a case carries its own title and a mutant therefore reddens the guard it was written for - and each of the rest would need its own mutant to say the same sentence about a different row. What is missing is a mutant, not a case.
array-group-by-spec · numbers-by-parity-in-the-language, objects-by-a-field-in-the-language, the-empty-array-in-the-language, a-single-element-in-the-language, numeric-keys-keep-first-occurrence-order-in-the-language, a-group-keeps-input-order-in-the-language, nan-keys-form-one-group-in-the-language, a-negative-zero-key-is-stored-as-a-positive-zero-in-the-language, a-number-and-its-string-are-different-keys-in-the-language, a-boolean-and-its-string-are-different-keys-in-the-language, two-distinct-objects-are-two-keys-in-the-language, one-object-used-twice-is-one-key-in-the-language, symbols-are-keys-in-the-language, undefined-and-null-are-two-keys-in-the-language, the-key-proto-in-the-language, the-key-constructor-in-the-language, the-keys-tostring-and-hasownproperty-in-the-language, a-hole-in-a-sparse-array-in-the-language, an-explicit-undefined-element-in-the-language, a-key-function-is-never-asked-twice-in-the-language, a-key-function-that-writes-to-its-element-in-the-language, an-exception-propagates-unchanged-in-the-language, a-null-input-in-the-language-from-an-untyped-caller, an-undefined-input-in-the-language-from-an-untyped-caller, a-plain-object-in-the-language-from-an-untyped-caller, a-number-in-the-language-from-an-untyped-caller, a-set-in-the-language-from-an-untyped-caller, a-string-in-the-language-from-an-untyped-caller
block 4.4 replayed against Map.groupBy, minus the two twins AG-8 and AG-9 redden. The reference battery declares this whole suite out of its reach by construction, and that is true of it and not of this one: these guards read the table, so a defect injected into the table reaches them. Two of the thirty are probed, which is what establishes that the file replays this table; the other twenty-eight would each need a mutant to repeat it.
array-group-by-spec · a-number-and-its-string-are-different-keys-diverges-in-object-groupby, a-boolean-and-its-string-are-different-keys-diverges-in-object-groupby, two-distinct-objects-are-two-keys-diverges-in-object-groupby
the three divergences from Object.groupBy AG-8 does not reach. Like the language twins above they read block 4.4 by title, so a defect injected into the table reaches them - AG-8 is the proof, on the fourth. What they publish is the half of block 4.1 that says the object-shaped grouper disagrees, and each of the three would need its own mutant to say that about a different row.
array-group-by-spec · array/group-by@1 inputs only an untyped caller can pass
the six inputs only an untyped caller can pass. They are the runtime half of what the signature refuses at compile time, and no mutant here rewrites one - the same argument as the block 4.4 table above, and separated from it only because they are a second table.
array-group-by · a-null-input, an-undefined-input
no mutant answers a nullish input instead of refusing it. That is precisely what lodash does - measured, it returns zero groups for null - so the defect these two cases refuse is real and plausible, and this battery does not carry it. The three other untyped-caller cases are red on M-11, which reads the input by counting over length. Both cases publish a decision either way; what is missing is the mutant that violates it.
array-group-by · signature-refuses-a-third-argument, signature-refuses-a-missing-key-function
the two @ts-expect-error guards of block 4.2 that S-8 does not reach. S-8 widened the input and reddened the third; widening the key function to take a third argument, or making it optional, would reach these two, and neither mutant is written.
cli-install · a-refused-contract-answers-no-binding-and-an-empty-list-of-implementations, every-byte-the-registry-serves-arrives-unchanged, remove-decides-the-same-thing-against-the-emitted-tree
three guards of the emitted tree, each unreached for its own reason. A removal is out of reach here for the reason the region below gives for the rest of toopo remove. The byte comparison is unprobed by the data: response.text() in place of response.arrayBuffer() leaves this suite green, because every file this registry serves is valid UTF-8 and the round trip is the identity on this catalogue. And the refused contract is read off the emitted tree, where C-17 does not reach - it publishes it in the stand-in instead.
cli-install · a-command-that-takes-nothing-is-read-and-refuses-an-argument, a-project-holding-nothing-says-so-rather-than-printing-a-blank-screen, an-init-says-what-has-to-be-committed, remove-writes-only-when-it-is-asked-to, the-lockfile-standing-is-asked-and-not-predicted
toopo remove and toopo list, which cli-remove carries with twenty defects. This battery installs into a project that has nothing and never takes anything out of one, so the acceptance a removal asks for, an empty project, a query with no words and the line init prints are out of its reach - and the rest of that unit reddens on it.
cli-install · a-corpus-of-real-queries-ranks-the-right-contract-first, a-cut-summary-says-that-it-was-cut, a-miss-names-the-words-no-contract-carries, a-query-the-catalogue-cannot-answer-answers-nothing, a-query-with-no-words-answers-nothing, a-shortening-or-a-plural-is-answered-and-a-longer-word-is-not, a-word-carried-by-a-name-outranks-the-same-word-carried-by-an-alias, an-installable-contract-carries-no-refusal, every-declared-alias-finds-its-own-contract-first
toopo search, which is the third battery of this folder and shares nothing with either of the other two: it writes no file, reads no project, and touches neither the plan nor the lockfile. cli-search carries twenty-one defects over what a query matches, what it must not, the order and the screen the reader gets.
cli-install · a-commit-leaves-no-staged-file-behind, a-commit-writes-the-files-and-the-lockfile-together, a-count-is-read-off-the-lines-it-summarises, a-directory-where-a-file-goes-is-refused-by-name, a-file-where-a-folder-must-go-is-refused-with-nothing-staged, a-hunk-header-counts-the-lines-it-covers, a-line-only-the-first-text-has-is-a-minus, a-line-only-the-second-text-has-is-a-plus, a-missing-final-newline-is-said-rather-than-lost, a-refusal-leaves-no-staged-file-behind, a-refused-commit-does-not-touch-the-file-it-would-replace, a-removal-leaves-a-folder-that-still-holds-something, a-removal-tidies-the-folder-it-emptied, each-side-says-for-itself-that-it-has-no-final-newline, only-the-lines-around-a-change-are-shown, the-diff-op-codes-are-what-node-answers, two-changes-far-apart-are-two-hunks, two-identical-texts-have-nothing-to-show, update-writes-only-when-it-is-asked-to
the diff and the two-phase write, which arrived with toopo update. An install renders no diff at all, and it reaches write.ts only through the one call every guard here already makes succeed - so a defect in either is out of reach of an edit to the plan, the rewrite, the port or the install path. cli-update carries seventeen defects over exactly these, including the one that matters most: node's own documentation reads its diff op codes backwards, and every guard about shape passes on an inverted diff.
cli-remove · a-refused-contract-answers-no-binding-and-an-empty-list-of-implementations, add-decides-the-same-thing-against-the-emitted-tree, every-byte-the-registry-serves-arrives-unchanged, remove-decides-the-same-thing-against-the-emitted-tree, search-decides-the-same-thing-against-the-emitted-tree, update-decides-the-same-thing-against-the-emitted-tree
the acceptance of the emitted tree. The two sides of each comparison share every decision and differ in exactly one thing - which registry they read: the installer stand-in on one side, the emitted tree on the other. So a defect in a decision changes both sides identically and the comparison is green on it, and what separates them is a defect in local-source.ts, which cli-install carries with C-17, C-18, C-22 and C-42. This battery injects into neither that stand-in nor the emission it is compared against.
cli-remove · a-blob-that-is-not-what-its-address-names-is-refused, a-command-with-no-flag-is-read, a-commit-leaves-no-staged-file-behind, a-commit-writes-the-files-and-the-lockfile-together, a-configuration-round-trips-through-the-file, a-conflicted-feature-is-held-back-whole, a-contract-the-catalogue-refused-is-not-installable, a-corpus-of-real-queries-ranks-the-right-contract-first, a-count-is-read-off-the-lines-it-summarises, a-cut-summary-says-that-it-was-cut, a-dependency-that-left-the-closure-is-removed, a-destination-already-holding-our-bytes-is-a-move-that-happened, a-destination-holding-something-else-refuses-the-whole-move, a-directory-that-does-not-travel-is-refused, a-directory-where-a-file-goes-is-refused-by-name, a-feature-pulled-in-and-then-asked-for-becomes-a-root, a-feature-that-imports-a-held-back-one-is-held-back-too, a-feature-with-no-dependency-lands-exactly-as-it-was-served, a-field-this-toopo-does-not-honour-is-refused, a-file-already-equal-to-what-we-would-write-is-not-a-conflict, a-file-already-holding-our-bytes-is-claimed-and-not-rewritten, a-file-changed-on-both-sides-is-a-conflict, a-file-that-is-not-json-is-refused-by-name, a-file-that-was-deleted-is-put-back, a-file-the-lockfile-claims-and-the-disk-has-not-got-moves-nothing, a-file-the-registry-did-not-change-keeps-your-version, a-file-the-user-edited-moves-with-the-edit-in-it, a-file-toopo-did-not-write-is-never-overwritten-by-an-update, a-file-we-did-not-write-is-never-overwritten, a-file-where-a-folder-must-go-is-refused-with-nothing-staged, a-flag-and-its-value-are-read, a-flag-with-no-value-is-refused, a-folder-change-names-every-file-that-moved, a-folder-change-says-the-imports-are-the-users-to-change, a-folder-that-could-not-be-taken-is-named, a-folder-that-is-not-moving-and-a-project-with-nothing-to-move-both-move-nothing, a-held-back-feature-keeps-its-lockfile-entry-exactly, a-held-back-feature-says-so-before-it-says-anything-else, a-hunk-header-counts-the-lines-it-covers, a-kept-file-keeps-the-digest-we-wrote-and-not-the-one-on-disk, a-line-only-the-first-text-has-is-a-minus, a-line-only-the-second-text-has-is-a-plus, a-line-says-what-was-done-to-that-file, a-lockfile-from-before-asked-for-is-refused-with-the-command-to-run, a-lockfile-from-before-the-revision-is-refused-with-the-command-to-run, a-lockfile-with-no-configuration-is-refused-with-the-folder-to-name, a-lockfile-with-no-root-has-nowhere-to-start, a-miss-names-the-words-no-contract-carries, a-missing-final-newline-is-said-rather-than-lost, a-name-the-catalogue-does-not-hold-is-refused, a-path-with-a-space-installs-normally, a-project-is-removed-while-another-process-still-holds-it, a-project-that-was-never-initialised-answers-nothing, a-project-with-no-package-json-installs-normally, a-project-with-nothing-in-it-is-configured-rather-than-refused, a-query-the-catalogue-cannot-answer-answers-nothing, a-query-with-no-words-answers-nothing, a-refusal-leaves-no-staged-file-behind, a-refusal-leaves-the-project-exactly-as-it-was, a-refusal-says-nothing-was-written-before-it-says-why, a-refused-commit-does-not-touch-the-file-it-would-replace, a-refused-contract-is-found-with-the-reason-it-was-refused, a-refused-contract-is-in-the-index-and-is-not-installable, a-refused-contract-is-offered-no-install-line, a-refused-folder-change-leaves-the-configuration-naming-the-old-folder, a-registry-that-does-not-answer-is-a-sentence-a-person-can-read, a-relocation-leaves-the-lockfile-exactly-as-it-was, a-removal-leaves-a-folder-that-still-holds-something, a-removal-tidies-the-folder-it-emptied, a-renamed-entry-file-is-repointed, a-repeated-flag-and-a-stray-word-are-refused, a-root-stays-one-when-something-else-pulls-it-in, a-shared-blob-is-repointed-across-features, a-shared-file-is-written-once-and-still-appears-in-the-plan, a-shortening-or-a-plural-is-answered-and-a-longer-word-is-not, a-size-is-read-the-way-a-file-manager-shows-it, a-snapshot-that-is-not-what-its-digest-names-is-refused, a-source-carrying-more-than-the-port-declares-is-refused, a-status-that-is-neither-the-answer-nor-a-404-is-an-error-and-not-an-absence, a-switch-takes-no-value-and-swallows-nothing, a-version-that-moved-with-no-byte-changing-is-recorded-anyway, a-version-this-toopo-does-not-write-is-refused, a-word-carried-by-a-name-outranks-the-same-word-carried-by-an-alias, add-with-a-lockfile-and-no-configuration-writes-nothing, add-with-no-configuration-writes-one-and-says-so, add-without-a-contract-is-refused, an-edge-the-registry-does-not-hold-is-refused, an-edge-whose-digest-names-another-artefact-is-refused, an-edited-file-is-never-replaced, an-entry-file-is-named-after-its-feature, an-entry-file-is-never-deduplicated, an-ignored-folder-is-told-about-instead-of-being-told-to-commit-it, an-import-line-is-printed-ready-to-copy, an-import-line-names-the-diagnostic-beside-the-answer, an-import-of-a-file-this-install-does-not-carry-is-refused, an-import-of-something-outside-the-registry-is-refused, an-install-over-http-plans-exactly-what-the-same-registry-plans-in-process, an-install-records-the-revision-the-registry-answered-from, an-installable-contract-carries-no-refusal, an-installation-is-the-same-with-git-and-without, an-installed-file-imports-what-was-installed, an-unchanged-specifier-is-left-alone, an-unknown-command-and-an-unknown-flag-are-refused, an-unreadable-lockfile-stops-the-install, an-update-keeps-the-implementation-the-lockfile-names, an-update-writes-the-bytes-the-registry-now-serves, bytes-served-at-the-address-that-was-asked-for-are-refused-when-they-are-not-that, each-of-the-five-installs-one-file-named-after-itself, each-side-says-for-itself-that-it-has-no-final-newline, every-breakage-is-classified, every-clean-refusal-resolves-to-the-guard-it-names, every-declared-alias-finds-its-own-contract-first, every-feature-the-install-writes-gets-its-own-lockfile-entry, every-installed-file-moves-and-not-one-byte-changes, every-method-of-the-port-answers-an-endpoint-that-exists, every-shape-of-import-is-repointed-and-not-only-the-obvious-one, git-answers-whether-the-folder-is-ignored-and-says-nothing-when-it-cannot, nothing-at-all-is-refused, nothing-but-the-local-adapter-reaches-the-serialisation, nothing-is-removed-while-a-feature-is-held-back, only-the-feature-that-was-asked-for-is-a-root, only-the-lines-around-a-change-are-shown, re-adding-what-you-asked-for-changes-nothing-and-claims-nothing, reinstalling-what-is-already-there-changes-nothing, remove-without-a-contract-is-refused, the-catalogue-lists-every-contract-and-marks-the-one-it-refuses, the-cost-is-stated-before-the-files, the-cost-is-the-files-the-bytes-and-the-depth, the-diff-op-codes-are-what-node-answers, the-folder-that-was-left-goes-when-it-is-empty, the-folder-that-was-left-stays-when-it-holds-something-else, the-graph-lands-as-a-tree-of-features, the-import-line-follows-the-configured-directory, the-local-source-binds-a-visibly-unpublished-version, the-lockfile-holds-what-was-served-and-what-was-written, the-plan-is-in-the-resolutions-order, the-port-answers-every-need-behind-it-and-nothing-else, the-proposed-directory-follows-the-shape-of-the-project, the-same-decision-against-a-warm-cache-and-no-network-is-the-same-plan, the-three-spellings-of-one-file-all-resolve, the-updated-lockfile-holds-what-was-served-and-what-was-written, the-users-tsconfig-is-never-read, the-walk-costs-one-round-trip-per-level-and-fetches-each-frontier-at-once, the-ways-out-are-offered-only-where-the-reader-put-something, two-changes-far-apart-are-two-hunks, two-different-files-on-one-destination-are-refused, two-edges-naming-one-address-at-two-digests-are-refused, two-identical-texts-have-nothing-to-show, two-named-answers-from-two-revisions-refuse-the-install, two-versions-of-one-feature-are-refused, two-versions-of-one-feature-are-refused-before-anything-is-written, update-writes-only-when-it-is-asked-to
everything that is not a removal. Installing, updating, diffing, searching, the argument grammar, the two-phase write and the folder moving - a removal reaches the write and the reconciliation and nothing else of it, and the three batteries next door carry ninety-odd defects over exactly these. The folder change is the whole of that unit rather than part of it: this battery injects into the removal, the reconciliation and the listing, and a relocation goes through none of the three, so all thirteen of its guards are out of reach here and every one is load-bearing on cli-install. The registry over HTTP is in the same list for the same reason: a removal is decided against a held view, and nothing it can break reaches http-source.ts or fixpoint.ts.
cli-search · a-refused-contract-answers-no-binding-and-an-empty-list-of-implementations, add-decides-the-same-thing-against-the-emitted-tree, every-byte-the-registry-serves-arrives-unchanged, remove-decides-the-same-thing-against-the-emitted-tree, search-decides-the-same-thing-against-the-emitted-tree, update-decides-the-same-thing-against-the-emitted-tree
the acceptance of the emitted tree. The two sides of each comparison share every decision and differ in exactly one thing - which registry they read: the installer stand-in on one side, the emitted tree on the other. So a defect in a decision changes both sides identically and the comparison is green on it, and what separates them is a defect in local-source.ts, which cli-install carries with C-17, C-18, C-22 and C-42. This battery injects into neither that stand-in nor the emission it is compared against.
cli-search · a-blob-that-is-not-what-its-address-names-is-refused, a-command-that-takes-nothing-is-read-and-refuses-an-argument, a-command-with-no-flag-is-read, a-commit-leaves-no-staged-file-behind, a-commit-writes-the-files-and-the-lockfile-together, a-configuration-round-trips-through-the-file, a-conflicted-feature-is-held-back-whole, a-contract-the-catalogue-refused-is-not-installable, a-copy-deduplicated-away-is-taken-with-the-entry-that-stops-claiming-it, a-count-is-read-off-the-lines-it-summarises, a-deduplicated-copy-the-user-edited-is-kept-rather-than-taken, a-dependency-that-left-the-closure-is-removed, a-destination-already-holding-our-bytes-is-a-move-that-happened, a-destination-holding-something-else-refuses-the-whole-move, a-directory-that-does-not-travel-is-refused, a-directory-where-a-file-goes-is-refused-by-name, a-feature-another-root-still-imports-stays-and-stops-being-a-root, a-feature-nothing-else-holds-leaves-with-everything-it-pulled-in, a-feature-pulled-in-and-then-asked-for-becomes-a-root, a-feature-that-imports-a-held-back-one-is-held-back-too, a-feature-that-was-never-asked-for-is-refused-with-what-imports-it, a-feature-with-no-dependency-lands-exactly-as-it-was-served, a-field-this-toopo-does-not-honour-is-refused, a-file-already-equal-to-what-we-would-write-is-not-a-conflict, a-file-already-holding-our-bytes-is-claimed-and-not-rewritten, a-file-changed-on-both-sides-is-a-conflict, a-file-that-is-gone-is-named-with-what-puts-it-back, a-file-that-is-not-json-is-refused-by-name, a-file-that-was-deleted-is-put-back, a-file-the-lockfile-claims-and-the-disk-has-not-got-moves-nothing, a-file-the-registry-did-not-change-keeps-your-version, a-file-the-user-edited-is-not-deleted-by-a-removal, a-file-the-user-edited-moves-with-the-edit-in-it, a-file-toopo-did-not-write-is-never-overwritten-by-an-update, a-file-we-did-not-write-is-never-overwritten, a-file-where-a-folder-must-go-is-refused-with-nothing-staged, a-flag-and-its-value-are-read, a-flag-with-no-value-is-refused, a-folder-change-names-every-file-that-moved, a-folder-change-says-the-imports-are-the-users-to-change, a-folder-that-could-not-be-taken-is-named, a-folder-that-is-not-moving-and-a-project-with-nothing-to-move-both-move-nothing, a-held-back-feature-keeps-its-lockfile-entry-exactly, a-held-back-feature-says-so-before-it-says-anything-else, a-held-back-removal-leaves-the-lockfile-exactly-as-it-was, a-hunk-header-counts-the-lines-it-covers, a-kept-file-keeps-the-digest-we-wrote-and-not-the-one-on-disk, a-line-only-the-first-text-has-is-a-minus, a-line-only-the-second-text-has-is-a-plus, a-line-says-what-was-done-to-that-file, a-lockfile-from-before-asked-for-is-refused-with-the-command-to-run, a-lockfile-from-before-the-revision-is-refused-with-the-command-to-run, a-lockfile-with-no-configuration-is-refused-with-the-folder-to-name, a-lockfile-with-no-root-has-nowhere-to-start, a-missing-final-newline-is-said-rather-than-lost, a-name-the-catalogue-does-not-hold-is-refused, a-name-the-project-does-not-hold-is-refused-with-what-it-does, a-path-with-a-space-installs-normally, a-project-holding-nothing-says-so-rather-than-printing-a-blank-screen, a-project-is-removed-while-another-process-still-holds-it, a-project-that-was-never-initialised-answers-nothing, a-project-with-no-package-json-installs-normally, a-project-with-nothing-in-it-is-configured-rather-than-refused, a-refusal-leaves-no-staged-file-behind, a-refusal-leaves-the-project-exactly-as-it-was, a-refusal-says-nothing-was-written-before-it-says-why, a-refused-commit-does-not-touch-the-file-it-would-replace, a-refused-contract-is-in-the-index-and-is-not-installable, a-refused-folder-change-leaves-the-configuration-naming-the-old-folder, a-registry-that-does-not-answer-is-a-sentence-a-person-can-read, a-registry-that-has-not-moved-changes-nothing, a-relocation-leaves-the-lockfile-exactly-as-it-was, a-removal-leaves-a-folder-that-still-holds-something, a-removal-shows-and-writes-nothing-until-it-is-applied, a-removal-that-cannot-reach-the-registry-refuses-and-explains, a-removal-tidies-the-folder-it-emptied, a-renamed-entry-file-is-repointed, a-repeated-flag-and-a-stray-word-are-refused, a-root-stays-one-when-something-else-pulls-it-in, a-shared-blob-is-repointed-across-features, a-shared-file-is-written-once-and-still-appears-in-the-plan, a-shared-file-moves-into-the-folder-of-a-carrier-that-stays, a-size-is-read-the-way-a-file-manager-shows-it, a-snapshot-that-is-not-what-its-digest-names-is-refused, a-source-carrying-more-than-the-port-declares-is-refused, a-status-that-is-neither-the-answer-nor-a-404-is-an-error-and-not-an-absence, a-switch-takes-no-value-and-swallows-nothing, a-version-that-moved-with-no-byte-changing-is-recorded-anyway, a-version-this-toopo-does-not-write-is-refused, add-with-a-lockfile-and-no-configuration-writes-nothing, add-with-no-configuration-writes-one-and-says-so, add-without-a-contract-is-refused, an-edge-the-registry-does-not-hold-is-refused, an-edge-whose-digest-names-another-artefact-is-refused, an-edit-that-keeps-a-leaving-feature-keeps-what-it-imports-too, an-edited-file-is-never-replaced, an-entry-file-is-named-after-its-feature, an-entry-file-is-never-deduplicated, an-ignored-folder-is-told-about-instead-of-being-told-to-commit-it, an-import-line-is-printed-ready-to-copy, an-import-line-names-the-diagnostic-beside-the-answer, an-import-of-a-file-this-install-does-not-carry-is-refused, an-import-of-something-outside-the-registry-is-refused, an-init-says-what-has-to-be-committed, an-install-over-http-plans-exactly-what-the-same-registry-plans-in-process, an-install-records-the-revision-the-registry-answered-from, an-installation-is-the-same-with-git-and-without, an-installed-file-imports-what-was-installed, an-unchanged-specifier-is-left-alone, an-unknown-command-and-an-unknown-flag-are-refused, an-unreadable-lockfile-stops-the-install, an-update-keeps-the-implementation-the-lockfile-names, an-update-writes-the-bytes-the-registry-now-serves, applying-an-update-twice-changes-nothing-the-second-time, bytes-served-at-the-address-that-was-asked-for-are-refused-when-they-are-not-that, each-of-the-five-installs-one-file-named-after-itself, each-side-says-for-itself-that-it-has-no-final-newline, every-breakage-is-classified, every-clean-refusal-resolves-to-the-guard-it-names, every-feature-the-install-writes-gets-its-own-lockfile-entry, every-file-missing-at-once-says-the-folder-is-not-committed, every-installed-feature-is-named-with-whether-it-was-asked-for, every-installed-file-moves-and-not-one-byte-changes, every-method-of-the-port-answers-an-endpoint-that-exists, every-shape-of-import-is-repointed-and-not-only-the-obvious-one, git-answers-whether-the-folder-is-ignored-and-says-nothing-when-it-cannot, nothing-at-all-is-refused, nothing-but-the-local-adapter-reaches-the-serialisation, nothing-is-removed-while-a-feature-is-held-back, nothing-to-do-is-said-only-when-the-lockfile-does-not-move, one-file-missing-is-not-a-folder-nobody-committed, only-the-feature-that-was-asked-for-is-a-root, only-the-lines-around-a-change-are-shown, only-what-the-removed-feature-alone-pulled-in-goes-with-it, re-adding-what-you-asked-for-changes-nothing-and-claims-nothing, reinstalling-what-is-already-there-changes-nothing, remove-without-a-contract-is-refused, remove-writes-only-when-it-is-asked-to, taking-out-the-last-root-asks-the-registry-nothing, the-commands-that-reach-the-registry-are-these-and-no-others, the-cost-is-stated-before-the-files, the-cost-is-the-files-the-bytes-and-the-depth, the-diff-op-codes-are-what-node-answers, the-features-that-stay-are-planned-at-the-version-the-lockfile-records, the-folder-that-was-left-goes-when-it-is-empty, the-folder-that-was-left-stays-when-it-holds-something-else, the-graph-lands-as-a-tree-of-features, the-import-line-follows-the-configured-directory, the-listing-hashes-the-disk-rather-than-reading-what-we-recorded, the-local-source-binds-a-visibly-unpublished-version, the-lockfile-holds-what-was-served-and-what-was-written, the-lockfile-standing-is-asked-and-not-predicted, the-plan-is-in-the-resolutions-order, the-port-answers-every-need-behind-it-and-nothing-else, the-proposed-directory-follows-the-shape-of-the-project, the-same-decision-against-a-warm-cache-and-no-network-is-the-same-plan, the-three-spellings-of-one-file-all-resolve, the-updated-lockfile-holds-what-was-served-and-what-was-written, the-users-tsconfig-is-never-read, the-walk-costs-one-round-trip-per-level-and-fetches-each-frontier-at-once, the-ways-out-are-offered-only-where-the-reader-put-something, two-changes-far-apart-are-two-hunks, two-different-files-on-one-destination-are-refused, two-edges-naming-one-address-at-two-digests-are-refused, two-identical-texts-have-nothing-to-show, two-named-answers-from-two-revisions-refuse-the-install, two-versions-of-one-feature-are-refused, two-versions-of-one-feature-are-refused-before-anything-is-written, update-writes-only-when-it-is-asked-to
everything that touches a project. Installing, updating, diffing, staging, renaming, moving the configured folder, the lockfile and what a plan does with a shared file - a query reaches none of it, and the three batteries next door carry ninety-odd defects over exactly these. search is the one command that reads no project, so the division needs no argument beyond that sentence. The registry over HTTP is in the list on a second one: a query does go through the fixpoint, but every defect this battery injects is in search.ts and in the screen it renders, so none of them reaches the loop or the transport under it.
cli-update · a-refused-contract-answers-no-binding-and-an-empty-list-of-implementations, add-decides-the-same-thing-against-the-emitted-tree, every-byte-the-registry-serves-arrives-unchanged, search-decides-the-same-thing-against-the-emitted-tree
the acceptance of the emitted tree. The two sides of each comparison share every decision and differ in exactly one thing - which registry they read: the installer stand-in on one side, the emitted tree on the other. So a defect in a decision changes both sides identically and the comparison is green on it, and what separates them is a defect in local-source.ts, which cli-install carries with C-17, C-18, C-22 and C-42. This battery injects into neither that stand-in nor the emission it is compared against.
cli-update · a-registry-that-does-not-answer-is-a-sentence-a-person-can-read, a-status-that-is-neither-the-answer-nor-a-404-is-an-error-and-not-an-absence, an-install-over-http-plans-exactly-what-the-same-registry-plans-in-process, bytes-served-at-the-address-that-was-asked-for-are-refused-when-they-are-not-that, the-same-decision-against-a-warm-cache-and-no-network-is-the-same-plan, the-walk-costs-one-round-trip-per-level-and-fetches-each-frontier-at-once, two-named-answers-from-two-revisions-refuse-the-install
the port over HTTP, which cli-install carries with C-67, C-68, C-69 and C-72. Nothing this battery injects into reaches http-source.ts or fixpoint.ts: an update is decided against a held view, and how those answers arrived is settled a floor below anything it can break. The revisions two named answers agree on is in the same list on a narrower reading: an update compares them in reconcile.ts, which this battery does inject into, but the refusal itself is oneRevisionBehind in resolve.ts and cli-install carries it with C-70.
cli-update · a-corpus-of-real-queries-ranks-the-right-contract-first, a-cut-summary-says-that-it-was-cut, a-miss-names-the-words-no-contract-carries, a-query-the-catalogue-cannot-answer-answers-nothing, a-query-with-no-words-answers-nothing, a-refused-contract-is-found-with-the-reason-it-was-refused, a-refused-contract-is-offered-no-install-line, a-shortening-or-a-plural-is-answered-and-a-longer-word-is-not, a-word-carried-by-a-name-outranks-the-same-word-carried-by-an-alias, an-installable-contract-carries-no-refusal, every-declared-alias-finds-its-own-contract-first, the-catalogue-lists-every-contract-and-marks-the-one-it-refuses
toopo search, which is the third battery of this folder and shares nothing with either of the other two: it writes no file, reads no project, and touches neither the plan nor the lockfile. cli-search carries twenty-one defects over what a query matches, what it must not, the order and the screen the reader gets.
cli-update · a-project-holding-nothing-says-so-rather-than-printing-a-blank-screen, a-command-that-takes-nothing-is-read-and-refuses-an-argument, an-init-says-what-has-to-be-committed, the-lockfile-standing-is-asked-and-not-predicted, remove-without-a-contract-is-refused, remove-writes-only-when-it-is-asked-to
toopo remove and toopo list, which cli-remove carries with twenty defects. Only the ones below are out of reach here: the rest of that unit reddens on this battery, because a removal is a reconciliation with one feature demoted and this is the battery over the reconciliation.
cli-update · a-folder-change-names-every-file-that-moved, a-folder-change-says-the-imports-are-the-users-to-change, a-folder-that-could-not-be-taken-is-named
what toopo init says when it moves a folder, which cli-install carries with three defects. This battery never renders that screen: an update changes no configuration, so the relocation half of renderInit is out of its reach however the arithmetic underneath is broken - and the arithmetic underneath does redden here, on ten of the same unit's guards.
cli-update · a-command-with-no-flag-is-read, a-configuration-round-trips-through-the-file, a-directory-that-does-not-travel-is-refused, a-field-this-toopo-does-not-honour-is-refused, a-file-that-is-not-json-is-refused-by-name, a-flag-and-its-value-are-read, a-flag-with-no-value-is-refused, a-project-that-was-never-initialised-answers-nothing, a-lockfile-with-no-configuration-is-refused-with-the-folder-to-name, a-project-with-nothing-in-it-is-configured-rather-than-refused, a-repeated-flag-and-a-stray-word-are-refused, a-version-this-toopo-does-not-write-is-refused, add-without-a-contract-is-refused, an-unknown-command-and-an-unknown-flag-are-refused, nothing-at-all-is-refused, the-proposed-directory-follows-the-shape-of-the-project
the argument grammar and the configuration file. Nothing in this battery reads what the user typed or what toopo.json holds - it starts from a request already parsed - and cli-install carries twelve defects over exactly these. The two guards this unit *added* to the grammar are not here: --apply is this command's own acceptance, so U-34 probes it.
cli-update · a-blob-that-is-not-what-its-address-names-is-refused, a-contract-the-catalogue-refused-is-not-installable, a-feature-with-no-dependency-lands-exactly-as-it-was-served, a-file-we-did-not-write-is-never-overwritten, a-line-says-what-was-done-to-that-file, a-name-the-catalogue-does-not-hold-is-refused, a-project-is-removed-while-another-process-still-holds-it, a-refusal-leaves-the-project-exactly-as-it-was, a-refusal-says-nothing-was-written-before-it-says-why, a-refused-contract-is-in-the-index-and-is-not-installable, a-renamed-entry-file-is-repointed, a-shared-blob-is-repointed-across-features, a-shared-file-is-written-once-and-still-appears-in-the-plan, a-size-is-read-the-way-a-file-manager-shows-it, a-snapshot-that-is-not-what-its-digest-names-is-refused, a-source-carrying-more-than-the-port-declares-is-refused, git-answers-whether-the-folder-is-ignored-and-says-nothing-when-it-cannot, an-edge-the-registry-does-not-hold-is-refused, an-edge-whose-digest-names-another-artefact-is-refused, an-entry-file-is-named-after-its-feature, an-entry-file-is-never-deduplicated, an-import-of-a-file-this-install-does-not-carry-is-refused, an-import-of-something-outside-the-registry-is-refused, an-unchanged-specifier-is-left-alone, an-unreadable-lockfile-stops-the-install, every-breakage-is-classified, every-clean-refusal-resolves-to-the-guard-it-names, every-method-of-the-port-answers-an-endpoint-that-exists, every-shape-of-import-is-repointed-and-not-only-the-obvious-one, nothing-but-the-local-adapter-reaches-the-serialisation, the-cost-is-stated-before-the-files, the-local-source-binds-a-visibly-unpublished-version, the-plan-is-in-the-resolutions-order, the-port-answers-every-need-behind-it-and-nothing-else, the-three-spellings-of-one-file-all-resolve, two-different-files-on-one-destination-are-refused, two-edges-naming-one-address-at-two-digests-are-refused, two-versions-of-one-feature-are-refused, two-versions-of-one-feature-are-refused-before-anything-is-written
the install path: where a file lands, what its imports point at afterwards, what is checked on arrival, what the port may ask for, and the report an install prints. An update reuses every one of those and perturbs none of them - it starts from a plan and asks what is on disk - so a defect in any of them is measured by cli-install, which is where the thirty defects aimed at them live.
date-add-spec · determinism, no-ambient-input-from-history
reachable from here only through outputsAreEqual, which lives in contract.ts and which this battery does not mutate. Both compare two answers with the contract's declared equality, so a mutant that broke that function would redden them - and a defect of the contract's own comparison is a fifth family, not one of the four written here. The reference battery witnesses both: D-18 and D-22.
date-add-spec · profile-calendar-only, profile-clamping, profile-every-field, profile-rejected-inputs, profile-elapsed-time-only
the four benchmark profiles DA-9 leaves alone. Each publishes a claim about what its samples do, and one mutant per profile would repeat one sentence five times.
date-add-spec · date/add@1 named edge cases, described, date/add@1 edge cases outside the declared type, date/add@1 edge cases outside the declared type, described, an-ordinary-day, minutes-carry-into-hours, the-epoch-is-not-a-boundary, clamp-in-a-common-year, clamp-into-a-thirty-day-month, clamp-going-backwards, the-clamp-does-not-round-trip, the-clamp-keeps-the-time-of-day, a-leap-day-plus-one-year, a-leap-day-plus-four-years, the-century-rule, a-two-digit-year, year-zero, two-months-aggregated, years-and-months-are-one-total, weeks-and-days-are-one-total, a-week-never-clamps, calendar-before-elapsed-hours, calendar-before-elapsed-days, a-negative-field-subtracts, fields-of-opposite-sign, the-empty-duration, a-negative-zero-field, a-field-set-to-undefined, a-fractional-month, half-a-day, a-field-that-is-not-a-number, an-infinite-field, a-field-past-the-safe-range, two-fields-whose-total-cancels, a-month-total-that-is-not-exact, an-elapsed-total-that-is-not-exact, an-input-that-is-not-a-date, an-input-that-is-not-a-date-with-the-empty-duration, the-last-representable-instant, one-millisecond-past-the-end-of-the-range, one-millisecond-before-the-start-of-the-range, an-intermediate-step-outside-the-range
the cases of block 4.4 no mutant here rewrites, and this list is what the case identifier bought. The same declaration used to name all four suites whole, on the grounds that the silence was the instrument's: DA-7 did redden a guard in there, under a title the unmutated contract does not contain, so attribution could not see it and all eighty-six read as silent. They are now addressed by name, DA-7 reddens the case it was written for, and what is left is a measurement of this battery. The three whole suites are whole for reasons of their own: no mutant here changes a reason, DA-6 rewrites an expected instant into a form that still parses to the same one - which is exactly why the round-trip guard beside it exists - and nothing rewrites the untyped table at all.
date-add · a-month-total-that-is-not-exact, an-elapsed-total-that-is-not-exact, a-declared-field-carrying-a-string, an-input-that-is-not-a-date, an-input-that-is-not-a-date-with-the-empty-duration
what is left of the refusal region on the value channel, and the list shrank by half when D-22 arrived. Ten of these cases were unprobed: no mutant made the function *accept* a duration it must refuse, because D-08 weakens the field guard and the total guard catches every one of them behind it. D-22 memoises by the number of duration fields, so a one-field refusal now collects whatever the previous one-field call answered, and the five one-field cases went red - measured, and the battery refused the stale declaration rather than letting it stand. The five below carry no field, two fields, or a field whose type is wrong, so the collision never reaches them. Every one publishes a decision a caller reads whether or not a mutant violates it; what is missing is still a mutant, not a case.
fixture · doubles-zero
zero doubled and zero returned unchanged are the same value, so neither mutant here reaches it. It is reachable - a defect on the constant term reddens it, and instrument.test.ts writes exactly that mutant to measure what happens to this declaration when one arrives - and it is deliberately left unreached, because the meta-tests need a declared silence to measure the declaration machinery on.
number-parse-spec · p2-whitespace-insensitive, p3-right-inverse-of-string, determinism, no-ambient-input-from-history
reachable from here only through outputsAreEqual, which lives in contract.ts and which this battery does not mutate. All four compare two answers with the contract's declared equality, so a mutant that broke that function would redden them - and a defect of the contract's own comparison is a fifth family, not one of the four written here. The reference battery witnesses every one of them.
number-parse-spec · signature-is-the-declared-type
the identity assertion of block 4.2. It is reachable from this side - rewriting ParseNumber in contract.ts reddens it - and the mutant is not written, because S-9 and S-10 of the reference battery already redden this guard from the implementation side and a declaration mutant would be the same failure read from the mirror.
number-parse-spec · profile-small-integers, profile-decimals-and-exponents, profile-whitespace-padded, profile-long-inputs
the four benchmark profiles NP-7 and NP-9 leave alone. Each publishes a claim about what its samples do, and one mutant per profile would repeat one sentence five times; NP-7 measures that the claim is executed and NP-9 that an empty list is caught, which is what block 4.5 has to answer for here.
number-parse-spec · number/parse@1 named edge cases, described, ordinary-integer, ordinary-negative-decimal, surrounding-whitespace, tabs-and-newlines, leading-byte-order-mark, whitespace-inside-the-number, leading-plus-sign, sign-detached-from-its-digits, repeated-sign, negative-zero, leading-zeros, bare-fraction, trailing-decimal-point, lone-decimal-point, two-decimal-points, exponent, exponent-uppercase-and-signed, negative-exponent, exponent-with-no-digits, the-empty-string, a-blank-string, the-word-nan, the-word-infinity, the-word-negative-infinity, hexadecimal, octal, binary, comma-as-a-decimal-separator, comma-grouping, underscore-grouping, comma-grouping-with-a-decimal-point, apostrophe-grouping, no-break-space-grouping, narrow-no-break-space-grouping, grouping-that-is-not-in-threes, full-stop-grouping-with-a-comma-decimal, an-ordinary-space-between-digits, a-typographic-apostrophe-between-digits, the-arabic-thousands-separator, a-separator-with-nothing-to-separate, a-separator-in-text-that-is-not-a-number, a-separator-inside-a-radix-prefix, arbitrary-text, a-bigint-suffix, arabic-indic-digits, an-inherited-property-name, underflow-to-zero, negative-underflow, an-integer-past-two-to-the-fifty-third
the cases of block 4.4 no mutant here rewrites, and this list is what the case identifier bought. The same declaration used to name both suites whole, on the grounds that the silence was the instrument's: NP-6 did redden a guard in there, under a title the unmutated contract does not contain, so attribution could not see it and all hundred read as silent. They are now addressed by name, NP-6 reddens the case it was written for, and what is left is a measurement of this battery - forty-nine value guards and fifty described ones that would each need their own mutant to say one sentence about a different row. The described suite is whole because no mutant here changes a reason: NP-6 moves a value and leaves overflow in place, which is the asymmetry the two tables exist to keep.
registry-storage · a-plain-signature-names-its-parameters, a-signature-that-takes-nothing-has-no-parameters, the-type-parameters-are-not-the-parameters, the-parameters-of-a-parameter-are-not-parameters, a-trailing-comma-leaves-no-parameter-behind-it, an-arrow-inside-a-type-parameter-does-not-close-it, the-call-of-number-parse-is-read-from-its-own-signature, the-call-of-date-add-is-read-from-its-own-signature, the-call-of-array-group-by-is-read-from-its-own-signature, the-call-of-string-levenshtein-is-read-from-its-own-signature, the-call-of-string-slugify-is-read-from-its-own-signature
the reading of a declared signature on a shape one of the five writes. Every mutant here stops a real contract serialising, so it reddens most of this folder and attributes the kill to the failure rather than to the guard; the three that are narrow enough to name one guard are I-20, I-22 and I-23 above.
registry-storage · a record accounts for everything its contract declares, the registry encoding, the public/private frontier, a sixth contract enters without a migration, every-declared-type-occurs-in-the-contract-number-parse, every-declared-type-occurs-in-the-contract-date-add, every-declared-type-occurs-in-the-contract-array-group-by, every-declared-type-occurs-in-the-contract-string-levenshtein, every-declared-type-occurs-in-the-contract-string-slugify, the-answer-is-the-export-the-identity-names-number-parse, the-answer-is-the-export-the-identity-names-date-add, the-answer-is-the-export-the-identity-names-array-group-by, the-answer-is-the-export-the-identity-names-string-levenshtein, the-answer-is-the-export-the-identity-names-string-slugify, the-profile-vocabulary-and-the-profiles-agree-number-parse, the-profile-vocabulary-and-the-profiles-agree-date-add, the-profile-vocabulary-and-the-profiles-agree-array-group-by, the-profile-vocabulary-and-the-profiles-agree-string-levenshtein, the-profile-vocabulary-and-the-profiles-agree-string-slugify, every-mutation-provenance-resolves, every-case-is-addressable-across-the-whole-contract-number-parse, every-case-is-addressable-across-the-whole-contract-date-add, every-case-is-addressable-across-the-whole-contract-array-group-by, every-case-is-addressable-across-the-whole-contract-string-levenshtein, every-case-is-addressable-across-the-whole-contract-string-slugify, the-address-is-well-formed-number-parse, the-address-is-well-formed-date-add, the-address-is-well-formed-array-group-by, the-address-is-well-formed-string-levenshtein, the-address-is-well-formed-string-slugify, no-two-contracts-share-an-address, every-produced-expression-occurs-in-the-contract-number-parse, every-produced-expression-occurs-in-the-contract-date-add, every-produced-expression-occurs-in-the-contract-array-group-by, every-produced-expression-occurs-in-the-contract-string-levenshtein, every-produced-expression-occurs-in-the-contract-string-slugify, every-produced-profile-exists-number-parse, every-produced-profile-exists-date-add, every-produced-profile-exists-array-group-by, every-produced-profile-exists-string-levenshtein, every-produced-profile-exists-string-slugify, a-case-that-is-not-a-call-is-refused, every-harness-file-is-hashed-number-parse, every-harness-file-is-hashed-date-add, every-harness-file-is-hashed-array-group-by, every-harness-file-is-hashed-string-levenshtein, every-harness-file-is-hashed-string-slugify, the-implementation-belongs-to-its-contract-number-parse, the-implementation-belongs-to-its-contract-date-add, the-implementation-belongs-to-its-contract-array-group-by, the-implementation-belongs-to-its-contract-string-levenshtein, the-implementation-belongs-to-its-contract-string-slugify, every-reference-has-no-dependencies, nothing-is-measured-yet, a-lockfile-is-json
the schema, rather than the storage. These guards were written by the unit that built the contract record and have no battery of their own; the mutants here aim at the canonical form, the served bytes, the frozen projection, the ledger and the licence perimeter, and none of them reaches a statement about what a record contains.
registry-storage · a-bundle-that-is-not-addressed-like-a-blob-is-refused, a-byte-order-mark-is-not-content, a-crlf-source-is-served-as-its-lf-form, a-snapshot-invents-no-field-array-group-by, a-snapshot-invents-no-field-date-add, a-snapshot-invents-no-field-number-parse, a-snapshot-invents-no-field-string-levenshtein, a-snapshot-invents-no-field-string-slugify, a-standing-cannot-be-set-on-something-unpublished, a-standing-changes-and-the-digest-does-not, a-standing-field-does-not-move-the-digest-array-group-by, a-standing-field-does-not-move-the-digest-date-add, a-standing-field-does-not-move-the-digest-number-parse, a-standing-field-does-not-move-the-digest-string-levenshtein, a-standing-field-does-not-move-the-digest-string-slugify, a-value-json-would-lose-is-refused-a-bigint, a-value-json-would-lose-is-refused-a-function, a-value-json-would-lose-is-refused-a-hole, a-value-json-would-lose-is-refused-a-symbol, a-value-json-would-lose-is-refused-an-undefined-field, a-value-json-would-lose-is-refused-infinity, a-value-json-would-lose-is-refused-nan, a-value-json-would-lose-is-refused-negative-infinity, a-value-json-would-lose-is-refused-negative-zero, a-value-json-would-lose-is-refused-undefined, an-array-keeps-its-order, an-attestation-about-another-snapshot-is-refused, every-standing-field-says-why-it-cannot-be-frozen, no-two-contracts-share-a-digest, normalising-changes-the-digest, the-frozen-half-and-the-standing-half-partition-an-implementation-array-group-by, the-frozen-half-and-the-standing-half-partition-an-implementation-date-add, the-frozen-half-and-the-standing-half-partition-an-implementation-number-parse, the-frozen-half-and-the-standing-half-partition-an-implementation-string-levenshtein, the-frozen-half-and-the-standing-half-partition-an-implementation-string-slugify, the-harness-is-in-one-order-date-add, the-harness-is-in-one-order-number-parse, the-harness-is-in-one-order-string-levenshtein, the-harness-is-in-one-order-string-slugify, the-limit-of-a-signature-is-published, two-majors-of-one-name-coexist
storage guards no mutant of this battery reaches yet. Each one names a defect that could be written and has not been: a byte-order mark left in the served bytes, a value JSON would lose reaching a digest, an array reordered, a standing field pulled into the digest, an attestation accepted for the wrong snapshot, two contracts colliding on one digest.
registry-storage · a-content-addressed-answer-is-cached-for-ever, a-contract-is-refused-or-published-and-never-both, a-cycle-is-refused-rather-than-deduplicated-away, a-named-answer-is-always-revalidated, a-refused-entry-is-answered-by-endpoints-that-exist-for-other-reasons, a-snapshot-answer-that-was-altered-is-refused, a-snapshot-answer-under-another-format-version-means-nothing-here, an-edge-the-registry-does-not-hold-is-refused, an-unpublished-implementation-cannot-be-depended-on, every-claim-is-about-an-endpoint-that-exists, every-endpoint-answers-a-need-somebody-has, every-field-a-snapshot-serves-is-classified-array-group-by, every-field-a-snapshot-serves-is-classified-date-add, every-field-a-snapshot-serves-is-classified-number-parse, every-field-a-snapshot-serves-is-classified-string-levenshtein, every-field-a-snapshot-serves-is-classified-string-slugify, every-identifier-is-an-address, every-need-is-answered-exactly-once, every-stratum-is-translated-and-no-translation-is-orphaned, nothing-that-held-is-content-addressed, the-believed-claims-with-no-mitigation-are-named, the-believed-column-is-longer-and-is-mostly-opinion, the-depth-is-derived-from-the-edges, the-endpoints-no-entry-anticipated, the-endpoints-that-carry-the-bulk-are-the-cacheable-ones, the-methodology-answer-carries-every-field-of-a-record, the-needs-answered-without-the-api, the-refusals-page-has-a-source, update-compares-two-digests-and-nothing-else
read-API guards shown reachable and not promoted into this battery. A perturbation was written for each one while the unit was built - applied one at a time against a control calibrated at 268 assertions - and every one went red on the guard written for it. Five of that pass became I-11 to I-15; these twenty-eight did not, and the reason is cost rather than doubt. A debt with a name, which is what this list is for.
registry-storage · a-blob-answer-with-one-byte-changed-is-refused, a-shared-file-is-recognised-by-its-digest-and-never-by-its-path, a-translation-is-addressed-to-a-reader, an-implementation-binding-carries-no-frozen-field-array-group-by, an-implementation-binding-carries-no-frozen-field-date-add, an-implementation-binding-carries-no-frozen-field-number-parse, an-implementation-binding-carries-no-frozen-field-string-levenshtein, an-implementation-binding-carries-no-frozen-field-string-slugify, every-claim-is-an-address, every-entry-became-an-endpoint-that-exists, every-entry-says-why, every-verifiable-claim-says-what-it-does-not-establish, no-private-field-reaches-a-snapshot-answer-array-group-by, no-private-field-reaches-a-snapshot-answer-date-add, no-private-field-reaches-a-snapshot-answer-number-parse, no-private-field-reaches-a-snapshot-answer-string-levenshtein, no-private-field-reaches-a-snapshot-answer-string-slugify, the-believed-natures-are-the-declared-ones-and-none-is-withholding, the-checks-that-need-nothing-from-the-registry, the-methodology-answer-carries-both-columns-and-the-seeding-policy, the-methodology-answer-is-named-and-therefore-revalidated
read-API guards no perturbation was written for, so whether an edit to this folder can redden them is unmeasured rather than known. Two families sit here for a reason worth naming. The implementation binding is guarded on the same claim as the contract binding, which I-12 reddens, so that pair is half probed. And the private-field guards cannot redden until a private field exists: not one field of a contract record is private today, which is a finding field-map.ts already records rather than a gap a mutant here could close.
site · a-quote-and-a-backslash-are-escaped-before-anything-else, nothing-but-the-local-adapter-reaches-the-serialisation
a defect that adds a line rather than rewriting one, or that this battery measures more widely elsewhere
site · the-file-stays-inside-the-limits-the-host-parses-it-under
a limit somebody else publishes, which only a catalogue growing past it can violate. The rule count is one per endpoint and the endpoints are eight, so no edit to a file of this folder produces a hundred and first rule or a two-thousandth character - what would is a registry with ninety-three more endpoints, and that is not a mutant.
string-levenshtein-spec · both-empty, identical-text, one-side-empty, the-other-side-empty, one-substitution, one-insertion, one-deletion, the-canonical-example, a-shared-suffix, a-shared-infix, a-transposition-inside-a-word, case-is-a-difference, a-space-is-a-code-point, an-astral-character-inside-a-word, two-astral-characters-and-one, a-grapheme-is-not-the-unit, a-lone-surrogate-is-one-unit, a-surrogate-pair-against-its-own-half, normalisation-is-not-applied, a-combining-mark-is-one-unit, a-precomposed-character-is-one-unit
the cases of block 4.4 no mutant here rewrites. Every one is reachable - LS-6 and LS-11 are the proof - and each of the rest would need its own mutant to say the same sentence about a different row. What is missing is a mutant, not a case.
string-levenshtein-spec · profile-unrelated, profile-against-the-empty-string, profile-astral-text
the benchmark profiles LS-8, LS-9, LS-10 and LS-13 leave alone. Each publishes a claim about where its answer sits between the two bounds, and one mutant per profile would repeat one sentence five times. identical left this list when LS-13 was written: it is the row that measured what an address buys, because the same mutant reddened the same guard before identifiers existed and this declaration went on calling the region unprobed.
string-slugify-spec · signature-is-the-declared-type, signature-accepts-one-string, signature-returns-a-string, signature-refuses-no-argument, signature-refuses-options
the type block, which a specification mutant can reach and none of these does. Rewriting Slugify in contract.ts would redden all five, and this battery carries no such mutant because the four signature defects of the reference battery already measure what each of them catches. What is missing is a mutant, not a guard.
string-slugify-spec · p4-the-declared-alphabet, support-the-slugs-are-well-formed
the two guards that read the declared alphabet. GS-11 widens it and both go on passing, which is that mutant's finding: the alphabet is checked in one direction only. A mutant that narrowed it would redden them, and this battery does not carry one.
string-slugify-spec · cyrillic-is-kept, arabic-is-kept, an-indic-mark-is-kept, a-non-latin-digit-is-a-digit, an-astral-letter-is-kept, a-latin-diacritic-is-removed, a-decomposed-diacritic-folds-alike, a-precomposed-diacritic-folds-alike, two-stacked-marks-are-removed, a-letter-with-no-decomposition-is-kept, a-ligature-letter-is-kept, a-stroked-letter-is-kept, a-mark-the-base-absorbs-is-dropped, a-mark-reaching-its-base-across-another, a-mark-with-no-base-to-absorb-it-is-kept, a-greek-tonos-is-removed, a-final-sigma-is-not-unified, a-written-final-sigma-is-kept, the-turkish-dotted-i-loses-its-dot, the-turkish-dotless-i-is-kept, a-fullwidth-letter-is-unified, a-typographic-ligature-is-unified, a-superscript-digit-is-a-digit, a-roman-numeral-is-letters, runs-of-spaces-become-one-separator, an-existing-slug-is-unchanged, a-doubled-separator-collapses, an-underscore-is-a-boundary, a-full-stop-is-a-boundary, an-apostrophe-is-a-boundary, an-ampersand-is-not-a-word, a-currency-sign-is-not-a-word, the-empty-string, nothing-retainable, an-emoji-is-removed, a-joined-emoji-sequence-is-removed, a-lone-surrogate-is-removed, a-lone-surrogate-inside-a-word, a-plus-is-not-a-letter, a-hash-is-not-a-letter
the cases of block 4.4 no mutant here rewrites. Every one is reachable - GS-6 and GS-13 are the proof - and each of the rest would need its own mutant to say the same sentence about a different row. What is missing is a mutant, not a case.
string-slugify-spec · profile-ascii-prose, profile-latin-diacritics, profile-other-writing-systems, profile-punctuation-heavy, profile-nothing-retainable
the five benchmark profiles GS-8, GS-9 and GS-10 leave alone. Each publishes a claim about how much of its input survives, and one mutant per profile would repeat one sentence six times.
Some contracts are measured twice: once as they are, and once through a lens that takes part of the suite's sight away — the failure reason unread, the declared type unchecked, the table of settled cases blind. The difference between the two columns is what that half of the contract is worth, stated as a number instead of asserted. There are 24 such readings over the 19 batteries.
None of the following needs us to be honest, and none of it needs the registry to be reachable when you check. Each says what it establishes and, beside it, what it still does not.
this frozen artefact is exactly what the digest I asked for names
By re-canonicalising the body and hashing it, then comparing with the address it was fetched by.
this file is exactly what the digest names
By normalising to the served form - UTF-8, LF, no byte-order mark - and hashing.
the set of files is the published set, and none of them was substituted
By the harness digests being inside the snapshot digest, which the check above already covered.
the file in my project is the one the registry gave me, or I changed it
By hashing the file on disk against the digest the lockfile recorded.
what this digest names today is what it named when I installed it
By fetching by digest and hashing; a registry that answered anything else would fail the check.
installing this feature pulls in exactly these others, in this order
By walking the edges in each implementation snapshot, every one of which is verified on arrival.
this signature is about the artefact I am holding and not another one
By comparing the attestation subject with the digest of the snapshot.
this artefact was published by a named identity from a named build
By verifying the Sigstore bundle with cosign, against an issuer and identity the reader supplies.
this code satisfies the properties, the edge cases and the signature the contract declares
By fetching the harness and running it - the whole of it, on the reader's own machine.
The longer list, and that is the honest shape rather than a failure. Nearly all of it is the registry's own opinion — which implementation is recommended, what a machine measured, what we chose to call something. Two entries are outside what any arithmetic reaches, whatever anybody publishes. Where something narrows a claim, it is named; where nothing does, that is said rather than left blank.
number/parse@1 is the artefact behind this digest and not another
What narrows it: a lockfile pins it after the first install, so the binding is believed once and checked for ever afterwards; and a transparency log makes a later change auditable by a third party. Neither makes the first resolution checkable offline, and no scheme does.
this implementation is the default, that one was demoted, these are its tags
What narrows it: a demoted implementation goes on being served, so the opinion changes what is recommended and never what is reachable - a project that installed it keeps resolving its digest
this contract is published, or the language has since absorbed it
What narrows it: the absorbed state carries the measurement that established it, replayable by anyone against the language - so the claim is arguable even though it is not computable
this implementation takes this long per call on this profile
What narrows it: the figure names the machine and the date it was taken on, and the profiles and their samples are frozen inside the snapshot - so anyone can run the same profile on their own hardware and publish a number that disagrees
this implementation ships this many bytes
What narrows it: the source is served and hashed, so anyone with a minifier can produce the figure themselves and see whether it agrees. It is null on everything the catalogue holds today.
these are all the contracts the registry has
Nothing narrows this.
these are all the signatures held for this digest
Nothing narrows this.
this edge case exists because that mutant survived until it was written
What narrows it: nothing is withheld: the batteries are in the repository, public and replayable, and the citation is resolved against them at serialisation rather than transcribed - a provenance naming a mutant no battery declares stops the publication. What a reader cannot do is resolve it *from a response*, because the instrument measures the catalogue and is not part of it.
the summary, the input domain, and the rationale of each case say what is true
What narrows it: each field carries the stratum it is verified at, so a reader is told which sentences no run could falsify rather than left to assume they were all checked
the digest this name resolved to for me is the one it resolves to for everyone
What narrows it: a transparency log and independent mirrors would make a split view detectable after the fact. Neither exists yet, and until one does a registry that answered one reader differently would leave no trace either reader could find.
what this contract requires is what a caller of this function should want
Nothing narrows this.
A contract is a record, and not every field of it is checked the same way. Each of the 61 fields carries the stratum it is verified at, so you are told which sentences no run could falsify instead of being left to assume they were all checked.
a guard in the contract's own suite fails when an implementation contradicts this. You can run that suite yourself, on the harness we serve, and see it.
a malformed value here is refused without any implementation being involved. You can re-check it from the record alone.
a guard exists and keeps one half of what it appears to keep: the declared value may be wider than what the guard requires, and nothing notices. Read it as a claim, not as a check.
published prose. Nothing can contradict it, because it makes no claim a run could falsify.
what refuses a wrong value here depends on which declaration it is, and the record carries the answer beside each one.
The property tests are not run against a frozen sample: a property whose draws are frozen with the major explores one sample set for ever and can be passed row by row by a submitter who knows it, which is what re-seeding every run exists to prevent. So your run is a different sample of the same properties, and a run of ours passing is not a promise that yours will draw what ours drew.
A verdict is taken from 1 run and an attribution — which guard caught which defect — from the intersection of 3. Measured: three complete runs of the string-slugify battery, 58 cells each: 0 verdicts moved and 6 attributions moved, on G-07, G-22 and F-10, each on both lenses. Every pinned guard held. Earlier, at fc51b00: L-18 red on 23 runs of 25 and G-22 on 8 of 9, measured while checking declared pins. The intersection of three runs is what the batteries already take.
a signature attests who published this snapshot and from what build; the contract's verification says an implementation answers the contract; neither says the contract is the right specification