# name<TAB>file<TAB>perl substitution<TAB>packages. Each must make the tests fail; a survivor is a guard no test watches.
# Run by `make kit-verify` through scripts/mutate.sh (copied from zeoarchitect scripts/mutate.sh at 35f6681).
single-dash flag after the verb	app.go	s/case strings\.HasPrefix\(t, \"-\"\) && t != \"-\":/case false:/	./...
single-dash flag in verb position	app.go	s/if !strings\.HasPrefix\(verb, \"--\"\) \{/if false {/	./...
unknown flag is refused	app.go	s/if !ok \{\n\t\t\t\treturn Usagef\(\"unknown flag/if !ok \&\& false {\n\t\t\t\treturn Usagef(\"unknown flag/	./...
unknown command is refused	app.go	s/if !ok \{\n\t\treturn Usagef\(\"unknown command/if !ok \&\& false {\n\t\treturn Usagef(\"unknown command/	./...
positional count is bounded	app.go	s/if len\(c\.Args\) > cmd\.MaxArgs \{/if false {/	./...
a value flag needs its value	app.go	s/if i\+1 >= len\(rest\) \{/if false {/	./...
a no-value flag refuses a value	app.go	s/\} else if !f\.TakesValue && hasVal \{/} else if false {/	./...
an app cannot shadow a kit verb	app.go	s/case seen\[c\.Name\]:/case false:/	./...
a command needs a Run	app.go	s/case c\.Run == nil:/case false:/	./...
no command is a usage error	app.go	s/if len\(args\) == 0 \{/if false {/	./...
--json goes to stderr for the RESULT line	app.go	s/if c\.JSON \{\n\t\tw = c\.Stderr/if false {\n\t\tw = c.Stderr/	./...
the exit table: not_ready is 7	exit.go	s/ExitNotReady    ExitCode = 7/ExitNotReady    ExitCode = 6/	./...
the exit table: usage is 2	exit.go	s/ExitUsage       ExitCode = 2/ExitUsage       ExitCode = 3/	./...
ExitOnly(ok) is nil	exit.go	s/if code == ExitOK \{\n\t\treturn nil\n\t\}//	./...
doctor exits 7 when not ready	verbs.go	s/if !ready \{\n\t\treturn ExitOnly\(ExitNotReady\)/if false {\n\t\treturn ExitOnly(ExitNotReady)/	./...
a failing check names its next step	verbs.go	s/if ck\.Next == \"\" \{/if false {/	./...
a skipped check is not a failure	verbs.go	s/if !ck\.OK && !ck\.Skipped \{\n\t\t\tready = false/if !ck.OK {\n\t\t\tready = false/	./...
status exits 1 when unhealthy	verbs.go	s/if !st\.Healthy \{\n(\t\tfmt\.Fprintf[^\n]*\n)?\t\treturn ExitOnly\(ExitFailed\)/if false {\n\t\treturn ExitOnly(ExitFailed)/	./...
status state is checked	verbs.go	s/if !validStates\[st\.State\] \{/if false {/	./...
version defaults to unsigned	verbs.go	s/state, signer := SignatureUnsigned, \"\"/state, signer := SignatureVerified, \"\"/	./...
the signature state is checked	verbs.go	s/\tdefault:\n\t\treturn Failed\(\"signature state/\tcase \"never\":\n\t\treturn Failed(\"signature state/	./...
RESULT: ok carries no reason	result.go	s/case r\.Outcome == OutcomeOK && r\.Reason != \"\":/case false:/	./...
RESULT: a non-ok outcome needs a reason	result.go	s/case r\.Outcome != OutcomeOK && r\.Reason == \"\":/case false:/	./...
RESULT: the reason is one token	result.go	s/case r\.Reason != \"\" && !reasonRe\.MatchString\(r\.Reason\):/case false:/	./...
RESULT: the outcome is checked	result.go	s/if !r\.Outcome\.valid\(\) \{/if false {/	./...
RESULT: undo is one line	result.go	s/if strings\.ContainsAny\(r\.Undo, \"\\n\\r\"\) \{/if false {/	./...
RESULT: a refusal exits 3	result.go	s/case OutcomeRefused:\n\t\treturn ExitRefused/case OutcomeRefused:\n\t\treturn ExitFailed/	./...
recovery_required is not safe to retry	result.go	s/return o != OutcomeRecoveryRequired/return true/	./...
every outcome but ok and a refusal is exit 1	result.go	s/default:\n\t\treturn ExitFailed\n\t\}\n\}\n\n\/\/ SafeToRetry/default:\n\t\treturn ExitOK\n\t}\n}\n\n\/\/ SafeToRetry/	./...
help is built from the command table	verbs.go	s/for _, c := range a\.Commands \{\n\t\tadd\(c, false\)/for range a.Commands {\n\t\t_ = add/	./...
stale state is not refused	plan.go	s/if v, ok := now\[ch\.Target\]; !ok \|\| v != ch\.Before \{/if v, ok := now[ch.Target]; (!ok || v != ch.Before) \&\& false {/	./...
shared apply needs no plan	plan.go	s/if s\.Shared \{/if false {/	./...
plan_id not rechecked	plan.go	s/if want\.PlanID != doc\.PlanID \|\| want\.Empty != doc\.Empty \{/if (want.PlanID != doc.PlanID || want.Empty != doc.Empty) \&\& false {/	./...
plan file app and subject not checked	plan.go	s/case doc\.App != a\.Name \|\| doc\.Subject != subject:/case false:/	./...
plan file schema not checked	plan.go	s/case doc\.Schema != SchemaPlan:/case false:/	./...
unknown plan field allowed	plan.go	s/dec\.DisallowUnknownFields\(\)//	./...	accepted: apply --plan's byte comparison against what the kit would have written also refuses an unknown field; the decoder's own refusal stays as the first, plainer error
oversized plan accepted	plan.go	s/if len\(raw\) > maxPlanBytes \{/if false {/	./...
undo not swapped	plan.go	s/Before: ch\.After, After: ch\.Before/Before: ch.Before, After: ch.After/	./...
backup mode too open	plan.go	s/0o600/0o644/	./...
backup not written before apply	plan.go	s/path, err := a\.writeBackup\(s\.Name, plan\.PlanID, undo\)/_, _ = a.writeBackup(s.Name, plan.PlanID, undo); path, err := "", error(nil)/	./...
changes not sorted	plan.go	s/return changes\[i\]\.Target < changes\[j\]\.Target/return false/	./...
failed apply keeps its undo	plan.go	s/\t\tout\.Undo = ""\n//	./...
canonical keys unsorted	canonical.go	s/return slicesCompareUTF16\(members\[i\]\.key, members\[j\]\.key\) < 0/return false/	./...
canonical duplicate key allowed	canonical.go	s/if seen\[key\] \{/if false {/	./...
canonical integer bound dropped	canonical.go	s/i > 1<<53-1 \|\| i < -\(1<<53-1\)/i == 1<<62/	./...
canonical trailing data allowed	canonical.go	s/if _, err := dec\.Token\(\); !errors\.Is\(err, io\.EOF\) \{/if _, err := dec.Token(); !errors.Is(err, io.EOF) \&\& false {/	./...
canonical escapes control characters raw	canonical.go	s/if r < 0x20 \{/if false {/	./...
intent not checked before a change	update.go	s/if in != nil \{\n\t\twhat := /if in != nil \&\& false {\n\t\twhat := /	./...
intent not written before the switch	update.go	s/if err := a\.writeIntent\(intent\{App: a\.Name, From: from, To: to, Step: "switch"\}\); err != nil \{/if err := error(nil); err != nil {/	./...
intent cleared after a failed switch-back	update.go	s/\t\treturn r\.finish\(OutcomeRecoveryRequired, "recovery_required", fmt\.Errorf\("%v; and going back failed: %v", cause, err\)\)/\t\t_ = r.a.clearIntent()\n\t\treturn r.finish(OutcomeRecoveryRequired, "recovery_required", fmt.Errorf("%v; and going back failed: %v", cause, err))/	./...
failure after switch not switched back	update.go	s/err = u\.switchTo\(from\)\n\t\tr\.step\("switch-back"/err = error(nil)\n\t\tr.step("switch-back"/	./...
switch back not verified	update.go	s/\t\tif err == nil \{\n\t\t\terr = r\.prove\(from, t0\)\n\t\t\}/\t\tif false {\n\t\t\terr = r.prove(from, t0)\n\t\t}/	./...
new version not verified after switch	update.go	s/\tif err == nil \{\n\t\terr = r\.prove\(to, t0\)\n\t\}/\tif false {\n\t\terr = r.prove(to, t0)\n\t}/	./...
ready not required	update.go	s/\tif u\.Ready != nil \{\n\t\terr := u\.Ready/\tif u.Ready != nil \&\& false {\n\t\terr := u.Ready/	./...
busy lock not taken	update.go	s/syscall\.Flock\(int\(f\.Fd\(\)\), syscall\.LOCK_EX\|syscall\.LOCK_NB\)/error(nil)/	./...
downgrade allowed	update.go	s/case cmp < 0 \&\& r\.doc\.Verb == "update":/case false:/	./...
same version allowed	update.go	s/case cmp == 0:/case false:/	./...
unsafe version path allowed	update.go	s/if !validVersion\(rel\.Version\) \{/if false {/	./...
unsafe --to allowed	update.go	s/if to != "" \&\& !validVersion\(to\) \{/if false {/	./...
live rule dropped	update.go	s/if err == nil \&\& \(st\.Live == nil \|\| !\*st\.Live\) \{/if true || err == nil \&\& (st.Live == nil || !*st.Live) {/	./...
migration rollback allowed	update.go	s/if h\.Migrated \&\& u\.Down == nil \{/if false {/	./...
no previous allowed	update.go	s/if h\.Previous == "" \|\| !validVersion\(h\.Previous\) \{/if false {/	./...
recover clears without proof	update.go	s/\t\tif err := r\.prove\(v, t0\); err != nil \{\n\t\t\tlastErr = err\n\t\t\tcontinue\n\t\t\}/\t\t_ = r.prove(v, t0)/	./...
stop failure not restarted	update.go	s/if u\.Start != nil \{\n\t\tif err := r\.hook\("start-old"/if false {\n\t\tif err := r.hook("start-old"/	./...
apply ignores recovery	plan.go	s/if err := a\.refuseIfRecovery\(\); err != nil \{\n\t\tfmt/if false {\n\t\tfmt/	./...
down migration skipped	update.go	s/\tif down \{\n\t\tif err := u\.Down/\tif false {\n\t\tif err := u.Down/	./...
rename not atomic symlink	update.go	s/if err := os\.Rename\(tmp, u\.current\(\)\); err != nil \{/_ = os.Remove(u.current()); if err := os.Rename(tmp, u.current()); err != nil {/	./...	accepted: the gap between remove and rename cannot be observed by a test in one process; the single rename(2) of a new symlink is what review reads
an error message is folded to one printable line	app.go	s/if strconv\.IsPrint\(r\) \{/if strconv.IsPrint(r) || true {/	./...
only a plain name is echoed	app.go	s/if flagNameRe\.MatchString\(s\) \{/if true {/	./...
a plain single-dash flag is named	app.go	s/case flagNameRe\.MatchString\(name\):/case false:/	./...
-h points at --help	app.go	s/case name == "h":/case false:/	./...
--help is help	app.go	s/if args\[0\] == "--help" \{/if false {/	./...
a command name is validated	app.go	s/case !nameRe\.MatchString\(c\.Name\):/case false:/	./...
a command cannot list a code outside the table	app.go	s/if !e\.inTable\(\) \|\| e == ExitOK \{/if false {/	./...
a command cannot end outside the table or with 0	app.go	s/if errors\.As\(err, &e\) && !e\.Code\.inTable\(\) \|\| e != nil && e\.Code == ExitOK \{/if false {/	./...
a command cannot end with 0 and a message	app.go	s/ \|\| e != nil && e\.Code == ExitOK \{/ {/	./...
version lists exit 1	app.go	s/Exits: \[\]ExitCode\{ExitFailed\}, Run: a\.runVersion/Run: a.runVersion/	./...
doctor lists exit 1	app.go	s/\[\]ExitCode\{ExitFailed, ExitNotReady\}/[]ExitCode{ExitNotReady}/	./...
RESULT words are printable ASCII	result.go	s/\^\[!#-<>-~\]\+\$/^[^\\s"=]+\$/	./...
RESULT totals refuse a repeated key	result.go	s/if seen\[p\.Key\] \{/if false {/	./...
RESULT totals refuse reserved keys	result.go	s/seen := map\[string\]bool\{"from": true, "to": true, "reason": true, "undo": true\}/seen := map[string]bool{}/	./...
doctor prints an empty list, not null	verbs.go	s/if checks == nil \{/if false {/	./...
an unhealthy status names itself on stderr	verbs.go	s/\t\tfmt\.Fprintf\(c\.Stderr, "%s: status: not healthy[^\n]*\n//	./...
RESULT: undo is escaped to ASCII	result.go	s/strconv\.QuoteToASCII\(r\.Undo\)/strconv.Quote(r.Undo)/	./...
CLIENT: a variable beats the host file without permission	client/endpoint.go	s/if set \&\& e\.AllowEnv \{/if set {/	./client/
CLIENT: an unlisted origin is accepted	client/endpoint.go	s/if !listed\(o, e\) \{/if false {/	./client/
CLIENT: local from the environment needs no permission	client/endpoint.go	s/if !e\.EnvLocal \{/if false {/	./client/
CLIENT: a dev origin carries the credential	client/endpoint.go	s/return Endpoint\{Origin: o, Source: SourceDev\}, nil/return Endpoint{Origin: o, Source: SourceDev, Credential: true}, nil/	./client/
CLIENT: no variable in dev is not not_configured	client/endpoint.go	s/if !set \{\n\t\t\treturn Endpoint\{\}, \&Refusal\{\"not_configured\"/if false {\n\t\t\treturn Endpoint{}, \&Refusal{\"not_configured\"/	./client/
CLIENT: an unlisted service is not not_configured	client/endpoint.go	s/e, ok := host\.Services\[service\]\n\tif !ok \{/e, ok := host.Services[service]\n\tif false \&\& !ok {/	./client/
CLIENT: a service name may be longer than 32	client/endpoint.go	s/len\(s\) <= 32 \&\& //	./client/
CLIENT: a service name may hold punctuation	client/endpoint.go	s/\^\[a-z\]\[a-z0-9\]\*\(-\[a-z0-9\]\+\)\*\$/^[a-z][a-z0-9_.-]*\$/	./client/
CLIENT: an origin is not checked against the grammar	client/endpoint.go	s/if !originRe\.MatchString\(v\) \{/if false {/	./client/
CLIENT: a host is not lower-cased	client/endpoint.go	s/strings\.ToLower\(u\.Host\)/u.Host/	./client/
CLIENT: a port is not checked	client/endpoint.go	s/n < 1 \|\| n > 65535/n < -1 || n > 99999/	./client/
CLIENT: an empty port is accepted	client/endpoint.go	s/ \|\| strings\.HasSuffix\(u\.Host, ":"\)//	./client/
CLIENT: the host file owner is not checked	client/host.go	s/!ok \|\| uid != 0/!ok || uid < 0/	./client/
CLIENT: a group-writable host file is accepted	client/host.go	s/Perm\(\)\&0o022 != 0/Perm()\&0o002 != 0/	./client/
CLIENT: an other-writable host file is accepted	client/host.go	s/Perm\(\)\&0o022 != 0/Perm()\&0o020 != 0/	./client/
CLIENT: a symlink in the host path is accepted	client/host.go	s/fi\.Mode\(\)\&fs\.ModeSymlink != 0/false/	./client/
CLIENT: a host file need not be regular	client/host.go	s/!fi\.Mode\(\)\.IsRegular\(\) \|\| //	./client/
CLIENT: a host file may be any size	client/host.go	s/ \|\| fi\.Size\(\) > max//	./client/
CLIENT: a parent need not be a directory	client/host.go	s/\} else if !fi\.IsDir\(\) \{/} else if false {/	./client/
CLIENT: the host path need not be absolute and clean	client/host.go	s/if !filepath\.IsAbs\(path\) \|\| filepath\.Clean\(path\) != path \{/if false {/	./client/
CLIENT: the host file schema is not checked	client/host.go	s/ \|\| cfg\.Schema != EndpointsSchema//	./client/
CLIENT: a service name in the host file is not validated	client/host.go	s/if !validService\(name\) \{/if false {/	./client/
CLIENT: an entry may hold both origin and local, or neither	client/host.go	s/\(e\.Origin == nil\) == !e\.Local/false/	./client/
CLIENT: an origin entry needs no audience	client/host.go	s/ \|\| e\.Audience == \"\"//	./client/
CLIENT: an env origin is not validated	client/host.go	s/for _, o := range e\.EnvOrigins \{\n\t\t\tif _, err := parseOrigin\(o\); err != nil \{/for _, o := range e.EnvOrigins {\n\t\t\tif _, err := parseOrigin(o); err != nil \&\& false {/	./client/
CLIENT: the CA bundle is not checked	client/host.go	s/if err := f\.checkPath\(\*cfg\.CABundle, MaxHostFile\*64\); err != nil \{/if err := f.checkPath(*cfg.CABundle, MaxHostFile*64); err != nil \&\& false {/	./client/
CLIENT: a bundle is not required where the verifier reads the environment	client/host.go	s/\} else if !systemRootsIgnoreEnv\(\) \{/} else if false {/	./client/
CLIENT: a bundle with no certificate is accepted	client/host.go	s/if !pool\.AppendCertsFromPEM\(raw\) \{/if !pool.AppendCertsFromPEM(raw) \&\& false {/	./client/
CLIENT: a duplicate key is accepted	client/strict.go	s/if seen\[key\] \{/if false {/	./client/
CLIENT: an unknown field is accepted	client/strict.go	s/dec\.DisallowUnknownFields\(\)//	./client/
CLIENT: data after the document is accepted	client/strict.go	s/if _, err := dec\.Token\(\); !errors\.Is\(err, io\.EOF\) \{/if _, err := dec.Token(); !errors.Is(err, io.EOF) \&\& false {/g	./client/
CLIENT: an unknown outcome has an exit	client/result.go	s/default:\n\t\treturn kit\.ExitFailed/default:\n\t\treturn kit.ExitUnavailable/	./client/
CLIENT: not_found is not exit 4	client/result.go	s/return kit\.ExitNotFound/return kit.ExitFailed/	./client/
CLIENT: timeout is not exit 5	client/result.go	s/return kit\.ExitTimeout/return kit.ExitFailed/	./client/
CLIENT: doctor not ready is not exit 7	client/result.go	s/return kit\.ExitNotReady/return kit.ExitFailed/	./client/
CLIENT: refused is not exit 3	client/result.go	s/return kit\.ExitRefused/return kit.ExitFailed/	./client/
CLIENT: invalid is not exit 2	client/result.go	s/return kit\.ExitUsage/return kit.ExitFailed/	./client/
CLIENT: spooled is not exit 0	client/result.go	s/case OutcomeOK, OutcomeSpooled:/case OutcomeOK:/	./client/
CLIENT: any reason is valid	client/result.go	s/if a == \*r\.Reason \{/if a != \"\" {/	./client/
CLIENT: a reason on ok is valid	client/result.go	s/return len\(allowed\) == 0/return true/	./client/
CLIENT: a result is not validated when read back	client/result.go	s/ \|\| !r\.Valid\(\) \{/ {/	./client/
CLIENT: the result names no schema	client/result.go	s/\tr\.Schema = ResultSchema\n\tif r\.Transport/\tif r.Transport/	./client/
CLIENT: a config can raise a connect timeout	client/policy.go	s/want\.Connect < p\.Connect/want.Connect != p.Connect/	./client/
CLIENT: a config can raise a total timeout	client/policy.go	s/want\.Total < p\.Total/want.Total != p.Total/	./client/
CLIENT: jitter exceeds half	client/policy.go	s/int64\(d\/2\)\+1/int64(d)+1/	./client/
CLIENT: jitter is none	client/policy.go	s/rand\.Int64N\(int64\(d\/2\)\+1\)/rand.Int64N(1)/	./client/
CLIENT: the proxy comes from the environment	client/call.go	s/Proxy:\s+nil,[^\n]*/Proxy: http.ProxyFromEnvironment,/	./client/
CLIENT: redirects are followed	client/call.go	s/return http\.ErrUseLastResponse/return nil/	./client/
CLIENT: the pin is not checked	client/call.go	s/hex\.EncodeToString\(sum\[:\]\) != want/hex.EncodeToString(sum[:]) != want \&\& false/	./client/
CLIENT: the given roots are not used	client/call.go	s/RootCAs: c\.Roots, //	./client/
CLIENT: a TLS failure is not classed as one	client/call.go	s/case isTLS\(err\) \&\& !sent:/case false:/	./client/
CLIENT: a path without a slash is accepted	client/call.go	s/return pathRe\.MatchString\(p\) \&\& /return /	./client/	accepted: the same path also fails in http.NewRequest, which is also invalid; the check keeps the refusal independent of it
CLIENT: a path with .. is accepted	client/call.go	s/ \&\& !strings\.Contains\(p, "\.\."\)//	./client/
CLIENT: a method is not checked	client/call.go	s/!validMethod\(r\.Method\)/false/	./client/
CLIENT: a request size is not bounded	client/call.go	s/len\(r\.Body\) > MaxRequest/false/	./client/
CLIENT: an envelope size is not bounded	client/call.go	s/len\(r\.Envelope\.Body\) > MaxEnvelope/false/	./client/
CLIENT: an operation id is not checked	client/call.go	s/if !idRe\.MatchString\(r\.OperationID\) \{/if false {/	./client/
CLIENT: a write body need not be JSON	client/call.go	s/if !json\.Valid\(r\.Body\) \{/if false {/	./client/
CLIENT: a local endpoint is called over HTTP	client/call.go	s/c\.Endpoint\.Local \|\| //	./client/
CLIENT: the audience is not checked	client/call.go	s/r\.Audience == \"\" \|\| r\.Audience != c\.Endpoint\.Audience/false/	./client/
CLIENT: a credential error is ignored	client/call.go	s/if err != nil \{\n\t\t\t\treturn c\.result\(r, OutcomeRefused, false, \"credential\"\)/if err != nil \&\& false {\n\t\t\t\treturn c.result(r, OutcomeRefused, false, \"credential\")/	./client/
CLIENT: a read is retried after bytes were sent	client/call.go	s/!res\.Sent \&\& //	./client/
CLIENT: a backoff longer than the time left is waited	client/call.go	s/time\.Until\(dl\) <= wait/time.Until(dl) < -wait/	./client/
CLIENT: a write without an outbox is sent	client/call.go	s/if c\.Outbox == nil \{\n\t\treturn c\.result\(r, OutcomeRefused, false, \"no_outbox\"\)/if false {\n\t\treturn c.result(r, OutcomeRefused, false, \"no_outbox\")/	./client/
CLIENT: a write may spool without a dedup contract	client/call.go	s/if r\.Spool \&\& r\.Dedup == \"\" \{/if false {/	./client/
CLIENT: a full outbox is not reported	client/call.go	s/case errors\.Is\(err, ErrFull\):/case false:/	./client/
CLIENT: a key conflict is not reported	client/call.go	s/case errors\.Is\(err, ErrKeyConflict\):/case false:/	./client/
CLIENT: an unknown record is sent again by a call	client/call.go	s/case StateUnknown:/case \"never\":/	./client/
CLIENT: --require-delivery is ignored	client/call.go	s/if r\.Spool \&\& !r\.RequireDelivery \{/if r.Spool {/	./client/
CLIENT: require_delivery is not reported	client/call.go	s/case r\.Spool \&\& r\.RequireDelivery \&\&/case false \&\&/	./client/
CLIENT: offline is not reported	client/call.go	s/res\.Outcome == OutcomeUnavailable \&\& \*res\.Reason == \"unavailable\"/false/	./client/
CLIENT: a successful read does not drain	client/call.go	s/if res\.Outcome == OutcomeOK \&\& c\.Outbox != nil \{/if false {/	./client/
CLIENT: reconcile resends a verb without dedup	client/call.go	s/ \|\| r\.Dedup == \"\" \{/ || r.Dedup == \"\" \&\& false {/	./client/
CLIENT: reconcile resends a record that is not unknown	client/call.go	s/err != nil \|\| rec\.State != StateUnknown/err != nil/	./client/
CLIENT: reconcile does not mark a refusal	client/call.go	s/case OutcomeInvalid, OutcomeNotFound:/case OutcomeInvalid:/	./client/
CLIENT: reconcile keeps a delivered record	client/call.go	s/case OutcomeOK:\n\t\t\t_ = c\.Outbox\.Remove\(rec\)/case OutcomeOK:\n\t\t\t_ = rec/	./client/
CLIENT: a deadline is not a timeout	client/call.go	s/case errors\.Is\(ctx\.Err\(\), context\.DeadlineExceeded\):\n\t\tswitch/case false:\n\t\tswitch/	./client/
CLIENT: a write timeout after send is a plain timeout	client/call.go	s/case sent \&\& !r\.Read:\n\t\t\treturn c\.result\(r, OutcomeDispatchUnknown, true, \"timeout_after_send\"\)/case false:\n\t\t\treturn c.result(r, OutcomeDispatchUnknown, true, \"timeout_after_send\")/	./client/
CLIENT: a lost answer to a write is plain unavailable	client/call.go	s/case sent \&\& !r\.Read:\n\t\treturn c\.result\(r, OutcomeDispatchUnknown, true, \"dispatch_unknown\"\)/case false:\n\t\treturn c.result(r, OutcomeDispatchUnknown, true, \"dispatch_unknown\")/	./client/
CLIENT: a redirect is followed in the answer	client/call.go	s/case status >= 300 \&\& status < 400:/case false:/	./client/
CLIENT: a 401 is not refused	client/call.go	s/case status == 401:/case false:/	./client/
CLIENT: a stop answer is not refused	client/call.go	s/case status == 403:/case false:/	./client/
CLIENT: a 404 is not not_found	client/call.go	s/case status == 404:/case false:/	./client/
CLIENT: a 400 or 422 is not invalid	client/call.go	s/case status == 400 \|\| status == 422:/case false:/	./client/
CLIENT: a 5xx answer to a write is not unknown	client/call.go	s/\t\tif r\.Read \{\n\t\t\treturn c\.result\(r, OutcomeUnavailable, true, \"server_error\"\)\n\t\t\}/\t\tif true {\n\t\t\treturn c.result(r, OutcomeUnavailable, true, \"server_error\")\n\t\t}/	./client/
CLIENT: a bad answer to a write is not unknown	client/call.go	s/\t\t\tif r\.Read \{\n\t\t\t\treturn c\.result\(r, OutcomeUnavailable, true, \"response_invalid\"\)/\t\t\tif true {\n\t\t\t\treturn c.result(r, OutcomeUnavailable, true, \"response_invalid\")/	./client/
CLIENT: an answer is not size-bounded	client/call.go	s/len\(raw\) == 0 \|\| len\(raw\) > MaxResponse/len(raw) == 0/	./client/
CLIENT: a duplicate key in an answer is accepted	client/call.go	s/ \|\| noDuplicateKeys\(raw\) != nil//	./client/
CLIENT: an answer need not carry a schema	client/call.go	s/head\.Schema == \"\" \|\| //	./client/
CLIENT: the expected schema is not checked	client/call.go	s/\(expect != \"\" \&\& head\.Schema != expect\)/false/	./client/
CLIENT: a read error is ignored	client/call.go	s/if readErr != nil \|\| len\(raw\)/if len(raw)/	./client/
CLIENT: no idempotency key is sent	client/call.go	s/req\.Header\.Set\(\"Idempotency-Key\", r\.OperationID\)//	./client/
CLIENT: the envelope is not carried	client/call.go	s/\"Zeo-Envelope\"/\"X-Other\"/	./client/
CLIENT: no credential is sent	client/call.go	s/req\.Header\.Set\(\"Authorization\", authz\)//	./client/
CLIENT: a body can be replayed by net/http	client/call.go	s/io\.NopCloser\(bytes\.NewReader\(body\)\)/bytes.NewReader(body)/	./client/	accepted: a one-request transport per call and no keep-alive means a reused connection never exists to replay on; this guard is defence in depth and no in-process test can reach the replay
CLIENT: keep-alive is on	client/call.go	s/DisableKeepAlives:\s+true,/DisableKeepAlives: false,/	./client/	accepted: see the replay mutation: a new transport per call leaves no connection to reuse
CLIENT: doctor says it answers when it does not	client/call.go	s/d\.Answers = res\.Outcome == OutcomeOK/d.Answers = res.Outcome != \"\"/	./client/
CLIENT: an outbox path may be relative or unclean	client/outbox.go	s/if !filepath\.IsAbs\(dir\) \|\| filepath\.Clean\(dir\) != dir \{/if false {/	./client/
CLIENT: an outbox sender is not validated	client/outbox.go	s/if !idRe\.MatchString\(sender\) \{/if false {/	./client/
CLIENT: an outbox path may hold a symlink	client/outbox.go	s/err != nil \|\| real != dir/err != nil || (real != dir \&\& false)/	./client/
CLIENT: an outbox directory may be open to others	client/outbox.go	s/ \|\| st\.Mode\(\)\.Perm\(\)\&0o077 != 0//	./client/
CLIENT: a bad incarnation is accepted	client/outbox.go	s/if len\(id\) != 32 \{/if false {/	./client/
CLIENT: a record from another incarnation is read	client/outbox.go	s/ \|\| r\.Incarnation != o\.incarnation//	./client/
CLIENT: a record with an unsafe id is read	client/outbox.go	s/\n\t\t\t!idRe\.MatchString\(r\.OperationID\) \|\| name != fileName\(r\.Seq, r\.OperationID\) \{/\n\t\t\tfalse {/	./client/
CLIENT: a record under the wrong name is read	client/outbox.go	s/ \|\| name != fileName\(r\.Seq, r\.OperationID\)//	./client/
CLIENT: a torn record is not moved aside	client/outbox.go	s/_ = os\.Rename\(path, path\+\"\.bad\"\)//	./client/
CLIENT: an operation id is not checked by the outbox	client/outbox.go	s/if !idRe\.MatchString\(id\) \{\n\t\treturn Record\{\}, nil, errors\.New\(\"the operation id is not valid\"\)/if false {\n\t\treturn Record{}, nil, errors.New(\"the operation id is not valid\")/	./client/
CLIENT: a key conflict is accepted	client/outbox.go	s/if r\.PayloadDigest != digest \{/if false {/	./client/
CLIENT: a repeated operation id is a second record	client/outbox.go	s/if r\.OperationID == id \{/if false {/	./client/
CLIENT: sequence numbers are not unique	client/outbox.go	s/if r\.Seq >= next \{/if false {/	./client/
CLIENT: the allocator is not locked	client/outbox.go	s/if err := syscall\.Flock\(int\(f\.Fd\(\)\), how\); err != nil \{/if false {/	./client/	accepted: the allocator lock keeps concurrent writers apart, but whether two goroutines race inside a few microseconds is a matter of timing no test can force; removing the lock also removes the drain lock, which O4 does kill (see the next row)
CLIENT: a record file is world-readable	client/outbox.go	s/tmp\.Chmod\(0o600\)/tmp.Chmod(0o644)/	./client/
CLIENT: purge removes records that are not refused	client/outbox.go	s/if r\.State == StateRefused \|\| r\.State == StateAbandoned \{/if true {/	./client/
CLIENT: doctor never says the outbox is near full	client/outbox.go	s/s\.NearFull = s\.Count >= o\.maxRecords\*9\/10 \|\|/s.NearFull = false ||/	./client/
CLIENT: a refused record stops a drain	client/outbox.go	s/(r\.State == StateRefused \|\| r\.State == StateAbandoned \|\| sr\.Unordered \&\& r\.State == StateUnknown) \{\n\t\t\tcontinue/$1 {\n\t\t\treturn sent, nil/	./client/
CLIENT: more than one drain may run	client/outbox.go	s/unlock, err := o\.lock\(\"\.drain\.lock\", false\)/unlock, err := func() (func(), error) { return func() {}, nil }()/	./client/
CLIENT: a dev-build local binding may be privileged	client/endpoint.go	s/e\.Local \&\& e\.Source != SourceDev/e.Local/	./client/
CLIENT: a credentialed entry needs no bundle or pin	client/host.go	s/if e\.Origin != nil \&\& e\.SPKI == nil \&\& cfg\.CABundle == nil \{/if false {/	./client/
CLIENT: a credential file is not checked	client/host.go	s/if err := f\.checkPath\(\*e\.CredentialFile, MaxHostFile\); err != nil \{/if err := f.checkPath(*e.CredentialFile, MaxHostFile); err != nil \&\& false {/	./client/
CLIENT: the credential file is not rechecked at read time	client/host.go	s/if err := f\.checkPath\(path, MaxHostFile\); err != nil \{\n\t\t\treturn \"\", err/if err := f.checkPath(path, MaxHostFile); err != nil \&\& false {\n\t\t\treturn \"\", err/	./client/
CLIENT: a TLS verification failure is an outage	client/call.go	s/return c\.result\(r, OutcomeRefused, false, \"tls\"\)/return c.result(r, OutcomeUnavailable, false, \"unavailable\")/	./client/
CLIENT: HTTP/2 is allowed	client/call.go	s/NextProtos: \[\]string\{\"http\/1\.1\"\}//; s/\t\t\tTLSNextProto: map\[string\]func\(string, \*tls\.Conn\) http\.RoundTripper\{\},\n//; s/ForceAttemptHTTP2:\s+false,/ForceAttemptHTTP2: true,/	./client/
CLIENT: a write is not made unknown before it is sent	client/call.go	s/lk, err = c\.Outbox\.setStateLocked\(rec, StateUnknown, lk\)/lk, err = lk, error(nil)/	./client/
CLIENT: records of other services block a write	client/call.go	s/o\.Service == rec\.Service \&\& //	./client/
CLIENT: records behind a write block it	client/call.go	s/ \&\& o\.Seq < rec\.Seq//	./client/
CLIENT: a new write overtakes the queue	client/call.go	s/if !r\.Unordered \&\& c\.ahead\(rec\) \{/if false {/	./client/
CLIENT: a write does not clear the queue ahead first	client/call.go	s/_, _ = c\.Outbox\.DrainBefore\(rec\.Service, rec\.Seq, func\(old Record\) Result \{ return c\.sendRecord\(ctx, old, authz\) \}\)/_ = ctx/	./client/
CLIENT: a blocked write is not refused	client/call.go	s/return c\.result\(r, OutcomeRefused, false, \"blocked\"\)\n\t\t\}\n\t\}/return c.result(r, OutcomeSpooled, false, \"\")\n\t\t}\n\t}/	./client/
CLIENT: a held outbox is not reported blocked	client/call.go	s/case errors\.Is\(err, ErrHeld\):/case false:/	./client/
CLIENT: a successful write leaves its record	client/call.go	s/case res\.Outcome == OutcomeOK:\n\t\t_ = c\.Outbox\.Remove\(rec\)/case res.Outcome == OutcomeOK:\n\t\t_ = rec/	./client/
CLIENT: a record that sent nothing is not requeued	client/call.go	s/if err := c\.Outbox\.SetState\(rec, StateQueued\); err != nil \{/if false {/	./client/
CLIENT: the implicit drain shares the call's deadline	client/call.go	s/context\.WithTimeout\(context\.WithoutCancel\(ctx\), Write\.Total\)/context.WithTimeout(ctx, Write.Total)/	./client/
CLIENT: an interrupted drain leaves a record queued	client/outbox.go	s/lk, err = o\.setStateLocked\(r, StateUnknown, lk\)/lk, err = lk, error(nil)/	./client/
CLIENT: a record that sent nothing stays unknown after a drain	client/outbox.go	s/return sent, o\.SetState\(r, StateQueued\)/return sent, o.SetState(r, StateUnknown)/	./client/
CLIENT: a drain ignores a hold	client/outbox.go	s/\tif bad > 0 \{\n\t\treturn 0, ErrHeld\n\t\}/\t_ = bad/	./client/
CLIENT: an enqueue ignores a hold	client/outbox.go	s/if bad > 0 \&\& !req\.Unordered \{/if bad > 0 \&\& !req.Unordered \&\& false {/	./client/
CLIENT: resolve does not clear a hold	client/outbox.go	s/if err := os\.Rename\(filepath\.Join\(o\.dir, name\), filepath\.Join\(o\.dir, to\)\); err != nil \{/if err := error(nil); to == \"\" || err != nil {/	./client/
CLIENT: a failed fsync deletes the file	client/outbox.go	s/tmp\.Close\(\); _ = os\.Rename\(name, name\+\"\.suspect\"\); return err/tmp.Close(); _ = os.Remove(name); return err/	./client/
CLIENT: a failed directory fsync deletes the record	client/outbox.go	s/_ = os\.Rename\(final, final\+\"\.suspect\"\)/_ = os.Remove(final)/	./client/
CLIENT: a crash temporary file is deleted at open	client/outbox.go	s/_ = os\.Rename\(filepath\.Join\(o\.dir, e\.Name\(\)\), filepath\.Join\(o\.dir, e\.Name\(\)\+\"\.suspect\"\)\)/_ = os.Remove(filepath.Join(o.dir, e.Name()))/	./client/
CLIENT: a drain goes past a record that is not queued	client/outbox.go	s/if r\.State != StateQueued \{\n\t\t\treturn sent, nil/if r.State != StateQueued {\n\t\t\tcontinue/	./client/
CLIENT: a drain goes on after a failure	client/outbox.go	s/\tdefault:\n\t\t\treturn sent, nil\n\t\t\}\n\t\}\n\treturn sent, nil/\tdefault:\n\t\t}\n\t}\n\treturn sent, nil/	./client/
CLIENT: a refusal does not mark the record	client/outbox.go	s/case res\.Outcome == OutcomeRefused \&\& res\.Sent \|\| res\.Outcome == OutcomeInvalid \|\| res\.Outcome == OutcomeNotFound:/case res.Outcome == OutcomeInvalid || res.Outcome == OutcomeNotFound:/	./client/
CLIENT: a drain past its limit sends the new write	client/outbox.go	s/if seq != 0 \&\& r\.Seq >= seq \{/if false {/	./client/	accepted: the in-flight lock that the writing call holds on its own new record also keeps a drain off it, so the limit and the lock both stop the drain
CLIENT: a reply key is not derived	client/call.go	s/return \"reply-\" \+ messageID/return messageID/	./client/
CLIENT: doctor hides a hold	client/call.go	s/d\.Held = c\.Outbox\.Held\(\)//	./client/
CLIENT: doctor does not say dev	client/call.go	s/, Dev: devBuildNow\}/}/	./client/
CLIENT: not_ready is not exit 7 in the helper	client/result.go	s/Outcome: OutcomeNotReady, Reason: str\(\"not_ready\"\)/Outcome: OutcomeRefused, Reason: str(\"endpoint\")/	./client/
CLIENT: records of other services are drained	client/outbox.go	s/if service != "" \&\& r\.Service != service \{/if false {/	./client/	accepted: sendRecord also refuses a record of another service (defence in depth), so the drain filter and that check hide each other
CLIENT: a stale non-dedup queued record is not set aside	client/outbox.go	s/strictDecode\(r\.Request, \&sr\) == nil \&\& sr\.Dedup == \"\" \{/strictDecode(r.Request, \&sr) == nil \&\& false {/	./client/
CLIENT: a suspect file holds the order	client/outbox.go	s/if strings\.HasSuffix\(name, \"\.bad\"\) \{/if strings.HasSuffix(name, \".bad\") || strings.HasSuffix(name, \".suspect\") {/	./client/
CLIENT: a discarded file is renamed like a resolved one	client/outbox.go	s/to = name \+ \"\.discarded\"/to = name + \".resolved\"/	./client/
CLIENT: a dedup record can be abandoned	client/outbox.go	s/ \|\| sr\.Dedup != \"\" \{/ {/	./client/
CLIENT: a record that is not unknown can be abandoned	client/outbox.go	s/if r\.State != StateUnknown \|\| strictDecode/if strictDecode/	./client/
CLIENT: abandon leaves no audit line	client/outbox.go	s/\t\to\.audit\(AuditEntry\{Verb: \"abandon\"[^\n]*\n//	./client/
CLIENT: a drain sends a non-dedup record	client/outbox.go	s/if sr\.Dedup == \"\" \{\n(\t\t\t\/\/[^\n]*\n)\t\t\tcontinue/if false {\n$1\t\t\tcontinue/	./client/
CLIENT: an unknown unordered record blocks a drain	client/outbox.go	s/ \|\| sr\.Unordered \&\& r\.State == StateUnknown//	./client/
CLIENT: an abandoned record blocks a drain	client/outbox.go	s/r\.State == StateRefused \|\| r\.State == StateAbandoned/r.State == StateRefused/	./client/
CLIENT: a hold blocks an unordered write	client/outbox.go	s/if bad > 0 \&\& !req\.Unordered \{/if bad > 0 {/	./client/
CLIENT: a delete is not made durable	client/outbox.go	s/return err\n\t\}\n\treturn o\.syncDir\(o\.dir\)\n\}\n\n\/\/ Purge/return err\n\t}\n\treturn nil\n}\n\n\/\/ Purge/	./client/
CLIENT: purge keeps abandoned records	client/outbox.go	s/if r\.State == StateRefused \|\| r\.State == StateAbandoned \{/if r.State == StateRefused {/	./client/
CLIENT: purge leaves no audit line	client/outbox.go	s/\t\to\.audit\(AuditEntry\{Verb: \"purge\"[^\n]*\n//	./client/
CLIENT: resolve leaves no audit line	client/outbox.go	s/\t\to\.audit\(AuditEntry\{Verb: \"resolve\"[^\n]*\n//	./client/
CLIENT: doctor does not list files set aside	client/outbox.go	s/s\.Aside\+\+/_ = s/	./client/
CLIENT: an unordered write waits behind the queue	client/call.go	s/if !r\.Unordered \&\& c\.ahead\(rec\) \{/if c.ahead(rec) {/	./client/
CLIENT: an unordered record blocks later writes	client/call.go	s/ \&\& !unorderedRecord\(o\)//	./client/
CLIENT: an abandoned record may be sent again	client/call.go	s/case StateRefused, StateAbandoned:/case StateRefused:/	./client/
CLIENT: the unordered flag is not stored	client/call.go	s/Dedup: r\.Dedup, Unordered: r\.Unordered, Body: r\.Body,/Dedup: r.Dedup, Body: r.Body,/	./client/
CLIENT: reconcile leaves no audit line	client/call.go	s/\t\tc\.Outbox\.audit\(AuditEntry\{Verb: \"reconcile\"[^\n]*\n//	./client/
CLIENT: doctor hides the binary	client/call.go	s/d\.Binary, _ = os\.Executable\(\)/_ = os.Executable; d.Binary = \"\"/	./client/
CLIENT: sent is not set at GotConn	client/call.go	s/GotConn: func\(httptrace\.GotConnInfo\) \{ sent = true \},//	./client/
CLIENT: an unordered body is not capped	client/outbox.go	s/if req\.Unordered \&\& len\(req\.Body\) > MaxUnorderedBody \{/if false {/	./client/
CLIENT: an ordinary write may eat the reserved records	client/outbox.go	s/o\.maxRecords-reserveN/o.maxRecords-reserveN*0/	./client/
CLIENT: an ordinary write may eat the reserved bytes	client/outbox.go	s/o\.maxBytes-reserveB/o.maxBytes-reserveB*0/	./client/
CLIENT: set-aside files do not count toward the bound	client/outbox.go	s/asideN, asideB := o\.aside\(\)/asideN, asideB := 0, 0/	./client/
CLIENT: the unordered record bound is not kept	client/outbox.go	s/if len\(recs\) >= o\.maxRecords \|\| used\+len\(canon\) > o\.maxBytes \{/if used+len(canon) > o.maxBytes {/	./client/
CLIENT: the unordered byte bound is not kept	client/outbox.go	s/if len\(recs\) >= o\.maxRecords \|\| used\+len\(canon\) > o\.maxBytes \{/if len(recs) >= o.maxRecords {/	./client/
CLIENT: the audit log is not rotated	client/outbox.go	s/fi\.Size\(\) >= MaxAuditBytes/fi.Size() >= MaxAuditBytes \&\& false/	./client/
CLIENT: the record lock is not taken	client/outbox.go	s/if err := syscall\.Flock\(int\(f\.Fd\(\)\), syscall\.LOCK_EX\|syscall\.LOCK_NB\); err != nil \{\n\t\tf\.Close\(\)\n\t\treturn nil, ErrDrainBusy/if false {\n\t\tf.Close()\n\t\treturn nil, ErrDrainBusy/	./client/
CLIENT: a drain sends a record another process holds	client/outbox.go	s/if lerr != nil \{/if lerr != nil \&\& false {/	./client/
CLIENT: the evidence sink is not called	client/outbox.go	s/if o\.Evidence != nil \&\& \(e\.Verb == \"abandon\" \|\| e\.Verb == \"resolve\"\) \{/if false {/	./client/
CLIENT: abandon needs no evidence	client/outbox.go	s/if evidence == \"\" \|\| \(observed/if (observed/	./client/
CLIENT: abandon takes any observation	client/outbox.go	s/ \|\| \(observed != ObservedApplied \&\& observed != ObservedNotApplied \&\& observed != ObservedUnknown\)//	./client/
CLIENT: an abandoned record keeps no resolution	client/outbox.go	s/r\.Resolution = \&Resolution\{[^\n]*\n/r.Resolution = nil; _ = at\n/	./client/
CLIENT: an over-cap unordered write is not invalid	client/call.go	s/case errors\.Is\(err, ErrTooBig\):/case false:/	./client/
plan file: keys in another case are accepted	plan.go	s/!bytes\.Equal\(have, want\)/!bytes.Equal(have, have) \&\& len(want) < 0/	./...
plan file: a file that is not canonical-clean is accepted	plan.go	s/if err != nil \{\n\t\treturn planDoc\{\}, Usagef\(\"the plan file is not canonical-JSON clean/if err != nil \&\& false {\n\t\treturn planDoc{}, Usagef(\"the plan file is not canonical-JSON clean/	./...	accepted: with this check gone the byte comparison still refuses the same files (a duplicate key makes the canonical forms differ); the check stays for its clearer error
plan: a non-UTF-8 value is accepted	plan.go	s/!utf8\.ValidString\(ch\.Target\) \|\| !utf8\.ValidString\(ch\.Before\) \|\| !utf8\.ValidString\(ch\.After\)/!utf8.ValidString(\"\")/	./...
plan: a duplicate target is accepted	plan.go	s/if seen\[ch\.Target\] \{/if false {/	./...
plan: help hides the exit 1 of plan	plan.go	s/Output: SchemaPlan, Exits: \[\]ExitCode\{ExitFailed\}, Run: a\.runPlan\}/Output: SchemaPlan, Run: a.runPlan}/	./...
apply: help hides the exit 4 of apply	plan.go	s/ExitFailed, ExitRefused, ExitNotFound\}/ExitFailed, ExitRefused}/	./...
apply: a half-done hook failure is called failed	plan.go	s/if same, err := unchanged\(func\(ch Change\) string \{ return ch\.Before \}\); err == nil \&\& same \{\n\t\tout\.Undo, out\.Backup/if true {\n\t\tout.Undo, out.Backup/	./...
apply: a verified put-back is not undone	plan.go	s/return finish\(OutcomeUndone, \"apply\"\)/return finish(OutcomeFailed, \"apply\")/	./...
apply: a failed put-back is not recovery_required	plan.go	s/return finish\(OutcomeRecoveryRequired, \"apply\"\)/return finish(OutcomeFailed, \"apply\")/	./...
apply: a failed backup does not stop the apply	plan.go	s/(if err != nil)( \{\n\t\tfmt\.Fprintf\(c\.Stderr, \"%s: backup:)/$1 \&\& false$2/	./...
backup directory mode too open	plan.go	s/os\.MkdirAll\(dir, 0o700\)/os.MkdirAll(dir, 0o755)/	./...
apply: an empty plan is applied	plan.go	s/if len\(plan\.Changes\) == 0 \{\n\t\treturn finish\(OutcomeOK, \"\"\)/if false {\n\t\treturn finish(OutcomeOK, \"\")/	./...
subjects: a duplicate name is accepted	plan.go	s/case seen\[s\.Name\]:/case false:/	./...
subjects: a missing hook is accepted	plan.go	s/case s\.Plan == nil \|\| s\.Read == nil \|\| s\.Apply == nil:/case false:/	./...
subjects: a relative StateDir is accepted	plan.go	s/a\.StateDir == \"\" \|\| !filepath\.IsAbs\(a\.StateDir\)/a.StateDir == \"\"/	./...
undo path is not quoted	plan.go	s/strings\.Trim\(p, \"[^\"]*\"\) == \"\"/true/	./...
plan text echoes a target raw	plan.go	s/strconv\.QuoteToASCII\(ch\.Target\)/ch.Target/	./...
a read error is echoed unfolded	plan.go	s/a\.Name, s\.Name, oneLine\(err\.Error\(\)\)\)/a.Name, s.Name, err.Error())/	./...
an unknown subject is echoed	plan.go	s/unknown subject %s; this app has %v\", shown\(name\)/unknown subject %s; this app has %v\", name/	./...
the app version need not be a RESULT word	app.go	s/case !wordRe\.MatchString\(a\.Version\):/case false:/	./...
canonical: invalid UTF-8 is accepted	canonical.go	s/if !utf8\.Valid\(doc\) \{/if !utf8.Valid(doc) \&\& false {/	./...
canonical: a lone surrogate is accepted	canonical.go	s/if loneSurrogate\(doc\) \{/if false {/	./...
canonical: a lone low surrogate is accepted	canonical.go	s/case r >= 0xDC00 \&\& r <= 0xDFFF:\n\t\t\t\treturn true/case r >= 0xDC00 \&\& r <= 0xDFFF:\n\t\t\t\treturn false/	./...
canonical: a high surrogate may be followed by anything	canonical.go	s/low < 0xDC00 \|\| low > 0xDFFF/low < 0xDC00 || low > 0xFFFF/	./...
digest: no size bound	canonical.go	s/if len\(doc\) > MaxDigestBytes \{/if false {/	./...
guard: a relative path is accepted	update.go	s/if !filepath\.IsAbs\(path\) \{\n\t\treturn Refused\(\"protected\", \"a path to guard must be absolute\"\)/if false {\n\t\treturn Refused(\"protected\", \"a path to guard must be absolute\")/	./...
protected: a removed or new entry is not a touch	update.go	s/if len\(now\) != len\(before\) \{\n\t\treturn true, nil\n\t\}//	./...
protected: a changed prefix is not a touch	update.go	s/if err != nil \|\| sum != was\.Sum \{/if err != nil || sum != was.Sum \&\& false {/	./...
protected: a mode change is not a touch	update.go	s/!ok \|\| is\.Mode != was\.Mode/!ok/	./...
protected: not checked before the switch	update.go	s/\tif r\.touchedProtected\(\) \{\n\t\terr := errors\.New\(\"a step touched a protected path; nothing was switched\"\)/\tif false {\n\t\terr := errors.New(\"a step touched a protected path; nothing was switched\")/	./...
protected: not checked after the proof	update.go	s/if err == nil \&\& r\.touchedProtected\(\) \{/if false {/	./...
protected: no snapshot is taken for an update	update.go	s/\t\tr\.protectedBefore = snap\n\t\}\n\trel, err := u\.Fetch/\t\t_ = snap\n\t}\n\trel, err := u.Fetch/	./...
live: an unknown state is not live	update.go	s/if err == nil \&\& \(st\.Live == nil \|\| !\*st\.Live\) \{/if err != nil || (st.Live == nil || !*st.Live) {/	./...
live: no idle fence is needed	update.go	s/if u\.Fence == nil \{\n\t\tif err != nil \{/if false {\n\t\tif err != nil {/	./...
recover: current is not proved before acting	update.go	s/err := r\.proveAsIs\(cur\)\n\t\tif err == nil \&\& !r\.touchedProtected\(\) \{/err := errors.New(\"skipped\")\n\t\tif err == nil \&\& !r.touchedProtected() {/	./...
recover: acts without the live rule	update.go	s/if reason, err := r\.liveGate\(\); err != nil \{\n\t\treturn r\.finish\(OutcomeRefused, reason, err\)/if reason, err := r.liveGate(); err != nil \&\& false {\n\t\treturn r.finish(OutcomeRefused, reason, err)/	./...
recover: an unreadable intent is not cleared once proved	update.go	s/\(in\.Step == \"unreadable\" \|\| cur == in\.From \|\| cur == in\.To\)/(cur == in.From || cur == in.To)/	./...
recover: an apply intent is not read	update.go	s/if in\.Kind == \"apply\" \{\n\t\treturn r\.recoverApply\(in\)\n\t\}//	./...
recover apply: a mix is cleared	update.go	s/if allBefore \|\| allAfter \{/if true {/	./...
recover apply: all-before is not cleared	update.go	s/allBefore = allBefore \&\& ok \&\& v == ch\.Before/allBefore = false/	./...
recover apply: all-after is not cleared	update.go	s/allAfter = allAfter \&\& ok \&\& v == ch\.After/allAfter = false/	./...
the directory is not synced after an atomic file write	update.go	s/return syncDir\(filepath\.Dir\(path\)\)/return nil/	./...	accepted: a directory sync is a durability property no test in one process can observe; the code is read in review
the directory is not synced after the switch	update.go	s/return syncDir\(u\.Root\)/return nil/	./...	accepted: see the directory sync above
the directory is not synced after clearing the intent	update.go	s/return syncDir\(a\.StateDir\)/return nil/	./...	accepted: see the directory sync above
a hook error is printed raw in text mode	update.go	s/r\.a\.Name, oneLine\(cause\.Error\(\)\)\)/r.a.Name, cause.Error())/	./...
an intent field is printed raw	update.go	s/what, shown\(in\.Step\), a\.Name\)/what, in.Step, a.Name)/	./...
a lock failure is called busy	update.go	s/if errors\.As\(err, \&e\) \&\& e\.Code == ExitFailed \{/if errors.As(err, \&e) \&\& e.Code == ExitFailed \&\& false {/	./...
update --check takes the lock	update.go	s/if !\(r\.doc\.CheckOnly \&\& verb == \"update\"\) \{/if true {/	./...
a stale install directory is kept	update.go	s/(err := syscall\.Kill\(pid, 0\); )err == nil/$1true || err == nil/	./...
a recovery_required going back has no backup path	update.go	s/r\.doc\.Backup = u\.versionDir\(from\)\n\t\t\}\n\t\treturn r\.finish\(OutcomeRecoveryRequired, \"recovery_required\", fmt\.Errorf\(\"%v; and going back failed/_ = from\n\t\t}\n\t\treturn r.finish(OutcomeRecoveryRequired, \"recovery_required\", fmt.Errorf(\"%v; and going back failed/	./...
an apply writes no intent	plan.go	s/\tif err := a\.writeIntent\(intent\{App: a\.Name, Step: \"apply\", Kind: \"apply\", Subject: s\.Name, PlanID: plan\.PlanID, Backup: path, Changes: plan\.Changes\}\); err != nil \{/\tif err := error(nil); err != nil {/	./...
a failed apply leaves its intent	plan.go	s/if o != OutcomeRecoveryRequired \{\n\t\t\tif err := a\.clearIntent\(\)/if o == OutcomeRecoveryRequired {\n\t\t\tif err := a.clearIntent()/	./...
guard: a protected path overlap is not refused	update.go	s/if overlaps\(p, path\) \{\n\t\t\treturn Refused\(\"protected\", \"a path overlaps/if false \&\& overlaps(p, path) {\n\t\t\treturn Refused(\"protected\", \"a path overlaps/	./...
protected: a step touching the install is not caught after install	update.go	s/\tif r\.touchedProtected\(\) \{\n\t\t_ = os\.RemoveAll\(dest\)/\tif false {\n\t\t_ = os.RemoveAll(dest)/	./...
guard: a path with .. after a link is accepted	update.go	s/if el == \"\.\.\" \{/if el == \"..\" \&\& false {/	./...
a version named like an install temp is accepted	update.go	s/ \&\& !strings\.Contains\(v, \"\.tmp-\"\)//	./...
protected: a file may grow although it is not append-only	update.go	s/is\.Size != was\.Size \&\& !u\.appendOnly\(path\)/false/	./...
protected: an append-only path outside the protected paths is accepted	update.go	s/if !filepath\.IsAbs\(p\) \|\| !in \{/if false \&\& !in {/	./...
protected: a retargeted link is not a touch	update.go	s/ \|\| is\.Link != was\.Link//	./...
protected: a touched install ends refused, not failed	update.go	s/return r\.finish\(OutcomeFailed, \"protected\", errors\.New\(\"a step touched a protected path; nothing was switched\. The touch/return r.finish(OutcomeRefused, \"protected\", errors.New(\"a step touched a protected path; nothing was switched. The touch/	./...
recover is not registered without an updater	update.go	s/if len\(a\.Subjects\) > 0 \{\n\t\t\treturn \[\]Command\{recoverCmd\}/if false {\n\t\t\treturn []Command{recoverCmd}/	./...
recover: the as-is proof does not ask Ready	update.go	s/err := u\.Ready\(r\.c\.Context, time\.Time\{\}, v\)/err := error(nil)/	./...
a hook-supplied reason is printed raw	update.go	s/\(%s\)\", shown\(reason\)\)/(%s)\", reason)/	./...
guard: a dangling link is accepted	update.go	s/if _, dangling := walk\(path\); dangling \{/if _, dangling := walk(path); dangling \&\& false {/	./...
protected: AppendOnly is not resolved like the snapshot keys	update.go	s/ \|\| within\(resolved\(p\), path\)//	./...
protected: a protected root that is a link is not resolved	update.go	s/if r, err := filepath\.EvalSymlinks\(p\); err == nil \{\n\t\t\troot = r/if r, err := filepath.EvalSymlinks(p); err == nil \&\& false {\n\t\t\troot = r/	./...
help: recover's schema is not listed without an updater	app.go	s/if a\.Updater != nil \|\| len\(a\.Subjects\) > 0 \{/if a.Updater != nil {/	./...
a run reads AppendOnly live, not once	update.go	s/cp\.AppendOnly = append\(\[\]string\(nil\), u\.AppendOnly\.\.\.\)/cp.AppendOnly = u.AppendOnly/	./...
walk: a link's target components are not followed	update.go	s/todo = append\(strings\.Split\(target, sep\), todo\.\.\.\)/_ = target/	./...
walk: an absolute link does not restart from the root	update.go	s/out, cur = out\[:1\], sep/out, cur = out[:len(out)], cur/	./...
walk: .. does not pop the directory reached	update.go	s/if len\(out\) > 1 \{/if len(out) > 1 \&\& false {/	./...
walk: an unresolvable link is not reported	update.go	s/err != nil \|\| serr != nil \|\|/err != nil || serr != nil \&\& false ||/	./...
overlaps: the first is not tested as an ancestor of the second	update.go	s/hasPrefix\(ea, eb\) \|\| //	./...
overlaps: the second is not tested as an ancestor of the first	update.go	s/ \|\| hasPrefix\(eb, ea\)//	./...
overlaps: an unresolvable path does not fail closed	update.go	s/return da \|\| db \|\| /return da \&\& false || db \&\& false || /	./...
sameElem: existing components are not compared by identity	update.go	s/return os\.SameFile\(x\.fi, y\.fi\)/return false/	./...
sameElem: missing components are not compared by name	update.go	s/sameName\(x\.name, y\.name\)/true/	./...
walk: the link hop cap is removed	update.go	s/ \|\| hops >= 40 \{/ || hops >= 4000000 {/	./...	accepted: a looping link already fails the stat before the cap is reached, so the cap only bounds the walk if that stat is ever relaxed
sameName: ASCII case is not folded	update.go	s/if strings\.EqualFold\(x, y\) \{/if x == y {/	./...
sameName: two non-ASCII names are not taken to be one	update.go	s/return !ascii\(x\) \&\& !ascii\(y\)/return !ascii(x) \&\& !ascii(y) \&\& false/	./...
validate: a dangling protected link is not named	update.go	s/if _, dangling := walk\(p\); dangling \{\n\t\t\treturn fmt/if _, dangling := walk(p); dangling \&\& false {\n\t\t\treturn fmt/	./...
CLIENT: a TLS record error after the send is a refusal	client/call.go	s/case isTLS\(err\) \&\& !sent:/case isTLS(err):/	./client/
CLIENT: a request path is not validated	client/call.go	s/return pathRe\.MatchString\(p\) \&\& !strings\.Contains\(p, "\.\."\) \&\& !strings\.ContainsAny\(p, "\\\\#"\)/return !strings.Contains(p, "..")/	./client/
CLIENT: the request origin is not compared with the pin	client/call.go	s/if req\.URL\.Scheme\+"\:\/\/"\+req\.URL\.Host != c\.Endpoint\.Origin \|\| req\.URL\.User != nil \{/if false {/	./client/	accepted: validPath already admits only a path that starts with a slash and holds no authority, so the origin compare is defence in depth that no input can reach
CLIENT: the doctor probe skips the audience pin	client/call.go	s/\(c\.Endpoint\.Credential \&\& \(audience == "" \|\| audience != c\.Endpoint\.Audience\)\) \{\n\t\treturn d/(false) {\n\t\treturn d/	./client/
CLIENT: a drain with no service is allowed	client/call.go	s/if !validService\(c\.Service\) \{\n\t\treturn 0, errors\.New\("a drain needs/if false {\n\t\treturn 0, errors.New("a drain needs/	./client/
CLIENT: a record is sent by another service's client	client/call.go	s/if \(c\.Service != "" \&\& rec\.Service != c\.Service\) \|\|/if false ||/	./client/
CLIENT: a record is sent to another audience	client/call.go	s/\(c\.Endpoint\.Credential \&\& \(r\.Audience == "" \|\| r\.Audience != c\.Endpoint\.Audience\)\) \{/(false) {/	./client/
CLIENT: a call for another service is sent	client/call.go	s/if c\.Service != "" \&\& r\.Service != c\.Service \{/if false {/	./client/
CLIENT: a held record is returned without its lock	client/outbox.go	s/if err != nil \{\n\t\t\t\treturn Record\{\}, nil, ErrDrainBusy\n\t\t\t\}\n\t\t\treturn r, lk, nil/_ = err\n\t\t\treturn r, lk, nil/	./client/
CLIENT: spooled although the queued state was not stored	client/call.go	s/if err := c\.Outbox\.SetState\(rec, StateQueued\); err != nil \{\n\t\t\t\treturn c\.result\(r, OutcomeRefused, false, "outbox"\)/if err := c.Outbox.SetState(rec, StateQueued); err != nil \&\& false {\n\t\t\t\treturn c.result(r, OutcomeRefused, false, "outbox")/	./client/
CLIENT: reconcile ends a record on an unsent answer	client/call.go	s/\t\t\tif res\.Sent \{/\t\t\tif true {/	./client/
CLIENT: the envelope is not stored	client/call.go	s/\t\tEnvelope: r\.Envelope,\n\t\}\)/\t})/	./client/
CLIENT: the stored envelope is not sent again	client/call.go	s/Dedup: sr\.Dedup, Envelope: sr\.Envelope,/Dedup: sr.Dedup,/	./client/
CLIENT: abandon ignores the in-flight lock	client/outbox.go	s/lk, err := o\.lockRecord\(r\)\n\t\tif err != nil \{\n\t\t\treturn ErrDrainBusy\n\t\t\}\n\t\tdefer lk\.Release\(\)/lk, err := o.lockRecord(r)\n\t\t_ = err\n\t\tdefer lk.Release()/	./client/
CLIENT: resolve accepts empty evidence	client/outbox.go	s/if evidence == "" \{\n\t\treturn 0, errors\.New\("resolve needs the evidence"\)/if false {\n\t\treturn 0, errors.New("resolve needs the evidence")/	./client/
CLIENT: a spooled result needs no record	client/result.go	s/if r\.SpoolID == nil \|\| r\.Sent \{/if false {/	./client/
CLIENT: a dispatch_unknown result needs no record	client/result.go	s/if r\.SpoolID == nil \|\| !r\.Sent \{/if false {/	./client/
CLIENT: a release build reads the environment	client/endpoint.go	s/if host == nil \&\& !devBuildNow \{/if host == nil \&\& false {/	./client/
