# name<TAB>file<TAB>perl substitution<TAB>packages. Each must make the tests fail; a survivor is a guard no test watches.
# Run by `make kit-verify` through scripts/mutate.sh (copied from zeoarchitect scripts/mutate.sh at 35f6681).
single-dash flag after the verb	app.go	s/case strings\.HasPrefix\(t, \"-\"\) && t != \"-\":/case false:/	./...
single-dash flag in verb position	app.go	s/if !strings\.HasPrefix\(verb, \"--\"\) \{/if false {/	./...
unknown flag is refused	app.go	s/if !ok \{\n\t\t\t\treturn Usagef\(\"unknown flag/if !ok \&\& false {\n\t\t\t\treturn Usagef(\"unknown flag/	./...
unknown command is refused	app.go	s/if !ok \{\n\t\treturn Usagef\(\"unknown command/if !ok \&\& false {\n\t\treturn Usagef(\"unknown command/	./...
positional count is bounded	app.go	s/if len\(c\.Args\) > cmd\.MaxArgs \{/if false {/	./...
a value flag needs its value	app.go	s/if i\+1 >= len\(rest\) \{/if false {/	./...
a no-value flag refuses a value	app.go	s/\} else if !f\.TakesValue && hasVal \{/} else if false {/	./...
an app cannot shadow a kit verb	app.go	s/case seen\[c\.Name\]:/case false:/	./...
a command needs a Run	app.go	s/case c\.Run == nil:/case false:/	./...
no command is a usage error	app.go	s/if len\(args\) == 0 \{/if false {/	./...
--json goes to stderr for the RESULT line	app.go	s/if c\.JSON \{\n\t\tw = c\.Stderr/if false {\n\t\tw = c.Stderr/	./...
the exit table: not_ready is 7	exit.go	s/ExitNotReady    ExitCode = 7/ExitNotReady    ExitCode = 6/	./...
the exit table: usage is 2	exit.go	s/ExitUsage       ExitCode = 2/ExitUsage       ExitCode = 3/	./...
ExitOnly(ok) is nil	exit.go	s/if code == ExitOK \{\n\t\treturn nil\n\t\}//	./...
doctor exits 7 when not ready	verbs.go	s/if !ready \{\n\t\treturn ExitOnly\(ExitNotReady\)/if false {\n\t\treturn ExitOnly(ExitNotReady)/	./...
a failing check names its next step	verbs.go	s/if ck\.Next == \"\" \{/if false {/	./...
a skipped check is not a failure	verbs.go	s/if !ck\.OK && !ck\.Skipped \{\n\t\t\tready = false/if !ck.OK {\n\t\t\tready = false/	./...
status exits 1 when unhealthy	verbs.go	s/if !st\.Healthy \{\n(\t\tfmt\.Fprintf[^\n]*\n)?\t\treturn ExitOnly\(ExitFailed\)/if false {\n\t\treturn ExitOnly(ExitFailed)/	./...
status state is checked	verbs.go	s/if !validStates\[st\.State\] \{/if false {/	./...
version defaults to unsigned	verbs.go	s/state, signer := SignatureUnsigned, \"\"/state, signer := SignatureVerified, \"\"/	./...
the signature state is checked	verbs.go	s/\tdefault:\n\t\treturn Failed\(\"signature state/\tcase \"never\":\n\t\treturn Failed(\"signature state/	./...
RESULT: ok carries no reason	result.go	s/case r\.Outcome == OutcomeOK && r\.Reason != \"\":/case false:/	./...
RESULT: a non-ok outcome needs a reason	result.go	s/case r\.Outcome != OutcomeOK && r\.Reason == \"\":/case false:/	./...
RESULT: the reason is one token	result.go	s/case r\.Reason != \"\" && !reasonRe\.MatchString\(r\.Reason\):/case false:/	./...
RESULT: the outcome is checked	result.go	s/if !r\.Outcome\.valid\(\) \{/if false {/	./...
RESULT: undo is one line	result.go	s/if strings\.ContainsAny\(r\.Undo, \"\\n\\r\"\) \{/if false {/	./...
RESULT: a refusal exits 3	result.go	s/case OutcomeRefused:\n\t\treturn ExitRefused/case OutcomeRefused:\n\t\treturn ExitFailed/	./...
recovery_required is not safe to retry	result.go	s/return o != OutcomeRecoveryRequired/return true/	./...
every outcome but ok and a refusal is exit 1	result.go	s/default:\n\t\treturn ExitFailed\n\t\}\n\}\n\n\/\/ SafeToRetry/default:\n\t\treturn ExitOK\n\t}\n}\n\n\/\/ SafeToRetry/	./...
help is built from the command table	verbs.go	s/for _, c := range a\.Commands \{\n\t\tadd\(c, false\)/for range a.Commands {\n\t\t_ = add/	./...
stale state is not refused	plan.go	s/if v, ok := now\[ch\.Target\]; !ok \|\| v != ch\.Before \{/if v, ok := now[ch.Target]; (!ok || v != ch.Before) \&\& false {/	./...
shared apply needs no plan	plan.go	s/if s\.Shared \{/if false {/	./...
plan_id not rechecked	plan.go	s/if want\.PlanID != doc\.PlanID \|\| want\.Empty != doc\.Empty \{/if (want.PlanID != doc.PlanID || want.Empty != doc.Empty) \&\& false {/	./...
plan file app and subject not checked	plan.go	s/case doc\.App != a\.Name \|\| doc\.Subject != subject:/case false:/	./...
plan file schema not checked	plan.go	s/case doc\.Schema != SchemaPlan:/case false:/	./...
unknown plan field allowed	plan.go	s/dec\.DisallowUnknownFields\(\)//	./...	accepted: apply --plan's byte comparison against what the kit would have written also refuses an unknown field; the decoder's own refusal stays as the first, plainer error
oversized plan accepted	plan.go	s/if len\(raw\) > maxPlanBytes \{/if false {/	./...
undo not swapped	plan.go	s/Before: ch\.After, After: ch\.Before/Before: ch.Before, After: ch.After/	./...
backup mode too open	plan.go	s/0o600/0o644/	./...
backup not written before apply	plan.go	s/path, err := a\.writeBackup\(s\.Name, plan\.PlanID, undo\)/_, _ = a.writeBackup(s.Name, plan.PlanID, undo); path, err := "", error(nil)/	./...
changes not sorted	plan.go	s/return changes\[i\]\.Target < changes\[j\]\.Target/return false/	./...
failed apply keeps its undo	plan.go	s/\t\tout\.Undo = ""\n//	./...
canonical keys unsorted	canonical.go	s/return slicesCompareUTF16\(members\[i\]\.key, members\[j\]\.key\) < 0/return false/	./...
canonical duplicate key allowed	canonical.go	s/if seen\[key\] \{/if false {/	./...
canonical integer bound dropped	canonical.go	s/i > 1<<53-1 \|\| i < -\(1<<53-1\)/i == 1<<62/	./...
canonical trailing data allowed	canonical.go	s/if _, err := dec\.Token\(\); !errors\.Is\(err, io\.EOF\) \{/if _, err := dec.Token(); !errors.Is(err, io.EOF) \&\& false {/	./...
canonical escapes control characters raw	canonical.go	s/if r < 0x20 \{/if false {/	./...
intent not checked before a change	update.go	s/if in != nil \{\n\t\twhat := /if in != nil \&\& false {\n\t\twhat := /	./...
intent not written before the switch	update.go	s/if err := a\.writeIntent\(intent\{App: a\.Name, From: from, To: to, Step: "switch"\}\); err != nil \{/if err := error(nil); err != nil {/	./...
intent cleared after a failed switch-back	update.go	s/\t\treturn r\.finish\(OutcomeRecoveryRequired, "recovery_required", fmt\.Errorf\("%v; and going back failed: %v", cause, err\)\)/\t\t_ = r.a.clearIntent()\n\t\treturn r.finish(OutcomeRecoveryRequired, "recovery_required", fmt.Errorf("%v; and going back failed: %v", cause, err))/	./...
failure after switch not switched back	update.go	s/err = u\.switchTo\(from\)\n\t\tr\.step\("switch-back"/err = error(nil)\n\t\tr.step("switch-back"/	./...
switch back not verified	update.go	s/\t\tif err == nil \{\n\t\t\terr = r\.prove\(from, t0\)\n\t\t\}/\t\tif false {\n\t\t\terr = r.prove(from, t0)\n\t\t}/	./...
new version not verified after switch	update.go	s/\tif err == nil \{\n\t\terr = r\.prove\(to, t0\)\n\t\}/\tif false {\n\t\terr = r.prove(to, t0)\n\t}/	./...
ready not required	update.go	s/\tif u\.Ready != nil \{\n\t\terr := u\.Ready/\tif u.Ready != nil \&\& false {\n\t\terr := u.Ready/	./...
busy lock not taken	update.go	s/syscall\.Flock\(int\(f\.Fd\(\)\), syscall\.LOCK_EX\|syscall\.LOCK_NB\)/error(nil)/	./...
downgrade allowed	update.go	s/case cmp < 0 \&\& r\.doc\.Verb == "update":/case false:/	./...
same version allowed	update.go	s/case cmp == 0:/case false:/	./...
unsafe version path allowed	update.go	s/if !validVersion\(rel\.Version\) \{/if false {/	./...
unsafe --to allowed	update.go	s/if to != "" \&\& !validVersion\(to\) \{/if false {/	./...
live rule dropped	update.go	s/if err == nil \&\& \(st\.Live == nil \|\| !\*st\.Live\) \{/if true || err == nil \&\& (st.Live == nil || !*st.Live) {/	./...
migration rollback allowed	update.go	s/if h\.Migrated \&\& u\.Down == nil \{/if false {/	./...
no previous allowed	update.go	s/if h\.Previous == "" \|\| !validVersion\(h\.Previous\) \{/if false {/	./...
recover clears without proof	update.go	s/\t\tif err := r\.prove\(v, t0\); err != nil \{\n\t\t\tlastErr = err\n\t\t\tcontinue\n\t\t\}/\t\t_ = r.prove(v, t0)/	./...
stop failure not restarted	update.go	s/if u\.Start != nil \{\n\t\tif err := r\.hook\("start-old"/if false {\n\t\tif err := r.hook("start-old"/	./...
apply ignores recovery	plan.go	s/if err := a\.refuseIfRecovery\(\); err != nil \{\n\t\tfmt/if false {\n\t\tfmt/	./...
down migration skipped	update.go	s/\tif down \{\n\t\tif err := u\.Down/\tif false {\n\t\tif err := u.Down/	./...
rename not atomic symlink	update.go	s/if err := os\.Rename\(tmp, u\.current\(\)\); err != nil \{/_ = os.Remove(u.current()); if err := os.Rename(tmp, u.current()); err != nil {/	./...	accepted: the gap between remove and rename cannot be observed by a test in one process; the single rename(2) of a new symlink is what review reads
an error message is folded to one printable line	app.go	s/if strconv\.IsPrint\(r\) \{/if strconv.IsPrint(r) || true {/	./...
only a plain name is echoed	app.go	s/if flagNameRe\.MatchString\(s\) \{/if true {/	./...
a plain single-dash flag is named	app.go	s/case flagNameRe\.MatchString\(name\):/case false:/	./...
-h points at --help	app.go	s/case name == "h":/case false:/	./...
--help is help	app.go	s/if args\[0\] == "--help" \{/if false {/	./...
a command name is validated	app.go	s/case !nameRe\.MatchString\(c\.Name\):/case false:/	./...
a command cannot list a code outside the table	app.go	s/if !e\.inTable\(\) \|\| e == ExitOK \{/if false {/	./...
a command cannot end outside the table or with 0	app.go	s/if errors\.As\(err, &e\) && !e\.Code\.inTable\(\) \|\| e != nil && e\.Code == ExitOK \{/if false {/	./...
a command cannot end with 0 and a message	app.go	s/ \|\| e != nil && e\.Code == ExitOK \{/ {/	./...
version lists exit 1	app.go	s/Exits: \[\]ExitCode\{ExitFailed\}, Run: a\.runVersion/Run: a.runVersion/	./...
doctor lists exit 1	app.go	s/\[\]ExitCode\{ExitFailed, ExitNotReady\}/[]ExitCode{ExitNotReady}/	./...
RESULT words are printable ASCII	result.go	s/\^\[!#-<>-~\]\+\$/^[^\\s"=]+\$/	./...
RESULT totals refuse a repeated key	result.go	s/if seen\[p\.Key\] \{/if false {/	./...
RESULT totals refuse reserved keys	result.go	s/seen := map\[string\]bool\{"from": true, "to": true, "reason": true, "undo": true\}/seen := map[string]bool{}/	./...
doctor prints an empty list, not null	verbs.go	s/if checks == nil \{/if false {/	./...
an unhealthy status names itself on stderr	verbs.go	s/\t\tfmt\.Fprintf\(c\.Stderr, "%s: status: not healthy[^\n]*\n//	./...
RESULT: undo is escaped to ASCII	result.go	s/strconv\.QuoteToASCII\(r\.Undo\)/strconv.Quote(r.Undo)/	./...
plan file: keys in another case are accepted	plan.go	s/!bytes\.Equal\(have, want\)/!bytes.Equal(have, have) \&\& len(want) < 0/	./...
plan file: a file that is not canonical-clean is accepted	plan.go	s/if err != nil \{\n\t\treturn planDoc\{\}, Usagef\(\"the plan file is not canonical-JSON clean/if err != nil \&\& false {\n\t\treturn planDoc{}, Usagef(\"the plan file is not canonical-JSON clean/	./...	accepted: with this check gone the byte comparison still refuses the same files (a duplicate key makes the canonical forms differ); the check stays for its clearer error
plan: a non-UTF-8 value is accepted	plan.go	s/!utf8\.ValidString\(ch\.Target\) \|\| !utf8\.ValidString\(ch\.Before\) \|\| !utf8\.ValidString\(ch\.After\)/!utf8.ValidString(\"\")/	./...
plan: a duplicate target is accepted	plan.go	s/if seen\[ch\.Target\] \{/if false {/	./...
plan: help hides the exit 1 of plan	plan.go	s/Output: SchemaPlan, Exits: \[\]ExitCode\{ExitFailed\}, Run: a\.runPlan\}/Output: SchemaPlan, Run: a.runPlan}/	./...
apply: help hides the exit 4 of apply	plan.go	s/ExitFailed, ExitRefused, ExitNotFound\}/ExitFailed, ExitRefused}/	./...
apply: a half-done hook failure is called failed	plan.go	s/if same, err := unchanged\(func\(ch Change\) string \{ return ch\.Before \}\); err == nil \&\& same \{\n\t\tout\.Undo, out\.Backup/if true {\n\t\tout.Undo, out.Backup/	./...
apply: a verified put-back is not undone	plan.go	s/return finish\(OutcomeUndone, \"apply\"\)/return finish(OutcomeFailed, \"apply\")/	./...
apply: a failed put-back is not recovery_required	plan.go	s/return finish\(OutcomeRecoveryRequired, \"apply\"\)/return finish(OutcomeFailed, \"apply\")/	./...
apply: a failed backup does not stop the apply	plan.go	s/(if err != nil)( \{\n\t\tfmt\.Fprintf\(c\.Stderr, \"%s: backup:)/$1 \&\& false$2/	./...
backup directory mode too open	plan.go	s/os\.MkdirAll\(dir, 0o700\)/os.MkdirAll(dir, 0o755)/	./...
apply: an empty plan is applied	plan.go	s/if len\(plan\.Changes\) == 0 \{\n\t\treturn finish\(OutcomeOK, \"\"\)/if false {\n\t\treturn finish(OutcomeOK, \"\")/	./...
subjects: a duplicate name is accepted	plan.go	s/case seen\[s\.Name\]:/case false:/	./...
subjects: a missing hook is accepted	plan.go	s/case s\.Plan == nil \|\| s\.Read == nil \|\| s\.Apply == nil:/case false:/	./...
subjects: a relative StateDir is accepted	plan.go	s/a\.StateDir == \"\" \|\| !filepath\.IsAbs\(a\.StateDir\)/a.StateDir == \"\"/	./...
undo path is not quoted	plan.go	s/strings\.Trim\(p, \"[^\"]*\"\) == \"\"/true/	./...
plan text echoes a target raw	plan.go	s/strconv\.QuoteToASCII\(ch\.Target\)/ch.Target/	./...
a read error is echoed unfolded	plan.go	s/a\.Name, s\.Name, oneLine\(err\.Error\(\)\)\)/a.Name, s.Name, err.Error())/	./...
an unknown subject is echoed	plan.go	s/unknown subject %s; this app has %v\", shown\(name\)/unknown subject %s; this app has %v\", name/	./...
the app version need not be a RESULT word	app.go	s/case !wordRe\.MatchString\(a\.Version\):/case false:/	./...
canonical: invalid UTF-8 is accepted	canonical.go	s/if !utf8\.Valid\(doc\) \{/if !utf8.Valid(doc) \&\& false {/	./...
canonical: a lone surrogate is accepted	canonical.go	s/if loneSurrogate\(doc\) \{/if false {/	./...
canonical: a lone low surrogate is accepted	canonical.go	s/case r >= 0xDC00 \&\& r <= 0xDFFF:\n\t\t\t\treturn true/case r >= 0xDC00 \&\& r <= 0xDFFF:\n\t\t\t\treturn false/	./...
canonical: a high surrogate may be followed by anything	canonical.go	s/low < 0xDC00 \|\| low > 0xDFFF/low < 0xDC00 || low > 0xFFFF/	./...
digest: no size bound	canonical.go	s/if len\(doc\) > MaxDigestBytes \{/if false {/	./...
guard: a relative path is accepted	update.go	s/if !filepath\.IsAbs\(path\) \{\n\t\treturn Refused\(\"protected\", \"a path to guard must be absolute\"\)/if false {\n\t\treturn Refused(\"protected\", \"a path to guard must be absolute\")/	./...
protected: a removed or new entry is not a touch	update.go	s/if len\(now\) != len\(before\) \{\n\t\treturn true, nil\n\t\}//	./...
protected: a changed prefix is not a touch	update.go	s/if err != nil \|\| sum != was\.Sum \{/if err != nil || sum != was.Sum \&\& false {/	./...
protected: a mode change is not a touch	update.go	s/!ok \|\| is\.Mode != was\.Mode/!ok/	./...
protected: not checked before the switch	update.go	s/\tif r\.touchedProtected\(\) \{\n\t\terr := errors\.New\(\"a step touched a protected path; nothing was switched\"\)/\tif false {\n\t\terr := errors.New(\"a step touched a protected path; nothing was switched\")/	./...
protected: not checked after the proof	update.go	s/if err == nil \&\& r\.touchedProtected\(\) \{/if false {/	./...
protected: no snapshot is taken for an update	update.go	s/\t\tr\.protectedBefore = snap\n\t\}\n\trel, err := u\.Fetch/\t\t_ = snap\n\t}\n\trel, err := u.Fetch/	./...
live: an unknown state is not live	update.go	s/if err == nil \&\& \(st\.Live == nil \|\| !\*st\.Live\) \{/if err != nil || (st.Live == nil || !*st.Live) {/	./...
live: no idle fence is needed	update.go	s/if u\.Fence == nil \{\n\t\tif err != nil \{/if false {\n\t\tif err != nil {/	./...
recover: current is not proved before acting	update.go	s/err := r\.proveAsIs\(cur\)\n\t\tif err == nil \&\& !r\.touchedProtected\(\) \{/err := errors.New(\"skipped\")\n\t\tif err == nil \&\& !r.touchedProtected() {/	./...
recover: acts without the live rule	update.go	s/if reason, err := r\.liveGate\(\); err != nil \{\n\t\treturn r\.finish\(OutcomeRefused, reason, err\)/if reason, err := r.liveGate(); err != nil \&\& false {\n\t\treturn r.finish(OutcomeRefused, reason, err)/	./...
recover: an unreadable intent is not cleared once proved	update.go	s/\(in\.Step == \"unreadable\" \|\| cur == in\.From \|\| cur == in\.To\)/(cur == in.From || cur == in.To)/	./...
recover: an apply intent is not read	update.go	s/if in\.Kind == \"apply\" \{\n\t\treturn r\.recoverApply\(in\)\n\t\}//	./...
recover apply: a mix is cleared	update.go	s/if allBefore \|\| allAfter \{/if true {/	./...
recover apply: all-before is not cleared	update.go	s/allBefore = allBefore \&\& ok \&\& v == ch\.Before/allBefore = false/	./...
recover apply: all-after is not cleared	update.go	s/allAfter = allAfter \&\& ok \&\& v == ch\.After/allAfter = false/	./...
the directory is not synced after an atomic file write	update.go	s/return syncDir\(filepath\.Dir\(path\)\)/return nil/	./...	accepted: a directory sync is a durability property no test in one process can observe; the code is read in review
the directory is not synced after the switch	update.go	s/return syncDir\(u\.Root\)/return nil/	./...	accepted: see the directory sync above
the directory is not synced after clearing the intent	update.go	s/return syncDir\(a\.StateDir\)/return nil/	./...	accepted: see the directory sync above
a hook error is printed raw in text mode	update.go	s/r\.a\.Name, oneLine\(cause\.Error\(\)\)\)/r.a.Name, cause.Error())/	./...
an intent field is printed raw	update.go	s/what, shown\(in\.Step\), a\.Name\)/what, in.Step, a.Name)/	./...
a lock failure is called busy	update.go	s/if errors\.As\(err, \&e\) \&\& e\.Code == ExitFailed \{/if errors.As(err, \&e) \&\& e.Code == ExitFailed \&\& false {/	./...
update --check takes the lock	update.go	s/if !\(r\.doc\.CheckOnly \&\& verb == \"update\"\) \{/if true {/	./...
a stale install directory is kept	update.go	s/(err := syscall\.Kill\(pid, 0\); )err == nil/$1true || err == nil/	./...
a recovery_required going back has no backup path	update.go	s/r\.doc\.Backup = u\.versionDir\(from\)\n\t\t\}\n\t\treturn r\.finish\(OutcomeRecoveryRequired, \"recovery_required\", fmt\.Errorf\(\"%v; and going back failed/_ = from\n\t\t}\n\t\treturn r.finish(OutcomeRecoveryRequired, \"recovery_required\", fmt.Errorf(\"%v; and going back failed/	./...
an apply writes no intent	plan.go	s/\tif err := a\.writeIntent\(intent\{App: a\.Name, Step: \"apply\", Kind: \"apply\", Subject: s\.Name, PlanID: plan\.PlanID, Backup: path, Changes: plan\.Changes\}\); err != nil \{/\tif err := error(nil); err != nil {/	./...
a failed apply leaves its intent	plan.go	s/if o != OutcomeRecoveryRequired \{\n\t\t\tif err := a\.clearIntent\(\)/if o == OutcomeRecoveryRequired {\n\t\t\tif err := a.clearIntent()/	./...
guard: a protected path overlap is not refused	update.go	s/if overlaps\(p, path\) \{\n\t\t\treturn Refused\(\"protected\", \"a path overlaps/if false \&\& overlaps(p, path) {\n\t\t\treturn Refused(\"protected\", \"a path overlaps/	./...
protected: a step touching the install is not caught after install	update.go	s/\tif r\.touchedProtected\(\) \{\n\t\t_ = os\.RemoveAll\(dest\)/\tif false {\n\t\t_ = os.RemoveAll(dest)/	./...
guard: a path with .. after a link is accepted	update.go	s/if el == \"\.\.\" \{/if el == \"..\" \&\& false {/	./...
a version named like an install temp is accepted	update.go	s/ \&\& !strings\.Contains\(v, \"\.tmp-\"\)//	./...
protected: a file may grow although it is not append-only	update.go	s/is\.Size != was\.Size \&\& !u\.appendOnly\(path\)/false/	./...
protected: an append-only path outside the protected paths is accepted	update.go	s/if !filepath\.IsAbs\(p\) \|\| !in \{/if false \&\& !in {/	./...
protected: a retargeted link is not a touch	update.go	s/ \|\| is\.Link != was\.Link//	./...
protected: a touched install ends refused, not failed	update.go	s/return r\.finish\(OutcomeFailed, \"protected\", errors\.New\(\"a step touched a protected path; nothing was switched\. The touch/return r.finish(OutcomeRefused, \"protected\", errors.New(\"a step touched a protected path; nothing was switched. The touch/	./...
recover is not registered without an updater	update.go	s/if len\(a\.Subjects\) > 0 \{\n\t\t\treturn \[\]Command\{recoverCmd\}/if false {\n\t\t\treturn []Command{recoverCmd}/	./...
recover: the as-is proof does not ask Ready	update.go	s/err := u\.Ready\(r\.c\.Context, time\.Time\{\}, v\)/err := error(nil)/	./...
a hook-supplied reason is printed raw	update.go	s/\(%s\)\", shown\(reason\)\)/(%s)\", reason)/	./...
guard: a dangling link is accepted	update.go	s/if _, dangling := walk\(path\); dangling \{/if _, dangling := walk(path); dangling \&\& false {/	./...
protected: AppendOnly is not resolved like the snapshot keys	update.go	s/ \|\| within\(resolved\(p\), path\)//	./...
protected: a protected root that is a link is not resolved	update.go	s/if r, err := filepath\.EvalSymlinks\(p\); err == nil \{\n\t\t\troot = r/if r, err := filepath.EvalSymlinks(p); err == nil \&\& false {\n\t\t\troot = r/	./...
help: recover's schema is not listed without an updater	app.go	s/if a\.Updater != nil \|\| len\(a\.Subjects\) > 0 \{/if a.Updater != nil {/	./...
a run reads AppendOnly live, not once	update.go	s/cp\.AppendOnly = append\(\[\]string\(nil\), u\.AppendOnly\.\.\.\)/cp.AppendOnly = u.AppendOnly/	./...
walk: a link's target components are not followed	update.go	s/todo = append\(strings\.Split\(target, sep\), todo\.\.\.\)/_ = target/	./...
walk: an absolute link does not restart from the root	update.go	s/out, cur = out\[:1\], sep/out, cur = out[:len(out)], cur/	./...
walk: .. does not pop the directory reached	update.go	s/if len\(out\) > 1 \{/if len(out) > 1 \&\& false {/	./...
walk: an unresolvable link is not reported	update.go	s/err != nil \|\| serr != nil \|\|/err != nil || serr != nil \&\& false ||/	./...
overlaps: the first is not tested as an ancestor of the second	update.go	s/hasPrefix\(ea, eb\) \|\| //	./...
overlaps: the second is not tested as an ancestor of the first	update.go	s/ \|\| hasPrefix\(eb, ea\)//	./...
overlaps: an unresolvable path does not fail closed	update.go	s/return da \|\| db \|\| /return da \&\& false || db \&\& false || /	./...
sameElem: existing components are not compared by identity	update.go	s/return os\.SameFile\(x\.fi, y\.fi\)/return false/	./...
sameElem: missing components are not compared by name	update.go	s/x\.name == y\.name/true/	./...
walk: the link hop cap is removed	update.go	s/ \|\| hops >= 40 \{/ || hops >= 4000000 {/	./...	accepted: a looping link already fails the stat before the cap is reached, so the cap only bounds the walk if that stat is ever relaxed
