The conformance corpus's guards can lose a row silently

[blooop]

Question

The conformance corpus from #310 is faithful, but its guards have holes the review of PR #353 found by mutation. A corpus whose rows can vanish silently is a guard that decays without anyone noticing — which is the same failure mode as the drifted fakes it replaced.

Three gaps, in severity order:

1. A row can be deleted with everything green. the_corpus_carries_the_rows_the_decision_named checks that certain flag names are mentioned somewhere across all rows, not that specific rows exist. The reviewer deleted a single row — including the regression row for the very --ignore-not-found defect Fix --ignore-not-found and drive the corpus through both fakes #310 fixed — and both cargo test and pytest stayed fully green. Guard row identity, not aggregate mentions.
2. The honesty guard is Rust-only. The test enforcing that every row's verified line opens with measured or unverified runs on the Rust side alone, so a corpus edited from the Python side can lose it silently. Both drivers read the same file; both should enforce its invariants.
3. The value-flag tables are now parallel in two languages with nothing comparing them — five tables in Rust and Python, no test diffing them, and only ~14 of ~44 flag names have a corpus row. So the defect class One conformance corpus for both devpod fakes #309 set out to close is half-closed: the corpus proves the fakes agree on what it covers, and covers a third of the surface.

Also worth doing while here: the seven rows marked unverified are all measurable. The reviewer provisioned a docker provider and an alpine devcontainer under scratch state and measured every one — all matched what the corpus asserts. So the provenance lines overstate the obstacle: measurement was inconvenient, not impossible. Either upgrade those rows to measured with the method recorded, or reword them to say "not measured here" rather than implying it cannot be done.

Red first for each: the mutation that currently passes is the test to write.

[blooop]

Claimed 2026-08-29: build in progress from an interactive session (opus agent in an isolated worktree, managed as part of closing out map #299). PR to follow. If you are another session seeing this, do not double-build.

[blooop]

breadcrumb: claimed and reproduced all three gaps on current main before writing anything.

Seams, as the ticket names them: the shared corpus file itself, and the two drivers that read it (the in-process fake's Rust driver, the shim's pytest module). Invariants of the corpus get enforced at both driver seams, not one.

The three mutations that pass today:

1. Delete the delete <missing> --ignore-not-found row (the Fix --ignore-not-found and drive the corpus through both fakes #310 regression row): cargo test 3/3 green, pytest green. The sibling row that puts the flag before the positional keeps the aggregate mention alive, so nothing notices.
2. Rewrite a row's verified to who knows: pytest green (the honesty guard is Rust-only).
3. Drop --gidmap from the shim's up value-flag table so the two tables disagree: both suites green, because no row exercises that flag and nothing diffs the tables.

Building: row identity by stable id (a roll call both drivers hold), every corpus invariant enforced on both sides, and a behavioural table-parity check.

[blooop]

breadcrumb: built and pushed as #510.

Rows carry a stable id and both drivers hold the roll call of ids they expect, so a deleted row fails by name on both sides rather than shrinking the corpus quietly. The provenance guard and the shape checks moved to both drivers too, the shape checks now keyed to row ids instead of asking whether a flag appears anywhere in the file. Each driver compares its own live value-flag tables against the other language's source, which is the piece that had nothing watching it at all.

Every row that read unverified now reads measured with the method recorded, on the strength of the provisioning done during PR #353's review.

Two counts in the ticket came out differently on the tree: five rows opened with unverified, not seven (three more opened measured and inherited part of the claim, which is where the seventh behaviour lives), and there are six value-flag tables rather than five, because stop has an empty one that no list of names can express.

Not merging; next stage is review in fresh context.

[blooop]

Review posted on #510: Request changes (one blocker) — #510 (review)

[blooop]

breadcrumb: review round done on #510; all 15 checks green at 81b7116, not merged.

The blocking finding was mine to own: I upgraded eight rows to measured citing PR #353's review, and that review never ran list against the workspace it provisioned. Seven upgrades stand with the method recorded; the eighth takes the ticket's other branch and opens unverified, naming the half that was measured. Worth remembering that the honesty guard cannot catch that class at all: it reads the opening word, not the citation.

The two minor findings turned out to be one problem. The value-flag tables are now a single shared file both fakes read, which deleted the two source parsers that review showed mis-attributing behaviour-neutral edits, and closed the unguarded table roll call at the same time. The Rust side reaches them through an enum, so a call site cannot name a table that does not exist. The guarantee changed shape rather than only tightening: the two fakes disagreeing is now unrepresentable instead of detected, and the residual (an edit wrong in the one shared copy) is what it always was, caught behaviourally for the flags with corpus rows.

Main moved four times underneath this branch, three of them on the CHANGELOG's [Unreleased]. Each merge keeps every line main brought and puts this entry under [Unreleased], never inside the shipped section where the textual merge lands it. A conflicting branch also gets no CI run at all, so the conflict has to go first or the checks never appear.