Three rules from maintainer rounds on #8132 and #8261, chosen over the
larger set those rounds produced because this file is already 2.4x its
size six days ago and nothing gates its growth.
A capability has two ends. #8132 found a cookie-to-Authorization bridge
gated to the desktop shell where it was minted and mounted
unconditionally where it was accepted, so every server treated that
cookie as a bearer. The tell generalises: the tests were named after the
gated end, which is what made the ungated end look covered.
"Nothing found" and "could not measure" must be different values, and
the damage is done by the consumer rather than the flag. #8261 set
`emptyDiff` both for a genuinely empty PR and for a diff capture that
FAILED, and the skill answered that flag by recommending the PR be closed
as superseded — a transient fetch error closing live work. The verdict
contract already applies this rule to our own report; the code under test
gets it too.
A validity control must run before the artifact it invalidates is built.
#8261's re-classifier demoted findings from a dead harness after the
findings list was assembled, so a harness proven dead still filed
`mutant-survived` against the author. A control that runs late is not a
weaker control, it is not a control.
The review also asked for two overlapping pairs to be consolidated. One
resolved itself when the observability-ranking bullet moved next to the
concurrency rule it cites. The other I deliberately left, with a note
saying why: merging the type-boundary bullet into the sibling-sweep
bullet would edit the one rule in this file with a measured before/after
behind it, and that text is byte-identical to what the treatment arm read
(verified against the staged copy). Editing the instrument is a change to
make with a fresh measurement, not on the way past.
Each new assertion was mutation-checked: neutering any of the three
pinned phrases turns the suite red.
Co-authored-by: verify <verify@local>