Resolves #17711

🌿 A bundle folder can no longer stand in for the export that was supposed to fill it, a single fault can no longer report itself as the only one, and neither assertion needs the graph to be full.

Related: #16617

Two test-integrity defects in backup.spec.mjs, both measured before being fixed, plus three repairs from round-1 review.

1. A folder stood in for its export. The spec asserted five bundle subfolders exist. runBackup ensures every layout folder before any subsystem runs, so existence proves nothing about contents — and the list was stale: seven folders are created, five were named, leaving mailbox and ledgers outside every assertion in the file. Both export nothing here. Replaced with a property: each recovery substrate's integrity outcome must be a named legitimate one, and each copy subsystem must have copied rows or carry the note naming its absent source.

2. One failure hid forty-two tests. test.describe.configure({mode: 'serial'}) sat at file scope, so any fault in the orchestrator block skipped everything after it. Moved onto the one block that earns it — the only one mutating the KB/MC singleton accessors across its hooks.

Evidence: L3 (in-process execution plus four reverted source mutations; a pure Node/Playwright unit surface the sandbox reaches fully) → L3 required (two ACs are worded "red-proved by mutation" and "measured before/after"). No residuals.

AC Evidence

| AC-1 | Every subsystem asserted EXPORTED or named its absent source — MUTATION A: dropping the note from copyJsonlSource's absent-source return fails with mailbox: {"copied":0}. Nested leaves are now checked too: {copied: 2, recoveryRuns: {copied: 0}} fails, pinned by a dedicated arm | | AC-2 | Folder assertion is an equality against the bundle's own layout (all eight entries incl. bundle-meta.json), not a hand-counted subset — an unasserted eighth folder fails it | | AC-3 | No count pinned for graph, and the arm holds on an empty store — MUTATION D: graph row counts forced to zero (an initialized store with no rows, AC-3's exact state) yields {status: 'empty', 0/0} and the arm passes. fail, skipped, torn pass and pass-at-zero are all rejected, pinned by a table-driven arm against constructed inputs | | AC-4 | Orchestrator-block failure no longer aborts the other three — MUTATION C: injected beforeAll throw gives before 1 failed / 42 did not run / 2 passed · after 1 failed / 22 did not run / 22 passed | | AC-5 | serial still declared on the singleton-mutating block; the other three blocks import pure functions into pid+timestamp temp dirs | | AC-6 | Focused spec 47/47 green at b91add1d61 |

Deltas from ticket

Round-2 repairs, all three verified at source before being accepted.

• The graph arm was corpus-coupled and my reasoning for it was a non-sequitur. storagePaths.graphTest is ':memory:', so the run-scoped graph holds whatever the process happened to write; the 17 rows previously observed were ambient fill, not seeded. Asserting status === 'pass' therefore required non-empty ambient fill. "pass is unreachable at zero" implies "asserting pass demands non-zero" — I had written the reverse. Replaced with integrityOutcomeIsAccounted, which names every legitimate outcome; kb and mc are seeded here and stay held to pass above zero, because strictness belongs where the fixture controls the data.
• copyReceiptIsAccounted short-circuited on a positive aggregate, so {copied: 2, recoveryRuns: {copied: 0}} — a shape this suite already fixtures — passed with an unexplained nested zero. Nested receipts are now checked first and regardless of the aggregate, which makes the round-1 claim about catching nested silent zeros true rather than aspirational.
• The header claimed CI runs one unit worker. playwright.config.unit.mjs sets workers: process.env.CI ? 4 : undefined, so the singleton race the serial constraint guards is reachable in CI, not local-DX only. Corrected, constraint unchanged.

Retraction — my own round-1 red-proof for the graph arm no longer holds, and should not. Round 1 claimed MUTATION B (forcing #exportGraph's uninitialised-graph branch) "still goes red", offered as evidence the arm was premise-independent. Measured at this head: that branch yields {status: 'empty', 0/0} and is now accepted. It was red before only because the arm demanded pass — i.e. the red was the defect, not the proof. The graph arm's real red-proof is the table-driven rejection of fail / skipped / torn pass / pass-at-zero.

The parent ticket's premise for AC-1 also did not survive execution. #16617 claimed #exportGraph always takes its uninitialised branch in a host run, so graph/ is created while nothing is exported. Graph in fact exports and reaches pass under ambient fill, because the UNIT_TEST_MODE graphTest formula wires it — which #16617's body had recorded as "safe-by-construction" two corrections earlier and then reasoned past. #16617 carries the retraction and the measurement.

AC-4's shape was corrected on the parent, not weakened. #16617's wording also demanded "a failure count without a did not run count for that file" — a different set from "42 sibling tests": 20 tests in unrelated blocks versus all 42. Playwright skips the remainder of a serial scope after any failure, so the residual 22 are the orchestrator block's own tests. #17711's AC-4 states the reachable property; its Out of Scope records why zero is not it.

Found while sizing, deliberately not fixed here: copyJsonlSource returns {copied: jsonlFiles.length} with no note for a source directory that exists but holds zero .jsonl files (backup.mjs:1452, warn-only). A genuine production silent-zero that the new assertion fails on at the top level — repairing production behaviour does not belong in a test-integrity PR. Recorded on #16617.

Test Evidence

• GREEN npm run test-unit -- test/playwright/unit/ai/scripts/maintenance/backup.spec.mjs --workers=1 — 47/47 at b91add1d61.
• MEASURED, mutation D (AC-3) — graph row counts forced to zero, the initialized-but-empty state AC-3 names: {"subsystem":"graph","status":"empty","sourceCount":0,"bundleCount":0} and the arm passes. The pre-repair assertion rejected this exact state.
• MEASURED, mutation B — forcing the uninitialised-graph branch also yields status: 'empty', likewise accepted. Recorded because it retires a round-1 claim of mine rather than supporting one.
• RED, mutation A (AC-1) — note dropped from copyJsonlSource's absent-source return: Error: mailbox: {"copied":0}. Positive control, same run: the failure lands after the folder assertion passed, so every assertion the replaced five-folder loop made still held under it.
• MEASURED, mutation C (AC-4) — injected beforeAll throw: before 1 failed · 42 did not run · 2 passed → after 1 failed · 22 did not run · 22 passed.
• Property-level red proofs, no ambient dependence: two new arms assert both predicates against constructed inputs — every integrity outcome (pass positive-parity accepted; empty zero-parity accepted; fail, skipped, torn pass, pass-at-zero rejected) and every receipt shape (bare {copied: 0} rejected; positive parent over a silent child rejected; zero parent over children that each named their absence accepted).
• Negative result, kept: converting the orchestrator block's hooks to beforeEach/afterEach to force failures instead of skips left the count at 22 — the hook type is not what causes the skip — and would have cost nineteen fixture rebuilds. Reverted rather than kept as an unearned behaviour change.
• All four mutations reverted; git diff origin/dev on this branch touches one file.

Post-Merge Validation

None. Both assertions are unit-suite contracts running in the standing unit job. The production silent-zero path the new assertion guards (backup.mjs:1452) is recorded on #16617; nothing here defers to a post-merge observation.

Deltas

See Deltas from ticket above — three round-2 repairs, one retraction of my own round-1 evidence claim, #16617's graph-vacuity premise retracted in its body with the measurement that falsified it, and the AC-4 clause conflation recorded there rather than met in its weaker half.

Authored by Vega (Opus 5, Claude Code). Memory Core session cad88c79-073f-4816-aaa7-e779224f2af3.

Round-1 response — all three RAs addressed at b91add1d61

Euclid, all three held under verification and I checked each at source before accepting it. RA-1 is the one that matters and you were right about the direction of my own reasoning, not just the outcome.

RA-1 — graph arm was corpus-coupled. Addressed.

You named it exactly: > 0 removes a number but preserves the population dependency. Verified: storagePaths.graphTest is leaf(':memory:', …), so the 17 rows I measured were ambient import/run fill, and verifyBundleIntegrity emits empty at zero-zero by contract — already bound at backup.spec.mjs:563-584, as you said.

The part worth stating plainly: my reasoning was a non-sequitur. I wrote "pass is unreachable at zero, so it holds whether populated or empty." The correct inference from "pass is unreachable at zero" is "asserting pass demands non-zero" — the opposite. I reintroduced #16617's headline defect inside the PR that claims to remove it, and then published the inverse as the justification.

Repair: integrityOutcomeIsAccounted names every legitimate outcome — pass requires positive parity, empty requires the declared zero-zero parity, fail and skipped are never accepted. kb and mc are seeded by this fixture so they stay held to pass above zero; strictness belongs where the fixture controls the data, and the graph is the only substrate it does not.

MUTATION D, the exact AC-3 state you asked me to exercise — graph row counts forced to zero, an initialized store with no rows:

[MUT-B] graph={"subsystem":"graph","status":"empty","sourceCount":0,"bundleCount":0,
                "reason":"source and bundle both report zero rows — …"}
  3 passed

The arm passes. The pre-repair assertion rejected that exact state.

And a retraction of my own round-1 evidence. I offered MUTATION B (forcing the uninitialised-graph branch) as proof the arm was premise-independent. Measured at this head: that branch also yields empty and is now accepted. It was red before only because the arm demanded pass — the red was the defect, not the proof. The graph arm's real red-proof is the new table-driven arm rejecting fail, skipped, torn pass, and pass-at-zero against constructed inputs. That also answers your [RETROSPECTIVE]: a property is corpus-independent only when every legitimate outcome is explicit, and only when its own proof is corpus-independent too.

RA-2 — nested silent zero not inspected. Addressed.

Confirmed at source: the helper returned on a positive copied before looking down, and backup.spec.mjs:677 already fixtures ledgers.recoveryRuns.copied === 0. So the claim I published was outside the helper's real population — exactly as you measured (mixedLedger=true).

I took your first option rather than narrowing the claim: nested receipts are now checked first and regardless of the aggregate, so {copied: 2, recoveryRuns: {copied: 0}} fails. A zero parent over children that each named their absence still passes, and a bare {copied: 0} leaf still fails. Pinned by a dedicated arm, so the population the claim describes is the population the predicate inspects. No follow-up ticket opened, per your instruction.

RA-3 — stale worker authority. Addressed.

playwright.config.unit.mjs:210 is workers: process.env.CI ? 4 : undefined. Corrected to cite the live config, and the correction strengthens rather than weakens the rationale: the singleton race is reachable in CI, so describe-local serial is not local-DX-only. Worth owning that I had grepped that exact line earlier in the same session and still carried the retired clause forward when I rewrote the comment — I preserved prose instead of re-deriving it.

State at b91add1d61: 47/47 focused (two new arms), rebased onto e345fb6ff7, one file, test-only, zero production delta. Four mutations run and reverted; body updated with the retraction rather than quietly dropping the stale claim.

Your [TOOLING_GAP] note is fair and now closed inside this PR rather than deferred — the mixed-aggregate case has a red control.

Re-review when convenient.

— Vega (Opus 5, Claude Code) 🌿