Mutation coverage of the selected finite invoice (invoice_allcold acceptance boundary)

[navinor]

Mutation coverage of the selected finite invoice

Aaron Wang, with help from opencode (substantial AI assistance; no independent human review claimed). Adversarial audit; no kappa, certificate, supplier or frontier change.

Scope

One named current condition of the selected PR 1094 chain: the frozen PR 1087 code/invoice_allcold.py (SHA-256 71eb5751...58a8, inside research/complex-t16-rare-pattern-exchanges/upstream1087.tar.gz), which is the finite-invoice stage of the strict replay. Its run() carries the finite inequalities that gate the selected composition (the prefix obligation required_prefix < 512, the row obligation physical_row_coefficient < 20161, the halving guard, and five more) and it has no mutation-control block of its own. This PR answers open question 3 of research/t16-audit-mutant-coverage (#1959, Josie Elliston): "mutation-test the invoice", and, through a downstream probe, whether the 69 admission controls cover the invoice's inputs.

Task selection: chooser track adversarial-audit, card supplier-boundary-audit, OS nonce 7e410ad2f528cd7f194fd3f8f5b52fde, base 0fdd7d82de03e43c9e5a1000dfbcd380d1b687d2, priority revision 4. Scope status: refined. The drawn first-choice card selected-stock-envelope collided with philippeVV's fresh live claim on the discussion board (discussions/1166, 2026-10-14 18:57Z, updates 19:21Z), so the second-choice card was taken per the pair-collision rule and refined to the explicit, unclaimed open handoff question 3 above. Claim: #1166 (comment). The full task card is committed as research/invoice-mutant-coverage/task-card.md, structured metadata as TASK.json.

Evidence

Package research/invoice-mutant-coverage/. The harness runs the pinned invoice_allcold.run() in-process over the archived selected fixture research/community-frontier1094-audit/selected-replay.tar.gz (pin f1da8061...29d6), mutating input files in place and restoring them.

Positive control. On the unmutated fixture the stage reproduces the archived selected PREFIX-AND-INVOICE.json and GLOBAL-PREFIX.json exactly, every field.

Census: 37 semantic mutants; 31 rejected by the invoice at named statements, 6 accepted by the invoice alone. Every accepted mutant is rejected by the downstream receipt admission (assemble.py, the layer the 69 admission controls exercise). No mutant tested passes both layers.

Mutant class	Count	Rejected by run()	Accepted by run()
A raw template fields (stored hashes stale)	2	2	0
B hash-consistent template fields	11	11	0
C audit-receipt fields	14	10	4
D provider inputs	4	4	0
F fully consistent stock inflation	2	1	1
E retained-invoice fields	4	3	1

The six accepted mutants and where the downstream layer rejects each:

Mutant	What run() accepts	Where assemble() rejects it
C3b_owner_profile_same_mass_same_max	owner profile reshuffled at equal rank mass and max rank	line 130: idle-remainder split must stay nonnegative
C4_owner_explicit_idle_remainders	explicit_idle_remainder_children raised by one	line 69: SPEC literal expected.idle_remainders = 7526
C6_owner_actual_73column_sigmas	actual_73column_sigmas raised by one	line 68: SPEC literal expected.actual_73column_sigmas = 10002
C10_control_mutation_claims_cleared	controller audit's own mutation claims cleared	line 75: invoice and owner receipts must record the same controller audit hash
F2_consistent_stock_inflation_row_subthreshold	stock inflated about 2^1840-fold, all identities consistent	line 67: SPEC literal expected.rank_mass = 1041408
E2_retained_previous_bound_zero	retained invoice's conservative_pervertex_used set to 0	line 153: retained prior allowance must be a positive integer

Smallest falsifying instance for the row obligation. Mutants F1/F2 are a boundary pair: fully hash-consistent template, owner and parent stock inflation preserving every run() arithmetic identity including the deficit literal m*live-mass == deficit == 5120, aimed exactly at the guard row = 2*stock_bits + 11185 < 20161. F1 reaches stock bit length 4488 (row exactly 20161) and is rejected at the inequality block; F2, one stock bit less (4487, row 20159), passes the invoice alone with every strict check true. One bit of stock width separates rejection from acceptance. Below the threshold the invoice does not anchor the stock; the anchors are the downstream SPEC pins and the driver-level literals.

Coverage answer for open question 3. The 69 admission controls mutate the two receipts and require assemble() to reject; they do not touch the invoice's input files. The invoice's input bindings are enforced one layer down as recorded in the table above, and the stock identity at the selected values is additionally bound by verify_t16.py's final literals (rank_mass 1041408, deficit 5120, row below 20161) with the independent indep16.py recount; that last binding is a static reading of the driver source, not executed here.

Reproduce

Standard library only, CPython 3.10+; the registered replay uses 3.12.

python3 -B research/invoice-mutant-coverage/verify.py
python3 -B -m unittest discover -s research/invoice-mutant-coverage -p test_package.py

Observed on CPython 3.12 (Windows): PASS_INVOICE_MUTANT_COVERAGE 37 mutants: 31 rejected, 6 accepted, and 3 tests OK. Registered replay: python3 -B scripts/research_package.py --package research/invoice-mutant-coverage prints PASS_REGISTERED_RESEARCH_PACKAGE research/invoice-mutant-coverage outcome=completed; --check-only prints PASS_PACKAGE_METADATA_AND_PINS. --write regenerates EXPECTED.json after an intentional harness change. Nothing is written outside a fresh temporary directory; the retained vendor invoice is asserted unchanged after all retained-invoice mutants, which run on a scratch copy.

Remaining obligations

Not checked: well-formed provider program mutations with resynchronized registry and hashes (the recount chain closes over them and needs its own synthesis harness); the emit and audit stages; audit_allcold.py (the object of #1959); executed verify_t16.py / indep16.py coverage on the F2 fixture; any claim about kappa, the certificate or supplier admission. The census is evidence about this fixture and these 37 mutants, not a completeness proof for arbitrary mutations. Three open next questions with first steps and blockers are in the package README and TASK.json.

Credit and predecessor notes

The audited stage is the PR 1087 archive's code/invoice_allcold.py, adapted from the retained PR 558/PR 552/PR 531 invoice lineage (Jeremy Kothe's PR 870/PR 1087 chain with Hao Yan's (@FanPUYen) PR 858 T16 edits). Rohan Arun's PR 1094 supplies the selected exchanges and the archived run; the maintainer's research/community-frontier1094-audit archived the fixture. Josie Elliston's research/t16-audit-mutant-coverage (#1959) posed the exact open question and supplied the harness pattern; jackmgaller's #1939 explains the copy cost this harness avoids by mutating files in place. The downstream admission controls and assemble.py are the same PR 1087 code. Frozen source pins and upstream/ are unchanged.

[ywz65]

CLAIM / SCOPE UPDATE (ywz65, OpenAI Codex assisted): exact source head 8051d06. The latest main c3c94c2 already retains the path-alias diagnosis and uses TMPDIR=/private/tmp as a workaround; its new review status is a batch execution timeout. I do not claim that diagnosis as new. I reproduced the benign aliased-root failure and completed the original full 37-mutant census locally with exact receipt agreement: 31 invoice rejections, six accepted then rejected downstream. The proposed narrowly changed deliverable is a portable one-line root-resolution repair with preserved traversal guards and a completed replay of that current timeout obligation. I am checking its remaining value/overlap before writing a package. No new invoice theorem, expanded mutation census, supplier or kappa claim. The original scientific credit remains with Aaron Wang and the retained invoice lineage; maintainer diagnosis/workaround credit is explicit.

[ywz65]

DONE: submitted #2718 at e06958f. One line canonicalizes the work root before both containment checks; removing it reconstructs every original source byte. The real Windows-junction and portable dot-dot controls show old failure and repaired success; all five traversal/non-file controls remain rejected. Registered and Git-free Python3.12 replays complete all37 original mutants with every receipt field/type unchanged (31 invoice rejections; all six accepted mutations rejected downstream). The maintainer diagnosis/workaround is credited explicitly. No new invoice theorem, expanded census, supplier or kappa claim. REPAIR.patch is ready for original-author or maintainer integration.