TASK-115: the read-only report's guards cover both surfaces and the task store

[ranjiao]

What this is

TASK-079 shipped ten new tests, all green, and a fresh-context V4 reviewer scored every deliverable MET. Two holes were invisible to all of that — they surfaced only when the reviewer mutated the production code and watched which tests failed. Five of six mutations were caught; these two were not.

Nothing was broken. What shipped is correct. What was missing is the guard that keeps it correct, so the measure here is not "the tests pass" — it is "the mutation that survived now dies".

No production code changed. bin/perry-migrate is untouched; the guard needed no seam.

The two holes

1 · The wording guard did not cover the machine-readable plan. TASK-079's deliverable 4 requires the emitted wording to state what was observed, not what should happen — the refuse-versus-report policy is USER-004 and this change must not settle it. The guard banned should/must/refus/chmod/instead/unsafe/warning/error on the rendered note only. Putting you should chmod it into the --json plan's read_only_override.observed left all ten tests green.

test_the_json_wording_states_what_was_observed_too now checks every read_only_override in the plan. Both surfaces read one POLICY_WORDS tuple rather than a copy of the list — a second copy is the same defect class this project keeps hitting, and it is the drift READ_ONLY_MECHANISM already exists to prevent for the sentence itself.

2 · The task-store path had no test behind it. _plan_task_store sets read_only_mode=owner_read_only(store_path). Deleting that line left all ten tests green, and a read-only tasks.jsonl would have silently lost its report. It is in the per-file list, so it is inside deliverable 1, and it was the only reported file with nothing standing behind it.

Two tests now stand there: test_the_read_only_task_store_is_reported_in_both_surfaces (the note and the JSON) and test_the_task_store_it_names_was_in_fact_rewritten (asserted on the bytes — a note about an override that did not happen would be a worse defect than the silence it replaced).

The fixture writes the store with the shipped writer, then ages it back to how a pre-TASK-106 Perry left it — no summary key. The record stays valid and projects identically to the board, so nothing is refused, and migration has a canonical rewrite to plan. Without a rewrite waiting there is no override to report, which is what test_a_file_left_byte_identical_is_not_reported_as_overridden pins.

Mutation results — all six die

Mutation	Test(s) that fail
you should chmod it into read_only_override.observed	test_the_json_wording_states_what_was_observed_too
delete read_only_mode=owner_read_only(store_path)	test_the_read_only_task_store_is_reported_in_both_surfaces, test_the_task_store_it_names_was_in_fact_rewritten
drop and self.writable	test_a_file_left_byte_identical_is_not_reported_as_overridden
report every file	4 tests, incl. test_a_project_with_no_such_file_reads_exactly_as_it_did_before
policy word in the rendered note	test_the_wording_states_what_was_observed_not_what_should_happen
dry-run only	3 tests, incl. test_the_applied_run_names_it_in_the_same_place

The last four were re-run to confirm this change does not trade one hole for another.

Verification

• tests/test_migrate.py: 130 → 133, green before and after. The class went 10 → 13; none of the ten was weakened — test_the_wording_... now reads the shared POLICY_WORDS, same words.
• python3 tests/parallel: 1846 → 1849 tests. Same 3 red modules before and after — test_diagnose, test_one_line_break_rule, test_v5_signoff — none mine, all pre-existing on this branch.
• bash tests/run: those three plus test_host_support, the documented shared-cache flake.
• python3 bin/perry-lint: 0 errors. git diff --check: clean.

Out of scope

The read-only policy itself. Whether migration should refuse such a file is USER-004 and stays unanswered — no refusal is implemented, and no policy word was let into either surface while adding the guard against policy words.

🤖 Generated with Claude Code