← back to Designerwallcoverings
TK-11357: fix three holes the contrarian found in my own tripwire fix
0a57a1da7e277ef424368a140914cc7872a204e4 · 2026-09-16 14:25:28 -0700 · Steve Abrams
My fix for the fabricated-receipt bug shipped with the same disease in the
opposite direction, plus a regression I introduced. All three found by a
separate reviewer, all confirmed by me against source before fixing.
1. LOCALE-DEPENDENT PARSE (would have made the fix lie about FAILURE).
tripwire.sh keyed its real write count off apply.mjs's pretty output,
"levels SET → 0 : N", via `grep -Eo 'levels SET . 0…'`. The `.` is one
byte; `→` is three. The installed plist has no EnvironmentVariables block,
so launchd supplies no LANG — and under `env -i` that grep returns rc=1, no
match. The wrapper would then have reported NOT MEASURED forever and never
ledgered a real remediation: a permanent false WARN, which trains the reader
to ignore it. My own earlier "verified under C and unset locale" check was
invalid — I ran it in an interactive shell where LANG still leaked in, so it
never reproduced the launchd environment.
Fix: apply.mjs now emits stable ASCII counters `LEVELS_SET:N` /
`APPLY_ERRORS:N` beside the pretty line, and the wrapper keys off those.
Parsing prose for an outcome was the same proxy-signal mistake that caused
the original defect; a fancier regex would have been a reskin, not a cure.
2. DUPLICATE RECEIPT. apply.mjs already appends its own honest ledger line
(blast_radius = its real didSet) on every --apply run, so the wrapper
writing a second one meant two undo records for one write. It was only
unreachable because hole 1 short-circuited it — two bugs cancelling out is
luck, not design. The wrapper no longer ledgers at all: apply.mjs owns the
receipt, the wrapper owns the verdict.
3. REGRESSION I INTRODUCED. Partitioning on `tracked === true` silently bucketed
a row with a MISSING tracked field as "unactionable", so the new script would
have refused work the old one did. Now three buckets, not two: a row missing
inventory_policy or tracked is UNKNOWN — still ATTEMPTED (zeroing a $0
orderable variant is never harmful) but it can never yield PASS.
Also: a write ACK is not a post-condition, so the script no longer claims PASS
in the same pass as a write. It reports WARN "not yet re-verified"; the next
run's enumerate re-tests the live predicate and PASSes only on an empty cohort.
(Codex review.)
Correction to the previous commit message, which disagreed with itself: the
ledger holds 170 "OUTCOME tripwire fired" lines ever — 167 with the fabricated
blast_radius 6 (09-14 → 09-16) and 3 with blast_radius 1255 from 09-11, an
earlier and plausibly real bulk event. "171 consecutive, blast_radius 6 every
time" was wrong. The substance stands: apply.mjs's parallel honest log records
zero real writes across the fabrication window.
test-tripwire.sh: 9 cases / 28 assertions, every one executed under `env -i`
with no LANG — the environment launchd actually provides. Case 2 is the
regression test for hole 1 (apply prints only the unicode line -> must read NOT
MEASURED, never a silent pass); case 6 covers hole 3. The first suite ran only
in an interactive shell, which is exactly why it passed 22/22 while the fix was
broken in production.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HZzmXGxo9CPc8YnVkvFcqg
Files touched
M scripts/tk11357-zero-price-stopgap/apply.mjsM scripts/tk11357-zero-price-stopgap/test-tripwire.shM scripts/tk11357-zero-price-stopgap/tripwire.sh
Diff
commit 0a57a1da7e277ef424368a140914cc7872a204e4
Author: Steve Abrams <steve@designerwallcoverings.com>
Date: Wed Sep 16 14:25:28 2026 -0700
TK-11357: fix three holes the contrarian found in my own tripwire fix
My fix for the fabricated-receipt bug shipped with the same disease in the
opposite direction, plus a regression I introduced. All three found by a
separate reviewer, all confirmed by me against source before fixing.
1. LOCALE-DEPENDENT PARSE (would have made the fix lie about FAILURE).
tripwire.sh keyed its real write count off apply.mjs's pretty output,
"levels SET → 0 : N", via `grep -Eo 'levels SET . 0…'`. The `.` is one
byte; `→` is three. The installed plist has no EnvironmentVariables block,
so launchd supplies no LANG — and under `env -i` that grep returns rc=1, no
match. The wrapper would then have reported NOT MEASURED forever and never
ledgered a real remediation: a permanent false WARN, which trains the reader
to ignore it. My own earlier "verified under C and unset locale" check was
invalid — I ran it in an interactive shell where LANG still leaked in, so it
never reproduced the launchd environment.
Fix: apply.mjs now emits stable ASCII counters `LEVELS_SET:N` /
`APPLY_ERRORS:N` beside the pretty line, and the wrapper keys off those.
Parsing prose for an outcome was the same proxy-signal mistake that caused
the original defect; a fancier regex would have been a reskin, not a cure.
2. DUPLICATE RECEIPT. apply.mjs already appends its own honest ledger line
(blast_radius = its real didSet) on every --apply run, so the wrapper
writing a second one meant two undo records for one write. It was only
unreachable because hole 1 short-circuited it — two bugs cancelling out is
luck, not design. The wrapper no longer ledgers at all: apply.mjs owns the
receipt, the wrapper owns the verdict.
3. REGRESSION I INTRODUCED. Partitioning on `tracked === true` silently bucketed
a row with a MISSING tracked field as "unactionable", so the new script would
have refused work the old one did. Now three buckets, not two: a row missing
inventory_policy or tracked is UNKNOWN — still ATTEMPTED (zeroing a $0
orderable variant is never harmful) but it can never yield PASS.
Also: a write ACK is not a post-condition, so the script no longer claims PASS
in the same pass as a write. It reports WARN "not yet re-verified"; the next
run's enumerate re-tests the live predicate and PASSes only on an empty cohort.
(Codex review.)
Correction to the previous commit message, which disagreed with itself: the
ledger holds 170 "OUTCOME tripwire fired" lines ever — 167 with the fabricated
blast_radius 6 (09-14 → 09-16) and 3 with blast_radius 1255 from 09-11, an
earlier and plausibly real bulk event. "171 consecutive, blast_radius 6 every
time" was wrong. The substance stands: apply.mjs's parallel honest log records
zero real writes across the fabrication window.
test-tripwire.sh: 9 cases / 28 assertions, every one executed under `env -i`
with no LANG — the environment launchd actually provides. Case 2 is the
regression test for hole 1 (apply prints only the unicode line -> must read NOT
MEASURED, never a silent pass); case 6 covers hole 3. The first suite ran only
in an interactive shell, which is exactly why it passed 22/22 while the fix was
broken in production.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HZzmXGxo9CPc8YnVkvFcqg
---
scripts/tk11357-zero-price-stopgap/apply.mjs | 5 +
.../tk11357-zero-price-stopgap/test-tripwire.sh | 123 +++++++++++++--------
scripts/tk11357-zero-price-stopgap/tripwire.sh | 61 +++++-----
3 files changed, 113 insertions(+), 76 deletions(-)
diff --git a/scripts/tk11357-zero-price-stopgap/apply.mjs b/scripts/tk11357-zero-price-stopgap/apply.mjs
index 71ac522..79d6f39 100644
--- a/scripts/tk11357-zero-price-stopgap/apply.mjs
+++ b/scripts/tk11357-zero-price-stopgap/apply.mjs
@@ -112,6 +112,11 @@ async function main() {
if (APPLY) {
console.log(`levels SET → 0 : ${didSet}`);
console.log(`errors : ${errors}`);
+ // TK-11357: stable ASCII, locale-independent, machine-readable counters. The wrapper keys
+ // off THESE, never the pretty unicode-arrow line — under launchd there is no LANG at all
+ // and `grep -Eo 'levels SET . 0'` does not match the multi-byte arrow (verified: env -i -> rc=1).
+ console.log(`LEVELS_SET:${didSet}`);
+ console.log(`APPLY_ERRORS:${errors}`);
console.log(`restore-map : ${RESTORE} (${Object.keys(restoreMap.entries).length} entries)`);
const line = {
ts: new Date().toISOString(), agent: 'vp-dw-commerce', ticket: 'TK-11357',
diff --git a/scripts/tk11357-zero-price-stopgap/test-tripwire.sh b/scripts/tk11357-zero-price-stopgap/test-tripwire.sh
index 5a71f93..bceb142 100755
--- a/scripts/tk11357-zero-price-stopgap/test-tripwire.sh
+++ b/scripts/tk11357-zero-price-stopgap/test-tripwire.sh
@@ -1,63 +1,90 @@
#!/usr/bin/env bash
# TK-11357 — NEGATIVE TEST for tripwire.sh (CLAUDE.md TK-11431 amendment 3).
-# Proves the tripwire goes RED on injected faults and, critically, that it does NOT
-# emit a success receipt for a cohort it cannot actually fix — the exact defect that
-# produced 166 fabricated "re-zeroed 6 … self-heal" ledger lines over 3 days.
-# Runs entirely on fixtures: no Shopify call, no real ledger, no real heartbeat.
+#
+# Proves the tripwire goes RED on injected faults and never emits a success signal for a
+# cohort it cannot actually fix — the defect that produced 167 fabricated "re-zeroed 6 …
+# self-heal" ledger lines over 3 days.
+#
+# EVERY case runs the script under `env -i` — a BARE environment with no LANG/LC_ALL, which
+# is what launchd actually supplies (the installed plist has no EnvironmentVariables block).
+# The first version of this suite ran only in an interactive shell and therefore missed a
+# locale-dependent parse bug in the fix itself: the reviewer found it, not the tests.
+# Fixtures only — no Shopify call, no real ledger, no real heartbeat.
set -u
TRIP="$(cd "$(dirname "$0")" && pwd)/tripwire.sh"
+BAREPATH="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin"
PASS=0; FAIL=0
-mk() { # mk <name> <targets-json>
- D=$(mktemp -d); export TRIPWIRE_TEST_DIR="$D"; printf '%s' "$2" > "$D/targets.json"; }
-run() { # run <enum-cmd> <apply-cmd> ; echoes exit code
- TRIPWIRE_ENUMERATE_CMD="$1" TRIPWIRE_APPLY_CMD="$2" bash "$TRIP" --test >/dev/null 2>&1; echo $?; }
-v() { python3 -c "import json,sys;print(json.load(open(sys.argv[1]))['verdict'])" "$TRIPWIRE_TEST_DIR/heartbeat/latest.json" 2>/dev/null || echo NO-HEARTBEAT; }
-ledger_lines() { [ -f "$TRIPWIRE_TEST_DIR/ledger.jsonl" ] && wc -l < "$TRIPWIRE_TEST_DIR/ledger.jsonl" | tr -d ' ' || echo 0; }
-chk() { # chk <case> <got> <want>
- if [ "$2" = "$3" ]; then echo " ok $1: $2"; PASS=$((PASS+1)); else echo " FAIL $1: got '$2' want '$3'"; FAIL=$((FAIL+1)); fi; }
-
-CONTINUE6='{"targets":[{"sku":"CORK-92700","inventory_policy":"CONTINUE","tracked":true},{"sku":"CORK-92702","inventory_policy":"CONTINUE","tracked":true},{"sku":"CORK-92703","inventory_policy":"CONTINUE","tracked":true},{"sku":"CORK-92704","inventory_policy":"CONTINUE","tracked":true},{"sku":"CORK-92705","inventory_policy":"CONTINUE","tracked":true},{"sku":"CORK-92706","inventory_policy":"CONTINUE","tracked":true}]}'
+
+mk() { D=$(mktemp -d); TDIR="$D"; printf '%s' "$1" > "$D/targets.json"; }
+run() { # run <enum-cmd> <apply-cmd> -> exit code, under a BARE env
+ env -i PATH="$BAREPATH" HOME="$HOME" TRIPWIRE_TEST_DIR="$TDIR" \
+ TRIPWIRE_ENUMERATE_CMD="$1" TRIPWIRE_APPLY_CMD="$2" \
+ /bin/bash "$TRIP" --test >/dev/null 2>&1; echo $?; }
+v() { python3 -c "import json,sys;print(json.load(open(sys.argv[1]))['verdict'])" "$TDIR/heartbeat/latest.json" 2>/dev/null || echo NO-HEARTBEAT; }
+field() { python3 -c "import json,sys;print(json.load(open(sys.argv[1]))[sys.argv[2]])" "$TDIR/heartbeat/latest.json" "$1" 2>/dev/null || echo NO-FIELD; }
+ledger_lines() { [ -f "$TDIR/ledger.jsonl" ] && wc -l < "$TDIR/ledger.jsonl" | tr -d ' ' || echo 0; }
+chk() { if [ "$2" = "$3" ]; then echo " ok $1: $2"; PASS=$((PASS+1)); else echo " FAIL $1: got '$2' want '$3'"; FAIL=$((FAIL+1)); fi; }
+
+CONT6='{"targets":[{"sku":"CORK-92700","inventory_policy":"CONTINUE","tracked":true},{"sku":"CORK-92702","inventory_policy":"CONTINUE","tracked":true},{"sku":"CORK-92703","inventory_policy":"CONTINUE","tracked":true},{"sku":"CORK-92704","inventory_policy":"CONTINUE","tracked":true},{"sku":"CORK-92705","inventory_policy":"CONTINUE","tracked":true},{"sku":"CORK-92706","inventory_policy":"CONTINUE","tracked":true}]}'
DENY3='{"targets":[{"sku":"A","inventory_policy":"DENY","tracked":true},{"sku":"B","inventory_policy":"DENY","tracked":true},{"sku":"C","inventory_policy":"DENY","tracked":true}]}'
MIXED='{"targets":[{"sku":"A","inventory_policy":"DENY","tracked":true},{"sku":"X","inventory_policy":"CONTINUE","tracked":true}]}'
+UNKNOWN='{"targets":[{"sku":"A","inventory_policy":"DENY","tracked":true},{"sku":"U","inventory_policy":"DENY"}]}'
EMPTY='{"targets":[]}'
-APPLY_OK3='printf "levels SET → 0 : 3\nerrors : 0\n"'
-APPLY_OK1='printf "levels SET → 0 : 1\nerrors : 0\n"'
-APPLY_ERR='printf "levels SET → 0 : 2\nerrors : 5\n"'
-APPLY_GARBAGE='printf "something went sideways\n"'
-
-echo "== 1. THE REGRESSION CASE: 6 CONTINUE variants (the real 09-14..16 state) =="
-mk c1 "$CONTINUE6"; RC=$(run "true" "$APPLY_OK3")
-chk "1a exit code (want 2=WARN)" "$RC" "2"
-chk "1b verdict" "$(v)" "WARN"
-chk "1c NO fabricated receipt ledgered" "$(ledger_lines)" "0"
-
-echo "== 2. empty cohort -> PASS, no receipt =="
-mk c2 "$EMPTY"; RC=$(run "true" "$APPLY_OK3")
-chk "2a exit" "$RC" "0"; chk "2b verdict" "$(v)" "PASS"; chk "2c no receipt" "$(ledger_lines)" "0"
-
-echo "== 3. genuinely actionable, 3 written -> PASS + exactly one honest receipt =="
-mk c3 "$DENY3"; RC=$(run "true" "$APPLY_OK3")
-chk "3a exit" "$RC" "0"; chk "3b verdict" "$(v)" "PASS"; chk "3c one receipt" "$(ledger_lines)" "1"
-chk "3d blast_radius = ACTUAL writes" "$(python3 -c "import json;print(json.loads(open('$TRIPWIRE_TEST_DIR/ledger.jsonl').readline())['blast_radius'])")" "3"
-
-echo "== 4. mixed cohort -> WARN, receipt counts only what was written =="
-mk c4 "$MIXED"; RC=$(run "true" "$APPLY_OK1")
+# Fixtures reproduce apply.mjs's REAL stdout: the pretty unicode-arrow line AND the ASCII counters.
+OK3=$'printf "levels SET \xe2\x86\x92 0 : 3\\nerrors : 0\\nLEVELS_SET:3\\nAPPLY_ERRORS:0\\n"'
+OK1=$'printf "levels SET \xe2\x86\x92 0 : 1\\nerrors : 0\\nLEVELS_SET:1\\nAPPLY_ERRORS:0\\n"'
+ERR=$'printf "LEVELS_SET:2\\nAPPLY_ERRORS:5\\n"'
+GARBAGE='printf "something went sideways\n"'
+# The regression fixture: ONLY the pretty line, no ASCII counters (what apply.mjs printed
+# before this fix). Under a bare env this must read NOT MEASURED, never a silent pass.
+PRETTY_ONLY=$'printf "levels SET \xe2\x86\x92 0 : 3\\nerrors : 0\\n"'
+
+echo "== 1. REGRESSION A: 6 CONTINUE variants (the real 09-14..16 state) =="
+mk "$CONT6"; RC=$(run "true" "$OK3")
+chk "1a exit (want 2=WARN)" "$RC" "2"
+chk "1b verdict" "$(v)" "WARN"
+chk "1c NO fabricated receipt" "$(ledger_lines)" "0"
+chk "1d unactionable counted" "$(field unactionable)" "6"
+
+echo "== 2. REGRESSION B: apply prints only the unicode line, no ASCII counters =="
+echo " (bare env has no LANG; must be NOT MEASURED, never a silent pass)"
+mk "$DENY3"; RC=$(run "true" "$PRETTY_ONLY")
+chk "2a exit" "$RC" "2"
+chk "2b verdict" "$(v)" "WARN"
+chk "2c no receipt" "$(ledger_lines)" "0"
+
+echo "== 3. empty cohort -> PASS =="
+mk "$EMPTY"; RC=$(run "true" "$OK3")
+chk "3a exit" "$RC" "0"; chk "3b verdict" "$(v)" "PASS"; chk "3c no receipt" "$(ledger_lines)" "0"
+
+echo "== 4. actionable, 3 written -> WARN not-yet-re-verified (write ack != post-condition) =="
+mk "$DENY3"; RC=$(run "true" "$OK3")
chk "4a exit" "$RC" "2"; chk "4b verdict" "$(v)" "WARN"
-chk "4c blast_radius" "$(python3 -c "import json;print(json.loads(open('$TRIPWIRE_TEST_DIR/ledger.jsonl').readline())['blast_radius'])")" "1"
-chk "4d unremediated" "$(python3 -c "import json;print(json.loads(open('$TRIPWIRE_TEST_DIR/ledger.jsonl').readline())['unremediated'])")" "1"
+chk "4c levels_set parsed under bare env" "$(field levels_set)" "3"
+chk "4d wrapper writes NO duplicate receipt (apply.mjs owns it)" "$(ledger_lines)" "0"
+
+echo "== 5. mixed cohort -> WARN, unremediated surfaced =="
+mk "$MIXED"; RC=$(run "true" "$OK1")
+chk "5a exit" "$RC" "2"; chk "5b verdict" "$(v)" "WARN"
+chk "5c levels_set" "$(field levels_set)" "1"; chk "5d unactionable" "$(field unactionable)" "1"
+
+echo "== 6. row missing 'tracked' -> UNKNOWN, still ATTEMPTED, never PASS =="
+mk "$UNKNOWN"; RC=$(run "true" "$OK1")
+chk "6a exit" "$RC" "2"; chk "6b verdict" "$(v)" "WARN"
+chk "6c apply WAS run (work not silently refused)" "$(field levels_set)" "1"
-echo "== 5. enumerate fails -> FAIL, NOT-MEASURED, no receipt =="
-mk c5 "$DENY3"; RC=$(run "false" "$APPLY_OK3")
-chk "5a exit" "$RC" "3"; chk "5b verdict" "$(v)" "FAIL"; chk "5c no receipt" "$(ledger_lines)" "0"
+echo "== 7. enumerate fails -> FAIL, no receipt =="
+mk "$DENY3"; RC=$(run "false" "$OK3")
+chk "7a exit" "$RC" "3"; chk "7b verdict" "$(v)" "FAIL"; chk "7c no receipt" "$(ledger_lines)" "0"
-echo "== 6. apply output unparseable -> WARN NOT-MEASURED, no receipt =="
-mk c6 "$DENY3"; RC=$(run "true" "$APPLY_GARBAGE")
-chk "6a exit" "$RC" "2"; chk "6b verdict" "$(v)" "WARN"; chk "6c no receipt" "$(ledger_lines)" "0"
+echo "== 8. apply output unparseable -> WARN NOT MEASURED =="
+mk "$DENY3"; RC=$(run "true" "$GARBAGE")
+chk "8a exit" "$RC" "2"; chk "8b verdict" "$(v)" "WARN"
-echo "== 7. write errors -> FAIL =="
-mk c7 "$DENY3"; RC=$(run "true" "$APPLY_ERR")
-chk "7a exit" "$RC" "3"; chk "7b verdict" "$(v)" "FAIL"
+echo "== 9. write errors -> FAIL =="
+mk "$DENY3"; RC=$(run "true" "$ERR")
+chk "9a exit" "$RC" "3"; chk "9b verdict" "$(v)" "FAIL"
echo
-echo "RESULT: $PASS passed, $FAIL failed"
+echo "RESULT: $PASS passed, $FAIL failed (all cases executed under env -i, no LANG)"
[ "$FAIL" -eq 0 ] || exit 1
diff --git a/scripts/tk11357-zero-price-stopgap/tripwire.sh b/scripts/tk11357-zero-price-stopgap/tripwire.sh
index 770905d..db34917 100755
--- a/scripts/tk11357-zero-price-stopgap/tripwire.sh
+++ b/scripts/tk11357-zero-price-stopgap/tripwire.sh
@@ -73,13 +73,24 @@ if ! eval "$ENUMERATE_CMD" >"$ENUM_OUT" 2>&1; then
exit 3
fi
-# 2) partition: qty->0 only removes orderability when policy=DENY AND tracked=true
-read -r DET ACT UNACT UNSKU <<<"$(python3 - <<'PY'
+# 2) classify. qty->0 only removes orderability when policy=DENY AND tracked=true.
+# THREE buckets, never two (TK-11431 amendment 1): a row whose inventory_policy or
+# tracked field is MISSING is NOT "unactionable" -- it is UNKNOWN / not measured. We still
+# ATTEMPT the write on unknown rows (so we never refuse work the old script did, and
+# zeroing a $0 orderable variant is never harmful), but an unknown row can never yield PASS.
+read -r DET ACT UNACT UNK UNSKU <<<"$(python3 - <<'PY'
import json
t=json.load(open("targets.json")).get("targets",[])
-act=[x for x in t if str(x.get("inventory_policy","")).upper()=="DENY" and x.get("tracked") is True]
-un=[x for x in t if not (str(x.get("inventory_policy","")).upper()=="DENY" and x.get("tracked") is True)]
-print(len(t),len(act),len(un),",".join(str(x.get("sku") or x.get("variant_id")) for x in un[:12]) or "-")
+def bucket(x):
+ pol, tr = x.get("inventory_policy"), x.get("tracked")
+ if pol in (None,"") or tr is None: return "unknown"
+ return "act" if str(pol).upper()=="DENY" and tr is True else "unact"
+b=[(bucket(x),x) for x in t]
+act =[x for k,x in b if k=="act"]
+un =[x for k,x in b if k=="unact"]
+unk =[x for k,x in b if k=="unknown"]
+print(len(t),len(act),len(un),len(unk),
+ ",".join(str(x.get("sku") or x.get("variant_id")) for x in (un+unk)[:12]) or "-")
PY
)"
@@ -89,7 +100,7 @@ if [ "${DET:-0}" -eq 0 ]; then
exit 0
fi
-if [ "${ACT:-0}" -eq 0 ]; then
+if [ $(( ${ACT:-0} + ${UNK:-0} )) -eq 0 ]; then
# The whole cohort is structurally beyond this tool. Say so; do NOT run apply and do
# NOT claim a fix. The remedy is a POLICY flip (CONTINUE->DENY) = customer-facing = gated.
echo "$TS CANNOT ACT — $DET orderable, 0 actionable, $UNACT need a POLICY flip: $UNSKU" >>"$LOG"
@@ -101,8 +112,11 @@ fi
echo "$TS TRIPWIRE FIRED — $DET orderable ($ACT actionable, $UNACT not), re-zeroing" >>"$LOG"
eval "$APPLY_CMD" >"$APPLY_OUT" 2>&1
RC=$?
-SETN=$(grep -Eo 'levels SET . 0[[:space:]]*:[[:space:]]*[0-9]+' "$APPLY_OUT" | tail -1 | grep -Eo '[0-9]+$')
-ERRN=$(grep -Eo '^errors[[:space:]]*:[[:space:]]*[0-9]+' "$APPLY_OUT" | tail -1 | grep -Eo '[0-9]+$')
+# Key off apply.mjs's stable ASCII counters, NOT its pretty output: launchd supplies no LANG,
+# and the unicode-arrow line does not match under a bare env (verified env -i -> rc=1). Parsing
+# prose for an outcome is the same proxy-signal mistake that caused the original defect.
+SETN=$(grep -Eo '^LEVELS_SET:[0-9]+' "$APPLY_OUT" | tail -1 | cut -d: -f2)
+ERRN=$(grep -Eo '^APPLY_ERRORS:[0-9]+' "$APPLY_OUT" | tail -1 | cut -d: -f2)
SETN=${SETN:-}; ERRN=${ERRN:-}
echo "$TS apply.mjs --apply exit=$RC levels_set=${SETN:-UNPARSED} errors=${ERRN:-UNPARSED}" >>"$LOG"
@@ -112,27 +126,18 @@ if [ -z "$SETN" ]; then
exit 2
fi
-# 4) ledger ONLY a write that actually happened, with the REAL count
-if [ "$SETN" -gt 0 ]; then
- python3 - "$SETN" "${ERRN:-0}" "$UNACT" >>"$LEDGER" 2>/dev/null <<'PY'
-import json,sys,datetime
-n,err,unact=sys.argv[1:4]
-print(json.dumps({
- "ts":datetime.datetime.now(datetime.UTC).isoformat().replace("+00:00","Z"),
- "agent":"zero-price-orderable-tripwire (launchd, TK-11357 action C)","ticket":"TK-11357",
- "action":f"OUTCOME tripwire: set {n} inventory level(s) to 0 on ACTIVE $0 quote-only sellable variants that had become orderable"
- + (f" — {unact} further variant(s) left UNFIXED (CONTINUE/untracked: qty->0 is a no-op, needs a gated policy flip)" if int(unact)>0 else ""),
- "blast_radius":int(n),"unremediated":int(unact),"store":"designer-laboratory-sandbox.myshopify.com",
- "undo_cmd":"node ~/Projects/designerwallcoverings/scripts/tk11357-zero-price-stopgap/rollback.mjs --apply",
- "verify":"node ~/.claude/skills/zero-price-orderable-canary/check.mjs # expect 0","errors":int(err)}))
-PY
-fi
-
+# 4) NO receipt is written here. apply.mjs already appends its own honest ledger line
+# (agent vp-dw-commerce, blast_radius = its real didSet) on every --apply run, so a second
+# line from this wrapper is a duplicate receipt for one write. The wrapper's job is the
+# VERDICT (the heartbeat below), not a second undo record. (Cody review, TK-11357.)
if [ "${ERRN:-0}" -gt 0 ]; then
heartbeat FAIL "$DET" "$ACT" "$UNACT" "$SETN" "${ERRN:-0}" "apply.mjs reported ${ERRN} write error(s)"; exit 3
fi
-if [ "$UNACT" -gt 0 ]; then
- heartbeat WARN "$DET" "$ACT" "$UNACT" "$SETN" 0 "PARTIAL: set $SETN level(s) to 0, but $UNACT variant(s) remain orderable at \$0 (CONTINUE/untracked) and need a gated CONTINUE->DENY flip. SKUs: $UNSKU"; exit 2
+if [ "$UNACT" -gt 0 ] || [ "${UNK:-0}" -gt 0 ]; then
+ heartbeat WARN "$DET" "$ACT" "$UNACT" "$SETN" 0 "PARTIAL: set $SETN level(s) to 0, but $UNACT variant(s) remain orderable at \$0 (CONTINUE/untracked, need a gated CONTINUE->DENY flip) and ${UNK:-0} row(s) were NOT MEASURED (missing inventory_policy/tracked). SKUs: $UNSKU"; exit 2
fi
-heartbeat PASS "$DET" "$ACT" 0 "$SETN" 0 "remediated: set $SETN level(s) to 0; no orderable \$0 variant left unfixed"
-exit 0
+# We wrote, and every row was actionable -- but a write ACK is not a post-condition. Do NOT
+# claim PASS in the same pass: the NEXT run's enumerate re-tests the live predicate and will
+# report PASS only if the cohort is genuinely empty. (Codex review, TK-11357.)
+heartbeat WARN "$DET" "$ACT" 0 "$SETN" 0 "wrote $SETN level(s) to 0; NOT YET RE-VERIFIED -- the next run's enumerate is the post-condition check; PASS is only claimed on an empty cohort"
+exit 2
← 0b26a67 chore: lint, refactor, v0.1.17 (TK-00038 session close)
·
back to Designerwallcoverings
·
auto-data-snapshot: 2026-09-16T15:43:40 (1 data files) — dat 869dbfb →