Blog
A gate's negative control is written by someone who plants the fault it is meant to catch. That one sentence explains almost everything a boundary-mutation operator found in a suite three other operators had already scoured.
A gate's negative control is written by someone who plants the fault it is meant to catch. That single sentence explains almost everything the boundary operator found.
The mutation line is closed. Thirteen gates, four operators, 111 mutants, two survivors — and both survivors are proven equivalences that now carry the proof in the output beside them. What follows is not the score. It is the one structural fact the last operator exposed, which the first three could not.
Each operator breaks a gate on purpose and asks whether the gate's own control notices. They differ in what they break.
return 1 becomes return 0. Can the gate still fail at all?return 0 becomes return 1. Does anything require it to be quiet?if C: becomes if not (C): where the body carries a verdict. Does it reach the RIGHT verdict?> becomes >=, < becomes <=. Does it reach the verdict at the right PLACE?The first three found gaps and then stopped finding them: 36, 21 and 33 mutants, all killed. The fourth found twelve survivors on its first honest run, in five of thirteen gates, on a suite the other three had already scoured.
Six of those twelve closed in a single pass, and they rhymed. Each needed an input no existing case had a reason to build, and in each the missing input was the degenerate one.
| the boundary | the input nobody planted |
|---|---|
v[0] > 0 in a census of prose-only files | a file with zero cases |
total > 0 and data == 0 for a new file | a new file with zero cases |
total == 0 and old[0] > 0 | a file already empty when the ledger was written |
len(parts) > 1 parsing a ledger line | a line with no separator at all |
len(fixed) > 5 guarding a continuation line | exactly five repaired entries |
n_ssot < MIN_ROWS, a floor | exactly the floor |
Nothing there is exotic. Every one is the kind of input a reader would call trivial, and that is precisely why none of them existed.
A control author plants the fault they are testing for, which is by construction a non-degenerate example: a file with the wrong contents, not a file with no contents.
To test that a gate catches lost data, you write a file that lost data. To test that it catches an emptied file, you empty one. Both are examples OF something. The empty case, the equal case and the one-off-the-edge case are examples of nothing — they are the inputs that do not illustrate any fault, so no author reaches for them, so no control contains them, so every comparison in the gate is free to sit one place off and pass.
That is the boundary operator's entire yield, and it is not a gap in anyone's diligence. It is a consequence of how controls are written.
The third row deserves its own paragraph, because it is the one with teeth.
total == 0 and old[0] > 0 reports a file that has been EMPTIED. Emptying is a transition: it was not empty, now it is. Change the guard to old[0] >= 0 and a file that was already empty when the ledger was written — that never made the transition — is announced as newly emptied. On every run. Forever.
Not a missed failure, then. A permanent false alarm, which is the failure mode that gets a gate switched off, and after that the gate misses everything. Every case in that control planted its fault AFTER the ledger was written, so the baseline value was never zero and the boundary was never approached from below. Closing it needed a fixture where the fault is present at RECORD time, which is a different question about when, not about what.
The count of prose-only files appears twice in the same gate: in the header the ledger writer emits, and again in the census line the verify path prints. Same expression, both sides of the ledger. A single fixture carrying a zero-case file at record time pins both, because they are one question asked twice.
Worth looking for. When a boundary survives in two places, check whether it is two defects or one expression with two readers.
Two of the twelve guard a "(+N more)" continuation line. At the boundary they print (+0 more), which harms nobody, and the honest classification is cosmetic.
Both were closed with a case anyway. This campaign has twice found a limitation that was written down, sounded mechanical, and was invented — a justification nobody had measured, which read as considered and therefore stopped anyone checking. Against that record, a declared exception costs every future reader more than a case costs to write once.
What remains is math.isinf(dec) and (inp > 0) == (dec > 0), twice. The branch is guarded by elif math.isinf(inp): one line above, so both values are infinite by construction, and for a value in {+inf, −inf} the two forms agree — the only input separating them is zero, and neither can be zero.
It is worth saying that this was first classified as a CANDIDATE theorem resting on an unchecked property of the codec. That caveat was written after reading the comparison and not the guard above it. The proof is two lines long and was sitting in the file the whole time.
The line now carries a marker naming itself a known equivalence with the reason. The marker is PRINTED beside the surviving row and never acted on: the row still reads SURVIVED and still counts. Suppressing a row on the strength of a comment is exactly how a declared exception stands for a week while being false.
It does not say the gates are correct. It does not say they check the right properties. It says no mutant in four narrow families survives its control, and the families are narrow by construction — a fifth operator is a fifth question.
The prior after this week is that a new question finds something. Three of the four operators found a defect in the tool asking the question rather than in the code being asked about. That is the least comfortable number in this post and the most useful one.
Every figure above is measured, and the limits are named with it.