The review's package cases become a corpus, package-mutations/: each the golden altered
and, where the receipt or LISTING alone would catch it, re-sealed with the golden's key,
held as an overlay (the files that differ or are new, and the files it removes) with its
reason. 26 cases: a receipt over no component (on demand and live), the index against
its policy (class records, a capability, the string order, the class plan), a class
named classic, a patent-pool floor under royalty_free_only, a component of another
medium, a floor object missing and corrupted, a live window starting past 2^53 - 1, floor
objects that do not open on a key frame / hold an extra one / have another sequence
header / framing header / renderer and settings / target, an extra key frame the policy
allows (ok), dot-names and a *.sha256 file read strictly, and receipt files that are not
canonical or name a member twice.
- golden.rs builds them (package_mutations), writes the overlays (regen) and requires
each, applied to the golden, to get its reason from verify_files (check, so cargo
test and CI).
- pack_verify.py writes each case out and verifies it in §11.3's order without the
golden's inputs, taking the reason of the first check that fails. Two fixes the
corpus found in it: an index no catalog can be written for (a start past 2^53 - 1) is
catalog-mismatch, not an uncaught ValueError; and "on-demand, one window" is an
assertion about the golden, not a rule a package is held to (a live window is a
package too, §6.1, §9.2). An object-rules failure now names its reason in brackets.
- review.rs asserts the same cases by name, keeping what the corpus cannot hold (an
on-demand index starting past 0 cannot be sealed, a fragment time past 2^64 - 1, the
random alterations, the verifier's own directory walk).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
b1a7a776dd