Prove the tests catch real mistakes, and tell the admin stories in plain English

AGENTS.md

@@ -970,7 +970,7 @@ rate, so the cost stays bounded to the source files you actually changed. Run
 branch that changes `src/` files; the standard `deno task precommit` no longer
 runs it (it was too slow for every commit).
 Known-equivalent survivors recorded in
-`scripts/mutation/equivalent-mutants.txt` are suppressed, as with a manual run.
+`scripts/mutation/equivalent-mutants/` are suppressed, as with a manual run.
 Never record `=== → ==`/`!== → !=` mutants: Biome's `noDoubleEquals` rule is
 configured to reject loose comparisons even against `null`, and the runner
 counts that lint failure as killed before tests run. Use
@@ -980,8 +980,8 @@ now kill. The audit never runs tests and refuses to rewrite stale or malformed
 entries. Like `deno task mutation`, it works in a copy of the checkout under
 `.mutation-runs/`, so the live source files are never left mutated and a commit
 made while it runs cannot pick up a mutant. With `--write`, the pruned
-`equivalent-mutants.txt` is copied back when the run ends — unless that file was
-edited meanwhile, which fails the run instead of overwriting the edit.
+`equivalent-mutants/` registry files are copied back when the run ends — unless
+one was edited meanwhile, which fails the run instead of overwriting the edit.
 
 Before it runs the mapped tests, the runner puts every mutant through two cheap
 **static gates**, ordered cheapest-first: a per-file Biome **lint** and then a
@@ -998,7 +998,7 @@ trusted after the runner confirms the *unmutated* target passes it (the baseline
 probe): a standalone `deno task mutation` doesn't run `lint:ci`/`typecheck`
 first, so if the target isn't already clean the run aborts loudly rather than
 scoring a bogus 100%. This means a mutant recorded in
-`equivalent-mutants.txt` must be one that survives *both* gates *and* the tests;
+`equivalent-mutants/` must be one that survives *both* gates *and* the tests;
 a mutation that produces a type error never reaches the ignore-list because the
 type-check gate kills it first.
 
@@ -1008,7 +1008,7 @@ to fix. Never determine whether a survivor "predates main" (no `git stash`, no
 diffing against the base to excuse it): the bar is 100%, and a survivor on a
 line in your changed file is a real gap in that file's tests that you are now
 the person best placed to close. Either write the assertion that kills it, or
-record the mutant in `scripts/mutation/equivalent-mutants.txt` with a proof that
+record the mutant in `scripts/mutation/equivalent-mutants/` with a proof that
 no input can distinguish it. "It was already there" is not a resolution; leaving
 it just guarantees the next person trips over the same survivor. This is the
 [Good citizen](#preferences) rule applied to mutation testing.

TODO.md

@@ -1225,43 +1225,6 @@ proves they create the attendee and ledger rows exactly once.
 
 ---
 
-## Stale equivalent-mutant line numbers across recent refactors
-
-*Origin: running `deno task mutation:audit-equivalents` while hardening
-`src/shared/square.ts` for the confirmed-Square-refunds job.*
-
-`scripts/mutation/equivalent-mutants.txt` carries several entries whose
-`file:line:col` no longer points at a generated mutant, so
-`deno task mutation:audit-equivalents` aborts with "No generated mutant matches".
-The mutants are still real and equivalent; only the code moved. Confirmed stale
-entries span at least:
-- `src/shared/uptime-kuma/socket.ts` (lines 107, 130, 167, 187 — `===`/`!==`↔loose)
-- `src/shared/uptime-kuma/monitors.ts` (lines 87, 101, 116, 119, 138, 193, 227,
-  250, 306, 325 — `===`/`!==`↔loose and `1000→1001`)
-- `src/shared/scheduled-access.ts:16:20 ??→||`
-- `src/shared/storage.ts:376:18 application/octet-stream→""`
-- `src/ui/templates/admin/images.tsx:84:28` and `:85:20 ??→||`
-- `src/features/app/routes.ts:235:14 →"mutated"`
-
-These most likely drifted when the Uptime Kuma modules were split into
-one-concept-per-file (#1906) and other recent move/refactor PRs. The audit is a
-standalone task (`mutation:audit-equivalents`, not part of `deno task
-precommit`), so CI doesn't gate on it; it surfaced here only because the
-Square-refunds job ran exhaustive mutation and used the audit to validate its
-own equivalent entries. The `square.ts` entries in the equivalent-mutants
-registry have been refreshed in place (they drift as the source shifts lines —
-the audit command's own output lists every stale `file:line:col`);
-
-Fix: for each stale entry, re-run `deno task mutation <file> '<tests>'
---exhaustive`, locate the surviving equivalent mutant's current `file:line:col`
-from the report, and update the line/col in `equivalent-mutants.txt` (or remove
-the entry if the static gates now kill it — `mutation:audit-equivalents --write`
-does this automatically for entries the lint/type-check gates catch). Then
-re-run the audit until it reports no stale entries. Starting point: the audit's
-own output lists every stale `file:line:col`.
-
----
-
 ## Square PENDING refunds — propagate a pending result, not a plain false
 
 *Origin: Codex review of PR #1911 (confirmed Square refund outcomes), thread
@@ -1334,7 +1297,7 @@ a malformed response throws rather than being silently cast. Starting point:
 Direct tests at `test/features/api/folded-booking.test.ts` and
 `test/features/api/folded-booking/parent-booking.test.ts` kill every non-equivalent mutant on the unchanged `folded-booking.ts`.
 Five equivalents (lines 87, 118, 176, 301, 381) are recorded in
-`scripts/mutation/equivalent-mutants.txt` with proofs — no unsuppressed survivors remain.
+`scripts/mutation/equivalent-mutants/` with proofs — no unsuppressed survivors remain.
 
 ## Split `render-selector.test.ts` by what each case actually checks
 

deno.json

@@ -128,6 +128,7 @@
     "@std/assert": "jsr:@std/assert@^1.0.19",
     "@std/cli": "jsr:@std/cli@^1.0.30",
     "@std/collections": "jsr:@std/collections@^1.2.0",
+    "@std/csv": "jsr:@std/csv@^1.0.6",
     "@std/expect": "jsr:@std/expect@^1.0.18",
     "@std/testing": "jsr:@std/testing@^1.0.17",
     "@std/path": "jsr:@std/path@^1.1.4"

e2e-payments/src/flow.ts

@@ -32,7 +32,7 @@ export const runSetup = async (
   await session.fill("admin_password_confirm", config.adminPassword);
   await session.select("country", country);
   await session.check("accept_agreement");
-  await session.clickButton("Complete Setup");
+  await session.clickButton("Complete setup");
   log(`  setup complete (admin=${config.adminUsername}, country=${country})`);
 };
 

scripts/audit-equivalent-mutants.ts

@@ -1,10 +1,9 @@
 #!/usr/bin/env -S deno run --allow-all
 
+import { fromFileUrl, relative, resolve } from "@std/path";
+import { splitFlagValues } from "#scripts/flag-values.ts";
 import { auditEquivalentMutants } from "#scripts/mutation/equivalent-audit.ts";
-import {
-  EQUIVALENT_MUTANTS_FILE,
-  EQUIVALENT_MUTANTS_PATH,
-} from "#scripts/mutation/ignore.ts";
+import { listRegistryFiles } from "#scripts/mutation/ignore.ts";
 import { runInSnapshot } from "#scripts/mutation/isolation.ts";
 import {
   isSnapshotChild,
@@ -21,28 +20,42 @@ const usage = `Usage: deno task mutation:audit-equivalents [--write]
 Runs lint and type-check against every recorded equivalent mutant without
 running tests. Pass --write to remove entries that static checks now kill.`;
 
-const parseOptions = (args: string[]): { write: boolean } => {
-  if (args.length === 0) return { write: false };
-  if (args.length === 1 && args[0] === "--write") {
-    return { write: true };
-  }
-  if (args.length === 1 && ["-h", "--help"].includes(args[0]!)) {
+/** The audit's options. The registry list is internal plumbing: the parent
+ * enumerates the shards once and hands the same list to its snapshot child,
+ * so the audited files and the copied-back files can never differ. */
+interface AuditOptions {
+  registry: string[];
+  write: boolean;
+}
+
+const parseOptions = (args: string[]): AuditOptions => {
+  const { rest, values } = splitFlagValues(args, "--registry");
+  const registry = values.map((path) => {
+    if (!path || path.startsWith("--")) {
+      throw new Error(`--registry needs a path\n\n${usage}`);
+    }
+    return path;
+  });
+  if (rest.length === 1 && ["-h", "--help"].includes(rest[0]!)) {
     console.log(usage);
     Deno.exit(0);
   }
-  throw new Error(`Unknown arguments: ${args.join(" ")}\n\n${usage}`);
+  if (rest.length > 1 || (rest.length === 1 && rest[0] !== "--write")) {
+    throw new Error(`Unknown arguments: ${rest.join(" ")}\n\n${usage}`);
+  }
+  return { registry, write: rest[0] === "--write" };
 };
 
 /** Audit inside this checkout, which the snapshot child owns outright. */
-const runAudit = async (options: { write: boolean }): Promise<number> => {
+const runAudit = async (options: AuditOptions): Promise<number> => {
   const controller = new AbortController();
   const onSignal = (): void => controller.abort();
   onTerminationSignals(onSignal);
   const result = await auditEquivalentMutants({
-    ...options,
-    ignoreFile: EQUIVALENT_MUTANTS_FILE,
+    ignoreFiles: options.registry.map((path) => resolve(projectRoot, path)),
     root: projectRoot,
     signal: controller.signal,
+    write: options.write,
   })
     .catch((error) => {
       if (controller.signal.aborted) Deno.exit(130);
@@ -60,17 +73,33 @@ const runAudit = async (options: { write: boolean }): Promise<number> => {
   return !options.write && result.retained !== result.checked ? 1 : 0;
 };
 
+/** Project-relative registry paths, listed before snapshotting so a --write
+ * audit can carry each pruned file back to the live checkout. */
+const registryCopyBackPaths = async (): Promise<string[]> =>
+  (await listRegistryFiles()).map((file) =>
+    relative(projectRoot, typeof file === "string" ? file : fromFileUrl(file)),
+  );
+
 if (import.meta.main) {
   // Parsed here too, so a bad flag or --help answers without copying anything.
   const options = parseOptions(Deno.args);
+  if (isSnapshotChild()) {
+    Deno.exit(await runSnapshotChild(() => runAudit(options)));
+  }
+  // The manifest is the parent's to build: a hand-passed file would be
+  // audited in the snapshot yet never copied back, so refuse it outright.
+  if (options.registry.length > 0) {
+    throw new Error(`--registry is internal to the audit\n\n${usage}`);
+  }
+  // One shard list serves the audit and the copy-back alike, so a shard added
+  // while the snapshot is being made can never be pruned and then lost.
+  const registry = await registryCopyBackPaths();
   Deno.exit(
-    isSnapshotChild()
-      ? await runSnapshotChild(() => runAudit(options))
-      : await runInSnapshot({
-          args: Deno.args,
-          // Only a --write audit rewrites the list, so only it keeps a file.
-          copyBack: options.write ? [EQUIVALENT_MUTANTS_PATH] : [],
-          entryScript: "scripts/audit-equivalent-mutants.ts",
-        }),
+    await runInSnapshot({
+      args: [...Deno.args, ...registry.flatMap((path) => ["--registry", path])],
+      // Only a --write audit rewrites the registry, so only it keeps files.
+      copyBack: options.write ? registry : [],
+      entryScript: "scripts/audit-equivalent-mutants.ts",
+    }),
   );
 }

scripts/flag-values.ts

@@ -0,0 +1,21 @@
+/**
+ * Splitting one repeated flag and its values out of a command line.
+ */
+
+/** Split argv into the given flag's values and everything else. A flag at the
+ * end with nothing after it yields undefined, for the caller to refuse with
+ * its own words. */
+export const splitFlagValues = (
+  args: string[],
+  flag: string,
+): { rest: string[]; values: (string | undefined)[] } => {
+  const rest: string[] = [];
+  const values: (string | undefined)[] = [];
+  const remaining = [...args];
+  while (remaining.length > 0) {
+    const value = remaining.shift()!;
+    if (value === flag) values.push(remaining.shift());
+    else rest.push(value);
+  }
+  return { rest, values };
+};