90f49498

test(xversion): an old client meets the new side-channel frames, both doors

a73x 2026-08-15 21:21

Commit message

test(xversion): an old client meets the new side-channel frames, both doors

The spec ASSERTS that a client with no arm for term_modes (0x8d),
term_title (0x8e) or term_event (0x8f) lands in `else => {}` and ignores
them. This rig exists to distrust assertions of that shape, and on both
transports for leg 3's reason: one sentence about a pre-M18 daemon was
right about the socket and wrong about QUIC.

The claim pinned is not "the old client did not crash" but that it kept
PARSING: a mis-framed type turns every later byte to garbage, so the
session emits all three side channels, waits a second so they land in a
pump of their own, and only then prints a marker the old client must
still paint. From a file the session runs, never typed input.

Both clients run on a real tty, which is what makes the negative half
mean anything -- over a pipe neither version writes a side channel, so
"the old client wrote no title" would be a fact about the pipe. And this
tree's own client runs first over the same door as a control: if it does
not show the side channels then nothing was sent, and a clean run by the
old client is asserting nothing. That is a FAIL, not a green.

Falsified both ways. XVER_OLD_BIN at the new binaries: both legs fail
naming all three channels the "old" client rendered. XVER_NEW_BIN at the
old binaries: both legs fail on the control, no clipboard sent.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

test/xversion.sh

@@ @@ -56,6 +56,16 @@ for _d in "$OLD_BIN" "$NEW_BIN"; do @@
+    done
+done
+# The pty fixture legs 7 and 8 need. Taken from the NEW tree in both
+# directions on purpose: it is a HARNESS, not a subject, and a
+# falsification run (XVER_OLD_BIN pointed at the new binaries) must still
+# have one. Those legs cannot run without it because mux writes a side
+# channel only to a terminal it has taken over — see the leg's own header.
+[ -x "$NEW_BIN/ptyclient" ] || {
+    echo "xver FAIL: no ptyclient in $NEW_BIN — legs 7 and 8 need the pty fixture"
+    echo "  it is built by this tree's build.zig into the same prefix as mux/muxd"
+    exit 1
+}
+# Short paths on purpose: these directories hold unix sockets, and a socket
+# path is capped near 108 bytes by the kernel, not by anything this script
@@ @@ -290,6 +300,160 @@ else @@
+    pass "stats_req discriminates the versions (a probe the old daemon already answers)"
+fi
+# ---- legs 7 and 8: an old client meets the new side-channel frames -----
+# This branch added three daemon->client frame types — term_modes (0x8d),
+# term_title (0x8e), term_event (0x8f) — and the new daemon queues them to
+# EVERY client in the session. An old client has no arm for any of them and
+# the spec ASSERTS it lands in `else => {}` and ignores them. That is the
+# shape of claim this rig exists to distrust, and both doors are asked for
+# leg 3's reason: one sentence about a pre-M18 daemon was right about the
+# socket and wrong about QUIC, and that cost a debugging session.
+#
+# The claim under test is not "the old client did not crash". It is that it
+# KEPT PARSING. A type it mis-framed would make every byte after that frame
+# garbage, so the session emits the side channels, waits, and only THEN
+# prints a marker: a marker painted on the old client's screen is proof the
+# frame boundary survived three frames it had never heard of.
+#
+# The wait is load-bearing, and the reason is the daemon's own order within
+# one pty chunk: `sendUpdate` (the delta) runs FIRST, then drainSideEvents,
+# sampleTermModes and sampleTermTitle (server.zig, the pty-readable arm).
+# Emitted in a single chunk the marker's delta would reach the client
+# BEFORE the three frames and this leg would prove nothing about parsing
+# past them. A second apart they are separate reads, separate pumps, and
+# the frames strictly precede the marker.
+#
+# BOTH clients run on a real tty (test/ptyclient), and that is what makes
+# the negative half assertable: the client writes a side channel only to a
+# terminal it has taken over, so over a pipe a client of EITHER version
+# writes none of them — "the old client wrote no title" would then be a
+# fact about the pipe rather than about the version, and the leg would
+# survive its own falsification saying nothing.
+#
+# Control and subject share one leg rather than reporting separately,
+# because a control that passes while its subject quietly stops being
+# tested is exactly the failure mode this file is built against. If this
+# tree's own client does not SHOW the side channels over this door, then
+# nothing was sent, the old client's clean run is asserting nothing, and
+# that is a FAIL here — not a skip and not a green.
+SC_OSC52=$(printf '\033]52;c;aGk=\007')
+SC_BP=$(printf '\033[?2004h')
+# side_channel_session TAG CLIENTBIN TRANSPORTARGS... — attach one client of
+# one version over one transport, make the session emit all three side
+# channels and then a marker, and leave the capture at $TMP/sc-TAG.
+#
+# Driven by a FILE the session runs, never by typed input: the shell echoes
+# what is typed, so a marker that could arrive as an echo would pass on a
+# client that forwarded nothing (M12's rule). The typed line is the path
+# `sh /run/mux/sc-TAG.sh` and the marker is `scTAG-pin`, which that line
+# does not contain.
+#
+# Each side channel needs its own arrangement to fire LIVE while this
+# client is attached, and two of the three are sampled rather than
+# streamed:
+#   * `?2004l` before `?2004h`, because sampleTermModes early-returns when
+#     the value has not changed and an earlier call of this helper left the
+#     session already bracketing.
+#   * a title unique to TAG, because sampleTermTitle early-returns the same
+#     way on an unchanged title.
+#   * OSC 52 needs nothing: a term_event is an occurrence rather than
+#     sampled state, so it fires every time.
+# The attach-time resync sends term_modes and term_title too, which is why
+# the arrangement matters — without it the only frames of those two types
+# would be ones that arrived BEFORE the marker for an uninteresting reason.
+side_channel_session() {
+    _sc_tag="$1"; _sc_cli="$2"; shift 2
+    cat > "$RUN_NEW/sc-$_sc_tag.sh" <<EOF
+printf '\033[?2004l'
+printf '\033]52;c;aGk=\007'
+printf '\033]2;xvsc-$_sc_tag\007'
+printf '\033[?2004h'
+sleep 1
+printf 'sc%s-%s\n' $_sc_tag pin
+EOF
+    timeout 60 "$NEW_BIN/ptyclient" --cols 80 --rows 24 \
+        --out "$TMP/sc-$_sc_tag" --err "$TMP/sc-$_sc_tag.err" \
+        -- "$_sc_cli" "$@" > "$TMP/sc-$_sc_tag.log" 2>&1 <<SCRIPT
+expect \x1b[?1049h 15000
+settle 400 15000
+send sh /run/mux/sc-$_sc_tag.sh\n
+expect sc$_sc_tag-pin 15000
+settle 600 15000
+send \x1c
+waitexit 10000
+SCRIPT
+}
+# xver_side_channel LABEL TRANSPORTARGS... — one leg, one door.
+#
+# The title needle is OSC **0** against a session that wrote OSC **2**, and
+# the asymmetry is the instrument (e2e.sh argues it at length on its own
+# title leg): a client that forwarded session bytes would put back what
+# went in, so `ESC]0;` for a session that only ever wrote `ESC]2;` can only
+# be the client re-rendering a term_title frame it decoded.
+xver_side_channel() {
+    _lbl="$1"; shift
+    _sc_title_n=$(printf '\033]0;xvsc-n%s\007' "$_lbl")
+    _sc_title_o=$(printf '\033]0;xvsc-o%s\007' "$_lbl")
+    side_channel_session "n$_lbl" "$NEW_BIN/mux" "$@"
+    _sc_rc=$?
+    _sc_cap="$TMP/sc-n$_lbl"
+    if [ "$_sc_rc" -ne 0 ]; then
+        fail "$_lbl: the control never ran — ptyclient exited $_sc_rc [$(tr -d '\n' < "$TMP/sc-n$_lbl.log")]"
+        return
+    elif ! grep -qaF "scn$_lbl-pin" "$_sc_cap"; then
+        fail "$_lbl: the control's session never ran — no marker on the new client's screen"
+        return
+    elif ! grep -qaF "$SC_OSC52" "$_sc_cap"; then
+        fail "$_lbl: no clipboard reached this tree's own client over this door — the old client below would be ignoring nothing"
+        return
+    elif ! grep -qaF "$_sc_title_n" "$_sc_cap"; then
+        fail "$_lbl: no title reached this tree's own client over this door — the old client below would be ignoring nothing"
+        return
+    elif ! grep -qaF "$SC_BP" "$_sc_cap"; then
+        fail "$_lbl: no bracketed-paste mode reached this tree's own client over this door — the old client below would be ignoring nothing"
+        return
+    fi
+    side_channel_session "o$_lbl" "$OLD_BIN/mux" "$@"
+    _sc_rc=$?
+    _sc_cap="$TMP/sc-o$_lbl"
+    if [ "$_sc_rc" -ne 0 ]; then
+        fail "$_lbl: the old client did not survive the side channels — ptyclient exited $_sc_rc [$(tr -d '\n' < "$TMP/sc-o$_lbl.log")]"
+    elif ! grep -qaF "sco$_lbl-pin" "$_sc_cap"; then
+        fail "$_lbl: the old client stopped painting after the side-channel frames — the marker never arrived"
+    else
+        # All three collected rather than chained on elif, and the reason is
+        # this file's own history: an assertion that is never evaluated
+        # passes green forever. Chained, a falsification run trips the first
+        # one and leaves the other two unexecuted — so two of the three
+        # needles would have been trusted without ever having been watched
+        # to fail. Collected, every run executes every grep, and the report
+        # names ALL the channels the client rendered instead of the first.
+        #
+        # `&&` on a grep is safe HERE and would not be in general: an errored
+        # grep exits 2 and reads as "not found", which is the wrong answer.
+        # What rules it out is that the marker grep above has already read
+        # this same file successfully, so it exists and is readable, and the
+        # needles reach grep as -F bytes in a variable, so no metacharacter
+        # can turn one into a bad pattern.
+        _sc_wrote=""
+        grep -qaF "$SC_OSC52" "$_sc_cap" && _sc_wrote="$_sc_wrote clipboard(term_event)"
+        grep -qaF "$_sc_title_o" "$_sc_cap" && _sc_wrote="$_sc_wrote title(term_title)"
+        grep -qaF "$SC_BP" "$_sc_cap" && _sc_wrote="$_sc_wrote bracketed-paste(term_modes)"
+        if [ -n "$_sc_wrote" ]; then
+            fail "$_lbl: the client under test rendered$_sc_wrote — it decoded frames an old client has no arm for, so it is not an old client"
+        else
+            pass "$_lbl: an old client ignores the new side-channel frames and keeps parsing past them"
+        fi
+    fi
+}
+xver_side_channel socket --sock "$SOCK_NEW"
+xver_side_channel quic "quic://127.0.0.1:$PORT_NEW" --key "$KEY" --quic-idle-ms 15000
+# ---- teardown, by the sanctioned verb, then OBSERVED ------------------
+"$NEW_BIN/muxd" stop --sock "$SOCK_NEW" >/dev/null 2>&1
+"$OLD_BIN/muxd" stop --sock "$SOCK_OLD" >/dev/null 2>&1
@@ @@ -313,8 +477,8 @@ fi @@
+# silently stops running is the failure mode no assertion inside it can
+# catch. Skips count — a skipped leg RAN and decided not to assert.
+TOTAL=$((PASSES + FAILS + SKIPS))
+if [ "$TOTAL" -ne 10 ]; then
+    echo "xver FAIL: $TOTAL legs reported, want 10 — one did not run"
+    FAILS=$((FAILS + 1))
+fi