` -> exit 0 and failures [] for all four (2107/2103/2103/2105 checks), while the snapshot and the real cell say reset_detected true. Expected: exit 1 with a failure for each.","severity":"medium","snippet":" if (tds.length === 0) continue; // a header row","title":"Page check lets free text show a wrong value: a th-only 'reset detected / false' row, a p note, a second h1 or a lone th all pass consistency.mjs"},{"citation":"resolved","description":"The renderer writes aria-label only as aria-label=\"unknown\" on blank unknown cells. The checker allows the attribute name on every element and never compares its value, and aria-label replaces the cell text for assistive technology. Merged from audit_math, audit_permissions and audit_economics. Impact: a wrong value presented to screen-reader users; the check passes. Reproduced by running. Fix: accept aria-label only equal to 'unknown', only on a td whose data-v is unknown and whose text is empty.","line":360,"path":"observatory/scripts/consistency.mjs","reproduction":"Copy outputs/reset from the check run and change '| ' to ' | '. `node scripts/consistency.mjs ` -> exit 0, 2101 checks, failures []. Expected: an attribute failure.","severity":"low","snippet":" const ATTRS = new Set([\"lang\", \"charset\", \"name\", \"content\", \"class\", \"scope\", \"aria-label\", \"data-k\", \"data-v\", \"data-n\", \"data-for\", \"data-row\", \"data-section\", \"data-col\", \"data-escrow\"]);","title":"consistency.mjs allows aria-label with any value on any element, so a cell can read 'false' to a screen reader while its text and data-v say true"},{"citation":"resolved","description":"Round 5 says src/strict.ts holds the one safe-integer reading for escrow, census and status. status.ts nonNegativeInt still uses Number.isInteger, so a head whose finalized number JSON.parse has rounded is accepted as present and valid. Its lag is computed from rounded values, and the height becomes the escrow evidence bound. Merged from audit_math and audit_permissions. Impact: wrong health (ok on an untrusted reading). Unrealistic heights, hence low. Reproduced by running. Fix: use isSafeInt in nonNegativeInt.","line":40,"path":"observatory/src/status.ts","reproduction":"Copy fixtures/status-healthy, set rpc-head.json finalized.number 9007199254740993 and best_number 9007199254740995 (JSON number literals). `node dist/cli.js status --fixtures ` -> rpc.health ok, stale false, finalized_height 9007199254740992, best_height 9007199254740996, finality_lag 4, conflicts []. Expected: rpc degraded ('no valid finalized head', 'no valid best height'), finalized_height null.","severity":"low","snippet":"function nonNegativeInt(value: unknown): number | null {\n return typeof value === \"number\" && Number.isInteger(value) && value >= 0 ? value : null;\n}","title":"status.ts reads heights and the runtime version with Number.isInteger, not the shared isSafeInt: finalized 2^53+1 is reported as 2^53 with rpc health ok"},{"citation":"resolved","description":"RULES.md 1.1: ok needs every check to run and pass. cli.ts passes the previous snapshot's rpc.observed_at whenever it is non-null, and the status stores the raw head time even when it does not parse (here a zoneless time, which already made that snapshot unknown). In the next snapshot with the same finalized head, secondsBetween returns null and the stuck branch is skipped without marking the check as unable to run. Impact: wrong health (ok while the height may have been stuck for 70 minutes). Reproduced by running. Fix: when previous is on the same genesis with the same head and its time does not parse, health unknown, or only take a previous whose observed_at parses.","line":175,"path":"observatory/src/status.ts","reproduction":"pz0 = fixtures/status-healthy with rpc-head observed_at '2026-11-09T23:47:40' (no zone); `node dist/cli.js snapshot --status pz0 --out o40 --log L4/log.jsonl --now 2026-11-09T23:47:53Z` -> rpc.health unknown, finalized_height 3341575. pz1 = same head, rpc-head observed_at 2026-11-10T00:57:48Z, three fetched_at 2026-11-10T00:57:50Z; `node dist/cli.js snapshot --status pz1 --out o41 --log L4/log.jsonl --now 2026-11-10T00:57:53Z` -> rpc.health ok, stale false, detail null. Expected: unknown (check could not run) or degraded (stuck 70 min).","severity":"low","snippet":" if (since !== null && since > o.staleAfterSeconds) {","title":"When the previous snapshot's RPC reading time does not parse, the stuck-height check silently does not run and RPC health is ok"},{"citation":"resolved","description":"Section 2: an unparsable finalized terminal on the pinned genesis could contradict any escrow, and more than one distinct finalized release is a conflict (line 376). The claimed branch checks suspectTerminals only for REFUNDED, and the refunded branch only for RELEASED. So one clean release plus one unparsable finalized release gives claimed, while one clean release plus a second clean release gives unverified. More conflicting evidence gives a more confident answer. Impact: WRONG ESCROW STATE (claimed/refunded) in a conflicting-evidence case. Reproduced by running. Fix: in the claimed branch also treat suspectTerminals.has(RELEASED) as a conflict (REFUNDED in the refunded branch), or state the exception in RULES.md.","line":383,"path":"observatory/src/escrow.ts","reproduction":"/tmp/rp/e4: one page 100..199 with finalized EscrowOpened@110 (0x01..01) and EscrowReleased@120 (0x02..02) for 0xa1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1, plus a finalized EscrowReleased@130 (0x03..03) with data {'0':'not-an-id'}. `node dist/cli.js escrow --fixtures /tmp/rp/e4` -> state claimed. e4r (Refunded instead) -> refunded. Control e4c (third event's id valid) -> unverified 'more than one distinct finalized release for this escrow'. Expected for e4/e4r: unverified.","severity":"low","snippet":" if (suspectTerminals.has(REFUNDED)) {","title":"A finalized release (or refund) with an unparsable escrow id does not block claimed (or refunded), though a second well-formed release of the same kind makes the escrow unverified"},{"citation":"resolved","description":"Clause 12 refuses a page only when it is not UTF-8 or not RFC 8259 JSON. json.load raises RecursionError on deeply nested data, which `except (OSError, ValueError)` does not catch, so the recount dies with a traceback. On Python 3.11+ it raises ValueError for an integer literal over 4300 digits and refuses the whole census, while TypeScript marks that one event malformed and counts the rest. compare-recount.mjs line 73 then calls any two non-zero exits 'both-refused' agreement. Merged from audit_flow and audit_permissions. Impact: no wrong count shown (both sides fail closed), but the two implementations disagree on valid input. Reproduced by running on Python 3.12.3 (3.13 has the same limits). Fix: catch RecursionError as Unreadable and bound nesting on both sides; parse long integers with parse_int that maps over 16 digits to an unsafe marker; in compare-recount count 'both refused' only on exit 2 from Python.","line":90,"path":"observatory/tools/recount.py","reproduction":"/tmp/rp/c1: page 100..199 with one finalized EscrowOpened@110 whose data also holds 'junk': 100000 nested arrays. `node dist/cli.js census --fixtures /tmp/rp/c1` -> exit 0, complete. `python3 -I tools/recount.py --dir /tmp/rp/c1 --genesis 0x99c172c095340ace980631f9123544c6bebd4839f3437e463533422d8be2d631 --from 100 --to 199` -> exit 1, 'RecursionError: maximum recursion depth exceeded while decoding a JSON array'. /tmp/rp/c2: two opens, the second with index 1 followed by 5000 zeros -> TypeScript exit 0, complete, malformed_dropped 1; Python exit 2 'Exceeds the limit (4300 digits) for integer string conversion'.","severity":"low","snippet":" except (OSError, ValueError) as exc:","title":"Python recount crashes (RecursionError, exit 1) or refuses (4300-digit integer) valid JSON that the TypeScript census counts as complete"},{"citation":"resolved","description":"RULES.md 4 says the scan fails any src module that uses process.getBuiltinModule, process.binding, eval or Function, and computed access, so that an aliased or computed form cannot slip past. The regexes match only literal spellings, and readdirSync(dir) is not recursive while tsconfig compiles everything under src. The runtime block in test/setup.ts still catches these if a test runs them, so this is a gap in the static layer, not a live path; no current src file uses these forms. Fix 13 is partly done. Impact: no current network/sign/spend path. Reproduced by running the scan's own regex list. Fix: scan recursively and ban `process[`, `Reflect.get(process`, `Reflect.` and `.constructor.constructor` in src.","line":170,"path":"observatory/test/guard.test.ts","reproduction":"/tmp/rpscripts/scan.mjs takes the `forbidden` array verbatim from test/guard.test.ts (from 'const NET =' to 'const dir') and tests lines: 'const m = (process as any)[\"getBuiltin\" + \"Module\"](\"node:\" + \"https\");' -> MISSED; 'const gb = Reflect.get(process, \"getBuiltin\" + \"Module\"); ...' -> MISSED; 'const F = [].constructor.constructor; const g = F(\"return this\")();' -> MISSED; 'const b = (process as any)[\"bind\" + \"ing\"](\"spawn_sync\");' -> MISSED; control 'process.getBuiltinModule(\"node:https\")' -> CAUGHT. `node -e 'console.log(typeof process[\"getBuiltin\"+\"Module\"](\"node:child_\"+\"process\").spawnSync)'` -> function. tsconfig include ['src'], but a file src/sub/x.ts is not in readdirSync(src).","severity":"low","snippet":" const files = readdirSync(dir).filter((f) => f.endsWith(\".ts\") && f !== \"guard.ts\");","title":"Source scan misses computed access on process and the Function constructor reached through .constructor, and does not scan src subfolders"},{"citation":"resolved","description":"The work folder comes from os.tmpdir() without realpath. Vitest reports test file names by real path, and relative(copyPkg, f.name) then gives '../../../../realtmp/...', so the control marks every file missing and every mutant 'error'. It fails closed (no false pass), but on stock macOS (/var/folders -> /private/var) the mutants step always exits 1. mutate-canary.mjs and canary.mjs use the same pattern. Reproduced by running. Fix: realpathSync(mkdtempSync(...)).","line":43,"path":"observatory/scripts/mutate.mjs","reproduction":"mkdir /tmp/realtmp; ln -s /tmp/realtmp /tmp/symtmp; `TMPDIR=/tmp/symtmp node scripts/mutate.mjs mutants/census.json` -> exit 1, control_before {outcome:'control-fail', exit:0, files:[{file:'../../../../realtmp/obs-mutate-*/repo/observatory/test/census.test.ts', status:'passed', tests:162}], missing:['test/census.test.ts']}, summary killed 0, other 31. Expected: control-pass and 31 killed, as without the symlink.","severity":"low","snippet":"const work = mkdtempSync(join(tmpdir(), \"obs-mutate-\"));","title":"Mutation runner fails every control when the temp folder is reached through a symlink, so 206 of 206 cannot be shown there (fails closed)"},{"citation":"resolved","description":"original.replace(m.find, m.replace) with a string pattern still expands $-patterns in the replacement, so a future mutant containing $& would be written differently from what mutants.json records. No current mutant has such a sequence, so no present result is wrong. Found by reading; the replace behaviour was reproduced. Fix: original.replace(m.find, () => m.replace) or split/join.","line":160,"path":"observatory/scripts/mutate.mjs","reproduction":"`node -e 'console.log(\"a+b\".replace(\"b\",\"$&$&\"))'` -> a+bb (not a+$&$&). A mutant {find:'b', replace:'$&$&'} would write 'bb'.","severity":"info","snippet":" writeFileSync(target, original.replace(m.find, m.replace));","title":"Mutation runner applies mutants with String.prototype.replace, which expands $& / $' / $` / $$ in the replacement"}],"hash":"9a328272cbc82fb339a26988ff07e5e233ac992758caf0775f1bc596590593ad","nodeId":"216f7962-79e7-452b-9974-60b403bcfc33","outcome":"completed","summary":"I've written 15 findings to `.imd-findings.json`: 2 high, 5 medium, 7 low and 1 info. I ran a reproduction for each one, merged the specialists' duplicates, and checked every snippet against its file and line. All the reproduction inputs are in `/tmp/rp`, outside the repository. The tracked tree is unchanged; `npm run check` created only ignored folders (`check-runs/`, `dist/`, `node_modules/`).\n\n## The check run\n- **Results:** `npm run check`: all 28 steps exit 0, 612 of 612 tests pass, 206 of 206 mutants are killed.\n- **Digest:** it is `cf862b04…`, not `bc051936…`. This machine has Node v24.21.0 and Python 3.12.3, not v22.23.4 and 3.13.18, and you said the digest differs off Node 22. I saw no other difference.\n\n## The 15 findings of job a24f9aa1\n- **Fixed (12):** 1, 2, 3, 5, 6, 7, 8, 9, 10, 11, 14, 15. I re-ran each against its fixture; for example, the stale `/chain` reading now gives reset_detected null, and a release above height 150 is unverified. For 8 and 9 the evidence is the check run's canary and mutation results. I did not open the drift-long-decimal fixture for 10; its test passed in the run.\n- **Partly fixed (3):**\n - **Fix 4:** the previous snapshot is now read only from the log's last line, so one snapshot without an RPC reading hides a rollback.\n - **Fix 12:** free text and `aria-label` on the page are still not checked.\n - **Fix 13:** the source scan misses computed `process[...]` access and doesn't look in `src/` subfolders.\n- **Not fixed:** none.\n\n## New findings\n**High**\n- **Missing block_number counts as evidence** (`src/escrow.ts:105`): an event with no `block_number` key is taken as clean evidence, giving funded, claimed or refunded. With a finalized height of 150 such a release still gives claimed with no notes, because a null block number skips the height bound. Both censuses call the same event malformed. **Wrong escrow state.**\n- **Rollback hidden** (`src/cli.ts:156`): if the last snapshot has no RPC reading, a rollback in the next one reads ok with no conflicts. **Wrong health.**\n\n**Medium**\n- **Stuck height never caught** (`src/status.ts:174`): the stuck time is measured only since the last snapshot. Five snapshots 60 s apart on an unchanged height all read ok and not stale. **Wrong health and stale value.**\n- **RPC genesis not gated** (`src/status.ts:243`): the RPC genesis counts toward reset_detected false even when the read errored, is 9 days old, or is dated after the snapshot. RULES.md §1 doesn't state such a gate for the RPC, so this is partly a spec gap. **Wrong reset value.**\n- **Page with a non-UTF-8 name dropped silently** (`src/source.ts:111`): escrow reads funded over a finalized release in that page. TypeScript says partial, Python says complete with the release counted. **Wrong escrow state, and the two disagree.**\n- **Broken page chain ignored** (`src/escrow.ts:225`): a missing `next_page` still gives funded, while the census calls the chain broken. **Wrong escrow state.**\n- **Free text on the page passes** (`scripts/consistency.mjs:181`): a \"reset detected / false\" row made of two th cells, a note paragraph, a second h1, or a lone th all pass with 0 failures. The real cell still says true. **Wrong value shown on the page.**\n\n**Low and info**\n- **Page:** `aria-label` with any value passes.\n- **Status:** unsafe-integer heights read ok; when the previous reading time doesn't parse, the stuck check is skipped and health still reads ok.\n- **Escrow:** one clean release plus an unparsable release gives claimed (the refund case behaves the same).\n- **Recount:** it crashes on deep nesting and refuses integers over 4300 digits, where TypeScript counts.\n- **Tooling:** the source-scan gaps; the mutation runner fails closed when the temp folder is behind a symlink; mutant replacement text expands `$&`.\n\n## Clear by area\n- **Read only (area 4):** nothing at medium or above. No `src/` file reaches the network, starts a process, signs, spends or writes. The scan gaps are static only; the runtim","treeHash":null,"usage":{"cachedInputTokens":1523780,"cost":{"source":"runtime","usdMicros":1491314},"inputTokens":48,"model":"claude-opus-5-5","outputTokens":26446,"runtime":"claude","turns":25,"wallClockMs":675320}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"bf4c5b8707945096","findings":[{"citation":"resolved","description":"RULES.md 3.1 clause 7 says an event is malformed when `block_number` is missing, and adds that the escrow rules read events the same way. Section 2 says a malformed event (missing fields) is ignored with a note and can never make an escrow look funded, claimed or refunded. structureProblem() accepts `n === undefined`, so an event with no block_number key is grouped and used as clean evidence, with block_number null. Census (TypeScript and Python) counts the same event in malformed_dropped, so the escrow table and the census disagree about one event. Because its block_number becomes null it also skips the finalized-height bound at escrow.ts:330 (`c.block_number !== null && c.block_number > height`), so in a snapshot with an RPC finalized height a release with no block_number still yields claimed. Impact: a wrong escrow state (funded / claimed / refunded) from a malformed event. Fix: treat `n === undefined` (key absent) as malformed, e.g. `if (!(\"block_number\" in ev) || (n !== null && !isSafeInt(n)))`, and add a fixture shared with the recount.","line":105,"path":"observatory/src/escrow.ts","reproduction":"Reproduced by running. Fixture dir e1 with meta.json {scenario:'e1', now:'2026-11-10T00:00:00Z', escrow_ids:['0xa1..a1' (64 hex)], pinned_genesis:'0x99c172c0...2d631', census_request:{from_block:100,to_block:199}} and event-pages/000.json = {genesis: pinned, from_block:100, to_block:199, page:0, next_page:null, events:[{block_hash:'0x' + '01'*32, finalized:true, index:0, section:'hasStation', method:'EscrowOpened', data:{'0':'0xa1..a1'}}]} (no block_number key). `node dist/cli.js escrow --fixtures e1` -> state funded, evidence [hasStation.EscrowOpened @ block_number null]. Same with method EscrowReleased -> state claimed. Expected: unverified with 'malformed event ignored' note. `node dist/cli.js census --fixtures e1` -> malformed_dropped 1, escrows_opened 0; `python3 -I tools/recount.py --dir e1 ... --from 100 --to 199` -> malformed_dropped 1. So escrow says funded from the event both censuses call malformed.","severity":"high","snippet":" if (n !== null && n !== undefined && !isSafeInt(n)) {","title":"Escrow reads an event with no block_number field as evidence: a malformed open or release makes the escrow funded or claimed"},{"citation":"resolved","description":"Section 2 makes every escrow unverified when a page could not be read, because 'the missing page could hold a conflicting event'. escrowState() never walks page chains, so a page that names a next_page that is not in the input (a page that was never retained) is not seen as missing at all. An open on page 0 with next_page 1 absent gives funded, though page 1 could hold the release or refund that makes it claimed or refunded. The census over the same input says the chain is broken and all 100 requested blocks are a gap. The rule text only names unreadable and invalid pages, so this is a spec gap as much as a code gap, but its stated reason applies exactly. Impact: funded shown while the evidence that would contradict it is known to be missing. Fix: apply census clause 2 to the escrow pages (a chain on the pinned genesis that is broken, or has disagreeing copies of a page number, makes every escrow unverified with a note), and state it in RULES.md section 2.","line":225,"path":"observatory/src/escrow.ts","reproduction":"Reproduced by running. Fixture e2: same meta as above; event-pages/000.json = {genesis: pinned, from_block:100, to_block:199, page:0, next_page:1, events:[{block_number:110, block_hash:'0x'+'01'*32, finalized:true, index:0, section:'hasStation', method:'EscrowOpened', data:{'0':'0xa1..a1'}}]} and no page 1. `node dist/cli.js escrow --fixtures e2` -> funded, evidence EscrowOpened @110. Expected unverified with a note that page 1 of blocks 100-199 is missing. `node dist/cli.js census --fixtures e2` -> status partial, gaps [100-199], note 'next_page 1 on page 0 names a page that does not exist, so the chain is broken'.","severity":"medium","snippet":" for (const page of pageList) {","title":"Escrow ignores page chains: an open on a page whose next_page is missing reads funded while the census calls the same pages broken"},{"citation":"resolved","description":"Round 5 fix 5 gates the faucet genesis on a usable /chain reading (HTTP 200, no error, reading time that parses, is not in the future and is within the stale limit). The RPC side has no such gate: rpcGenesis is taken from head.genesis_hash whatever head.error and head.observed_at say, and resetDetected() then returns false. A head whose read failed (error set), that is 2 days old, that has no observed_at, or whose observed_at is later than the snapshot time (a conflict) still counts as 'the RPC reports the pinned genesis'. A reset that happened after that old reading cannot show, and RULES.md 1 says callers use reset_detected false as the go-ahead before spending. This is the same defect finding 5 fixed for the faucet, left open on the other source. Impact: wrong reset value (false instead of null). Fix: count the RPC genesis toward reset_detected false only when the head has no error and observed_at parses, is not later than the snapshot time and is within the stale limit (the same gate as chainUsable); otherwise use null for that side. Keep a genesis that differs from the pinned one as true, and say so in RULES.md 1.","line":243,"path":"observatory/src/status.ts","reproduction":"Reproduced by running. Copy fixtures/status-healthy to s1 and change rpc-head.json to {genesis_hash:'0x99c172c0...2d631' (the pinned one), finalized:null, best_number:null, runtime_spec_version:1014002, observed_at:'2026-11-07T23:47:40Z', error:'websocket closed: read timed out'} (meta now is 2026-11-09T23:47:53Z, faucet-chain.json fetched_at 23:47:52Z, HTTP 200). `node dist/cli.js status --fixtures s1` -> reset_detected false, genesis.rpc = pinned, rpc.health degraded with detail 'read error: websocket closed: read timed out; head is 172813s old; no valid finalized head; no valid best height', conflicts []. Expected reset_detected null, because the RPC did not give a usable reading of the pinned genesis. The same holds with observed_at null or later than now.","severity":"high","snippet":" const rpcGenesis = normalizeHash(head.genesis_hash);","title":"reset_detected is false on an RPC reading that failed and is days old: the RPC genesis has no error or freshness gate, unlike the faucet /chain"},{"citation":"resolved","description":"RULES.md 1.1 requires, 'when there is a previous snapshot on the same genesis', no rollback, no changed finalized hash and no stuck height. The CLI takes only the last line of the log. If that snapshot has no RPC genesis or finalized head (the RPC was not read, or the read failed), previous stays null and the three checks are skipped, so the next snapshot's RPC health is ok even when its finalized height is below the one recorded two lines earlier on the same genesis. A one-off RPC outage between two readings is all it takes. Impact: wrong health (ok after a rollback), and conflicts stays empty. Fix: walk the verified log backwards to the latest snapshot whose status has an RPC genesis equal to the current one and a finalized height, hash and rpc.observed_at, and pass that as previous (or keep the highest finalized head seen per genesis).","line":156,"path":"observatory/src/cli.ts","reproduction":"Reproduced by running. sA = copy of fixtures/status-healthy (finalized 3341575, hash 0x5e..5e). sB = same with rpc-head.json deleted. sC = same with rpc-head.json finalized {number:3341500, hash:'0x'+'7a'*32}, best_number 3341510. Control: `node dist/cli.js snapshot --status sA --out oA --log L1; node dist/cli.js snapshot --status sC --out oC --log L1` -> last line status.rpc.health degraded, conflicts ['finalized height went backwards from 3341575 to 3341500 on the same genesis']. Attack: `... --status sA --log L2; ... --status sB --log L2; ... --status sC --log L2` -> last line status.rpc.health ok, detail null, conflicts [], reset_detected false. Expected degraded with the rollback conflict, as in the control.","severity":"high","snippet":" const st = readSnapshots(log).at(-1)?.status;","title":"Snapshot rollback check reads only the last log line: one snapshot without an RPC reading hides a finalized-height rollback, and RPC health reads ok"},{"citation":"resolved","description":"RULES.md 4 says the scan fails any src module that uses the indirect forms process.getBuiltinModule, process.binding, eval and Function, 'called or not', and fails computed access on the global object so 'an aliased, .call or computed form cannot slip past it'. The regexes match only the literal spellings. A computed key on process (process[\"getBuiltin\" + \"Module\"](\"node:https\")), Reflect.get(process, ...), process[\"bind\"+\"ing\"](\"spawn_sync\"), and the Function constructor through [].constructor.constructor or the AsyncFunction prototype all pass. The file list is also not recursive: tsconfig compiles everything under src (include [\"src\"]), but readdirSync(dir) lists only the top folder, so a src/live/net.ts with a plain `import https from \"node:https\"` is never scanned. The runtime block in test/setup.ts still records these when a test executes them, because getBuiltinModule returns the same patched module objects, so this is a gap in the static layer, not a live network path. No current src file uses these forms. Fix: scan src recursively (readdirSync(dir, { recursive: true })), and ban computed or Reflect access on process and the `.constructor` reach to Function (or ban any `process[` / `Reflect.` in src).","line":170,"path":"observatory/test/guard.test.ts","reproduction":"Reproduced by running the scan's own regex list (extracted verbatim from test/guard.test.ts lines 129-168) against these lines: 'const m = (process as any)[\"getBuiltin\" + \"Module\"](\"node:\" + \"https\");' -> MISSED; 'const gb = Reflect.get(process, \"getBuiltin\" + \"Module\"); const cp = gb(\"node:child_\" + \"process\");' -> MISSED; 'const F = [].constructor.constructor; const g = F(\"return this\")();' -> MISSED; 'const AF = Object.getPrototypeOf(async () => {}).constructor; await AF(\"return 1\")();' -> MISSED; 'const b = (process as any)[\"bind\" + \"ing\"](\"spawn_sync\");' -> MISSED. `node -e 'typeof process[\"getBuiltin\"+\"Module\"](\"node:child_\"+\"process\").spawnSync'` -> function, so the first line does reach child_process outside tests. A file src/sub/x.ts is not in the list readdirSync(new URL('../src/', ...)) returns, so it is never checked.","severity":"low","snippet":" const files = readdirSync(dir).filter((f) => f.endsWith(\".ts\") && f !== \"guard.ts\");","title":"Source scan misses computed access on process, the Function constructor reached through .constructor, and every module in a src subfolder"},{"citation":"resolved","description":"Clause 12 refuses a page only when it is not standard JSON (RFC 8259); clause 14 makes an event whose integer field is unsafe malformed, not the page unreadable. On Python 3.11 and later (the check pins 3.13) json.load raises ValueError for an integer literal over 4300 digits (sys.int_max_str_digits, not adjustable under -I), so recount.py refuses the whole census, while TypeScript parses it to Infinity, marks that one event malformed and counts the rest. A page with deeply nested data (100000 levels of [ ] inside `data`) makes json.load raise RecursionError, which is not caught by `except (OSError, ValueError)`, so recount.py crashes with a traceback (exit 1) while TypeScript counts normally. TypeScript and Python then disagree on valid input. Both fail closed in scripts/compare-recount.mjs, but that script also scores any two non-zero exits as 'both-refused' agreement (line 71), so a Python crash alongside a TypeScript refusal reads as agreement. Impact: no wrong count shown; the independent cross-check is not independent on these inputs. Fix: in recount.py parse with parse_int=lambda s: int(s) if len(s.lstrip('-')) <= 16 else float('inf') (or Decimal) and catch RecursionError as Unreadable only if TypeScript also refuses (or cap nesting in both); in compare-recount accept 'both refused' only when Python exits 2 with its own refusal.","line":89,"path":"observatory/tools/recount.py","reproduction":"Reproduced by running. c1/event-pages/000.json: {genesis: pinned, from_block:100, to_block:199, page:0, next_page:null, events:[{block_number:110, block_hash:'0x'+'01'*32, finalized:true, index:0, section:'hasStation', method:'EscrowOpened', data:{who:'a'}}, {same but index: 1 followed by 5000 zeros}]}. `node dist/cli.js census --fixtures c1` -> complete, escrows_opened 1, malformed_dropped 1. `python3.12 -I tools/recount.py --dir c1 --genesis 0x99c1...d631 --from 100 --to 199` -> exit 2 'Exceeds the limit (4300 digits) for integer string conversion: value has 5001 digits'. (Python 3.9.6 on this machine has no limit and agrees with TypeScript.) c2: one event whose data is {who:'a', x: 100000 nested arrays}. TypeScript -> complete, escrows_opened 1. python3 and python3.12 -> Traceback (RecursionError), exit 1.","severity":"low","snippet":" page = json.load(fh, parse_constant=_reject_constant)","title":"Python recount refuses or crashes on valid JSON that the TypeScript census counts: integers over 4300 digits and deep nesting"},{"citation":"resolved","description":"The work folder is built from os.tmpdir() without realpath. Vitest reports test file names by their real path, and runVitest() maps them back with relative(copyPkg, f.name). When tmpdir is a symlink (/tmp -> /private/tmp, or the macOS default /var/folders -> /private/var/folders), every file name comes back as '../../../../../private/tmp/.../test/x.test.ts', so control() lists every named test file as missing and reports control-fail with exit 0 and all files passed, and each mutant's run.files.find(x => x.file === m.test) finds nothing. mutate-canary inherits it (three of four canaries 'classified-wrong'). It fails closed, so it cannot report a false pass, but on such a machine the mutants and mutants-canary steps always exit 1 and the 206/206 claim cannot be reproduced there. Fix: const work = realpathSync(mkdtempSync(join(tmpdir(), 'obs-mutate-'))) here and in mutate-canary.mjs and canary.mjs if they do the same.","line":43,"path":"observatory/scripts/mutate.mjs","reproduction":"Reproduced by running `npm run check` on macOS with Node v24.18.0 and TMPDIR=/tmp/claude-501 (/tmp is a symlink to /private/tmp). steps: mutants exit 1, mutants-canary exit 1, every other step exit 0, 612 of 612 tests passed. mutants.json: control_before {outcome:'control-fail', exit:0, files:[{file:'../../../../../private/tmp/claude-501/obs-mutate-EeDrol/repo/observatory/test/attempts-check.test.ts', status:'passed', tests:11, failed:0}, ...]}. mutants-canary.json: canary-real-bug got 'error', canary-equivalent got 'error', canary-syntax-error got 'error' (all classified-wrong); control_before and control_after 'control-fail'.","severity":"low","snippet":"const work = mkdtempSync(join(tmpdir(), \"obs-mutate-\"));","title":"Mutation runner fails every control when the temp folder is reached through a symlink (stock macOS), so 206 of 206 cannot be shown there"}],"hash":"b49d4164275116046c20d39dafe4fa4858f33ddcd9a528309a6c7e1fd1ba1e6c","nodeId":"f6c7b955-def5-4cf6-82b9-4b473cb777a4","outcome":"completed","summary":"I found 7 problems: 3 high, 1 medium and 3 low. All 7 were reproduced by running them. Of the 15 earlier findings, 11 are fixed and 4 are only partly fixed. The findings are in `.imd-findings.json`. I changed no repository files; `npm run check` wrote only `check-runs/`, `dist/` and `node_modules/`, which git ignores, so `git status` is clean.\n\n## The check run\nThis machine has Node v24.18.0 and Python 3.9.6, not 22.23.4 and 3.13.18.\n- 26 of 28 steps exit 0, and 612 of 612 tests pass.\n- The output digest is `e0c2255243f498c45eb5d3e52cfe9ce034947ff2da625bd1fac40edb1560660b`. It differs from `bc0519…` only because the Node version differs, as the README predicts.\n- `mutants` and `mutants-canary` exit 1. This machine's temp folder is reached through a symlink, so every control run fails (low finding 7). It fails safe, but it means **I could not confirm the 206 of 206 mutants killed**.\n- The final `SHA256SUMS` step failed because this sandbox blocks `mktemp`. That is not a repository defect.\n\n## The 15 earlier findings\n| # | Verdict | Reproduction |\n|---|---|---|\n| 1, 2 | fixed | `escrows-unsafe-index` gives unverified for the unsafe event; `escrows-unsafe-page-range` gives unverified, unverified |\n| 3 | fixed | `census-invalid-utf8` and `census-byte-order-mark` are both refused (exit 2) |\n| 4 | **partly** | Snapshots A then C catch the rollback. A, then one with no RPC reading, then C miss it (finding 4) |\n| 5 | **partly** | Faucet side fixed: `status-readings-days-old` gives reset_detected null. The RPC genesis has no such check (finding 3) |\n| 6 | fixed | `census-event-pages-file` and `-link` are refused |\n| 7 | fixed | `escrows-two-opens-and-release` gives unverified, unverified |\n| 8 | fixed | Every canary was caught by the harness; the `attempts` step exits 0 |\n| 9 | fixed | `mutants-canary` reports the copy correct and the setup failure reported correctly |\n| 10 | fixed | `drift-long-decimal`: the long exact value matches, the mismatch is caught, the tiny fraction is unknown |\n| 11 | **partly** | Works when the event has a block number. An event with no block number skips the finalized-height bound (finding 1) |\n| 12 | fixed (as far as tested) | All 39 consistency tampers behave as expected; odd escrow ids make the check fail rather than pass |\n| 13 | **partly** | The bare names are banned, but computed access on `process` and `src` subfolders get past the scan (finding 5) |\n| 14 | fixed | `escrows-negative-block-number` gives unverified; `census-negative-from-block` is refused |\n| 15 | fixed | README lines 35–36 state the Node-version caveat; the CI workflow pins 22.23.4 |\n\n## New findings\n1. **High – `src/escrow.ts:105`.** An open or release event with no `block_number` field gives **funded** or **claimed**. Both the TypeScript and Python census count that same event as malformed, and RULES says a malformed event can never set an escrow state. With no block number it also skips the finalized-height check. *Wrong escrow state.*\n2. **Medium – `src/escrow.ts:225`.** The escrow code never follows page chains. If page 0 holds an open and points to a page 1 that isn't there, the escrow reads **funded**, while the census over the same pages calls the chain broken. This is partly a gap in the rules too. *Wrong escrow state.*\n3. **High – `src/status.ts:243`.** The RPC genesis counts toward `reset_detected` whether or not that reading worked. A reading that failed with a timeout and is two days old still gives **reset_detected false**. The faucet `/chain` reading has had this check since fix 5; the RPC side doesn't. *Wrong reset value.*\n4. **High – `src/cli.ts:156`.** The snapshot command reads only the last line of the log. Snapshot A, then one with no RPC reading, then C with a lower finalized height gives RPC health **ok** and no conflicts. Run A then C directly and it is degraded. *Wrong health.*\n5. **Low – `test/guard.test.ts:170`.** The source scan misses `process[\"getBuiltin\"+\"Module\"]`, `Reflect.get(process, …)`, `process[\"","treeHash":null,"usage":{"cachedInputTokens":3628437,"cost":{"source":"runtime","usdMicros":2955016},"inputTokens":62,"model":"claude-opus-5-5","outputTokens":50084,"runtime":"claude","turns":39,"wallClockMs":659068}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"918f8261a6fd589c","findings":[{"citation":"resolved","description":"FixtureSource.fromDir lists event-pages with readdirSync (default utf8 encoding), which decodes a file name holding an invalid UTF-8 byte (for example 0xff) to U+FFFD. The entry passes the clause 15 checks (regular file, ends in .json, no leading dot), but join(dir, 'event-pages', name) then names a path that does not exist, and read() returns undefined on !existsSync without pushing anything to loadErrors or pageErrors. The page is lost with no note. RULES.md section 2 line 102 and clause 12 say a page that could not be read leaves every escrow unverified and refuses the census; instead the escrow is evaluated without that page and comes out funded although the input directory holds a finalized hasStation.EscrowReleased for it. tools/recount.py reads the same directory through os.listdir (surrogateescape names) and counts the page, so TypeScript and Python disagree on completeness and on totals. Reproduced by running. Fix: report an entry whose name does not round-trip as a page error (readdirSync with encoding 'buffer' and a strict decode, or treat ENOENT after a successful readdir as a load error) and never return undefined silently for an entry the directory listing produced.","line":111,"path":"observatory/src/source.ts","reproduction":"Fixture under $TMPDIR/repro/E: meta.json {\"scenario\":\"E\",\"now\":\"2026-11-10T00:00:00Z\",\"synthetic\":true,\"pinned_genesis\":\"0x99c172c095340ace980631f9123544c6bebd4839f3437e463533422d8be2d631\",\"escrow_ids\":[\"0x6fca0e2333da351600475a298ff0bd15acc42933b1ea6873ced2c15910e2cac5\"],\"census_request\":{\"from_block\":0,\"to_block\":199}}; event-pages/00.json: page genesis pinned, from_block 0, to_block 99, page 0, next_page null, one finalized hasStation.EscrowOpened at block 10 with data {\"0\": , \"who\":\"alice\"}; a second file whose name is the bytes 30 31 2d ff 2e 6a 73 6f 6e ('01-\\xff.json', written with open(b'...')), holding a complete page from_block 100, to_block 199, page 0, next_page null, with one finalized hasStation.EscrowReleased at block 150 for the same id. Commands: node dist/cli.js escrow --fixtures $TMPDIR/repro/E ; node dist/cli.js census --fixtures $TMPDIR/repro/E ; python3 -I tools/recount.py --dir $TMPDIR/repro/E --genesis 0x99c1...2d631 --from 0 --to 199. Expected: escrow unverified with a note naming the unreadable page, census refused (exit 2) in both implementations. Actual: escrow state \"funded\" with evidence [hasStation.EscrowOpened] and no note about the page; TypeScript census exit 0, status partial, gaps [100-199], escrows_released 0; Python recount exit 0, status complete, escrows_released 1.","severity":"medium","snippet":" if (!existsSync(path)) return undefined;","title":"A page file whose name holds a non-UTF-8 byte is silently dropped by the fixture loader: escrow shows funded over a finalized release, census shows a gap, Python counts the page"},{"citation":"resolved","description":"RULES.md 1.1 requires, when there is a previous snapshot on the same genesis, 'no finalized height stuck for longer than the stale limit' (120 s by default), and rpc.stale true when the finalized height is stuck. classifyRpc measures the stuck time as the seconds between the previous snapshot's RPC reading time and now. cli.ts passes only the last line of the log as previous. So with snapshots taken more often than the stale limit (every 60 s here), the finalized height can stay at one value indefinitely and every snapshot measures only 60 s, reports rpc.health ok and rpc.stale false. The condition the rule names (the height has not moved for longer than the limit) is true from the third snapshot on and is never detected. This yields a wrong health and a wrong stale value, which the interfaces README tells Seat Court to act on deadlines with. Reproduced by running. Fix: when the previous snapshot has the same finalized height and hash, carry forward the time that height was first seen (walk the verified log back over consecutive snapshots with the same head, or store a 'finalized_since' in the status) and compare that to now.","line":174,"path":"observatory/src/status.ts","reproduction":"Five copies of fixtures/status-healthy (same rpc-head finalized number 3341575 and hash 0x5e5e...), copy k having rpc-head observed_at 2026-11-09T23:(47+k):48Z and faucet-health, faucet-chain and gateway-models fetched_at 2026-11-09T23:(47+k):50Z. Run, in order, node dist/cli.js snapshot --status --out $TMPDIR/repro/C/out --log $TMPDIR/repro/C/log.jsonl --now 2026-11-09T23:(47+k):53Z for k = 0..4. Expected: from seq 2 (120 s after seq 0, finalized height unchanged for 2 minutes, over the 120 s limit at seq 3) rpc.health degraded with detail 'finalized height stuck at 3341575 for ...s' and rpc.stale true. Actual: every snapshot seq 0..4 has rpc.health ok, rpc.stale false, detail null, conflicts [] (output of $TMPDIR/repro/C/out/snapshot.json).","severity":"medium","snippet":" const since = secondsBetween(previous.observed_at, o.now);","title":"A finalized height stuck across many consecutive snapshots is never reported stuck: the stuck check only measures the interval since the immediately previous snapshot"},{"citation":"resolved","description":"RULES.md section 5 says nothing on the page may be hidden and every value must sit where a person reads it, and the README claims that every page cell is compared and that a wrong value cannot be shown in a cell without data-k. The check enforces data-k only on td and span. Any th, p, h1, h2 text, div and code text is free. A row with two th cells and no td is skipped as a header row (line 181), so a tampered page can carry, inside the status table under the Network status heading, a row that reads 'reset detected' / 'false' in the same style as the real rows while the snapshot says true. The section check (line 401) only looks at data-k keys, the element and attribute allowlists accept th, p and h1 with scope and class, and the heading check only constrains h2. The same holds for a p.note in the status card reading 'reset detected: false. Chain is the pinned genesis; safe to spend.' and for a second h1 'No reset detected'. A reader of the page sees a wrong reset value; the check reports 0 failures. This is the misplaced-value case of area 5 that passes. Reproduced by running against the reset scenario output of this commit's own check run. Fix: require data-k (or data-for) on every th, forbid rows without a td, and either forbid p, h1 and code text that the renderer does not write (compare the page outside the marked cells to a template rendered from the snapshot) or require every text node outside a marked element to be one of the renderer's fixed strings.","line":181,"path":"observatory/scripts/consistency.mjs","reproduction":"Copy check-runs///outputs/reset to $TMPDIR/tamper/reset-row and insert, immediately before the real '| reset detected | ' row in index.html, the row '
|---|
| reset detected | false |
|---|
'. Run node scripts/consistency.mjs $TMPDIR/tamper/reset-row. Expected: exit 1 with a failure naming the row. Actual: exit 0, {\"checks\": 2107, \"failures\": []} while the snapshot and the real cell say reset_detected true. Variant reset-p: insert 'reset detected: false. Chain is the pinned genesis; safe to spend. ' right after 'Network status': exit 0, 2103 checks, no failure. Variant reset-h1: insert ' No reset detected' after the page h1: exit 0, no failure.","severity":"medium","snippet":" if (tds.length === 0) continue; // a header row","title":"The page check lets free text state a wrong value: a row of two th cells reading 'reset detected / false' inside the status table, a paragraph, or a second h1 all pass consistency.mjs"},{"citation":"resolved","description":"The renderer writes aria-label only as aria-label=\"unknown\" on blank unknown cells (src/page.ts lines 34 and 168). The checker allowlists the attribute name on every element and never compares its value, and an aria-label replaces the cell's text for assistive technology. A tampered page can therefore present reset_detected as false to a screen-reader user while the visible text, data-v and the snapshot all say true, and the check passes. RULES.md section 5 says only the attributes the renderer writes are allowed; the renderer never writes this attribute with another value or on a cell with a value. Reproduced by running. Fix: accept aria-label only with the value unknown, only on a td whose data-v is unknown and whose text is empty, and compare it in checkCell.","line":360,"path":"observatory/scripts/consistency.mjs","reproduction":"Copy check-runs/ //outputs/reset to $TMPDIR/tamper/reset-aria and change 'true | ' in index.html to 'true | '. Run node scripts/consistency.mjs $TMPDIR/tamper/reset-aria. Expected: exit 1 with an attribute failure. Actual: exit 0, {\"checks\": 2101, \"failures\": []}.","severity":"low","snippet":" const ATTRS = new Set([\"lang\", \"charset\", \"name\", \"content\", \"class\", \"scope\", \"aria-label\", \"data-k\", \"data-v\", \"data-n\", \"data-for\", \"data-row\", \"data-section\", \"data-col\", \"data-escrow\"]);","title":"consistency.mjs allows aria-label on any element with any value, so a cell can read 'false' to a screen reader while its text and data-v say true"},{"citation":"resolved","description":"The PR says src/strict.ts holds the one reading of a safe integer so that escrow, census and status cannot drift apart, and census clause 14 says a value beyond 2^53-1 is not an integer because JSON parsing has already rounded it. status.ts still reads finalized.number, best_number and runtime_spec_version through nonNegativeInt, which uses Number.isInteger. A head whose finalized number is 9007199254740993 parses to 9007199254740992 and is reported as a valid finalized height with rpc health ok; the lag is computed from rounded values (4 instead of 2 here). That rounded height is then the finalized height that bounds escrow evidence in buildSnapshot. Found by reading, reproduced by running. Fix: use isSafeInt from strict.ts in nonNegativeInt so that such a head fails the 'present and valid' check and rpc health is degraded.","line":41,"path":"observatory/src/status.ts","reproduction":"Copy fixtures/status-healthy to $TMPDIR/repro/B and in rpc-head.json replace the finalized number 3341575 with 9007199254740993 and best_number 3341577 with 9007199254740995 (as JSON number literals). Run node dist/cli.js status --fixtures $TMPDIR/repro/B. Expected: rpc.health degraded (no valid finalized head / best height), finalized_height null. Actual: rpc.health ok, rpc.stale false, finalized_height 9007199254740992, best_height 9007199254740996, finality_lag 4, conflicts [], reset_detected false.","severity":"low","snippet":" return typeof value === \"number\" && Number.isInteger(value) && value >= 0 ? value : null;","title":"status.ts accepts unsafe integers for heights and runtime version (Number.isInteger, not the shared isSafeInt): finalized 2^53+1 is reported as 2^53 with rpc ok"},{"citation":"resolved","description":"RULES.md 1.1: ok needs every check to run and pass, and a check that cannot run leaves health unknown (as the code does for the head's own observed_at). The stuck check compares previous.observed_at to now; cli.ts passes the previous snapshot's rpc.observed_at whenever it is non-null, and networkStatus stores the raw head observed_at even when it does not parse (a time without a zone, for example, which gives rpc health unknown in that earlier snapshot). In the next snapshot with the same finalized head, secondsBetween returns null and the stuck branch is skipped without adding to cannotRun, so health is ok although the height may have been stuck for over an hour. Reproduced by running. Fix: when previous is present on the same genesis with the same finalized head and its observed_at does not parse, push to cannotRun (health unknown) instead of skipping.","line":175,"path":"observatory/src/status.ts","reproduction":"Snapshot 0: copy fixtures/status-healthy to $TMPDIR/repro/D/s0 and set rpc-head.json observed_at to \"2026-11-09T23:47:40\" (no zone); node dist/cli.js snapshot --status $TMPDIR/repro/D/s0 --out $TMPDIR/repro/D/out0 --log $TMPDIR/repro/D/log.jsonl --now 2026-11-09T23:47:53Z gives rpc.health unknown, finalized_height 3341575, rpc.observed_at \"2026-11-09T23:47:40\". Snapshot 1: another copy with the same finalized head, rpc-head observed_at 2026-11-10T00:57:48Z and the three fetched_at values 2026-11-10T00:57:50Z; node dist/cli.js snapshot --status $TMPDIR/repro/D/s1 --out $TMPDIR/repro/D/out1 --log $TMPDIR/repro/D/log.jsonl --now 2026-11-10T00:57:53Z. Expected: rpc.health unknown (stuck check could not run) or degraded (height unchanged for 70 minutes). Actual: rpc.health ok, rpc.stale false, detail null.","severity":"low","snippet":" if (since !== null && since > o.staleAfterSeconds) {","title":"When the previous snapshot's RPC reading time does not parse, the stuck-height check silently cannot run and rpc health is still ok"},{"citation":"resolved","description":"RULES.md section 2: a finalized hasStation.EscrowReleased or EscrowRefunded on the pinned genesis whose escrow id does not parse could contradict any escrow, so every escrow it could contradict is unverified, and 'more than one distinct finalized release for this escrow' is itself a conflict (escrow.ts line 376, fixture A3 below gives unverified). An unparsable finalized release could be that second distinct release, yet with one clean release and one unparsable finalized release the state is claimed, because the claimed branch only checks suspectTerminals for REFUNDED; the refunded branch likewise ignores a suspect REFUNDED. 'More conflicting evidence never gives a more confident answer' is not kept: two well-formed releases give unverified, one well-formed plus one unreadable give claimed. Reproduced by running. Fix: in the claimed branch treat suspectTerminals.has(RELEASED) as a conflict too (and REFUNDED in the refunded branch), or state in RULES.md that an unparsable terminal of the same kind does not contradict.","line":383,"path":"observatory/src/escrow.ts","reproduction":"Fixture $TMPDIR/repro/A: meta.json with pinned_genesis 0x99c1...2d631 and escrow_ids [0x6fca0e2333da351600475a298ff0bd15acc42933b1ea6873ced2c15910e2cac5]; event-pages/00.json one page blocks 0 to 99, page 0, next_page null, events: finalized EscrowOpened at block 10 (block_hash 0xaa..aa, index 0, data {\"0\": id}), finalized EscrowReleased at block 20 (0xbb..bb, index 0, data {\"0\": id}), finalized EscrowReleased at block 30 (0xcc..cc, index 0, data {\"0\": \"not-an-id\"}). node dist/cli.js escrow --fixtures $TMPDIR/repro/A. Expected: unverified with a conflicting-evidence note (the unparsable release could be a second distinct release). Actual: state claimed, notes ['malformed event ignored: hasStation.EscrowReleased (escrow id is not 0x plus 64 hex)', ...]. Same with Refunded in place of Released (A2): refunded. Control A3 with the third event's data {\"0\": id}: unverified, 'more than one distinct finalized release for this escrow'.","severity":"low","snippet":" if (suspectTerminals.has(REFUNDED)) {","title":"A finalized release (or refund) whose escrow id does not parse does not contradict a claimed (or refunded) escrow, although a well-formed second distinct release would make it unverified"}],"hash":"c59636b6f012ae40a0b3f40eaed6ab9522f8c1378896c958dce0e7f633a45ba2","nodeId":"83248bfb-44c8-4642-b866-feba9df729c3","outcome":"completed","summary":"The review is complete. Seven findings are in `.imd-findings.json` at the repository root, each with a concrete input and a command that reproduces it. No source file was changed. The scratch work lives under `$TMPDIR` only.\n\n## Check run on this machine\n\n`npm run check` at b4a7a99 ran clean here: all 28 steps exit 0, 612 tests in 13 files pass, 206 of 206 mutants killed, 26 census fixtures agree (14 with totals, 12 both refused), 9 of 9 canaries caught, 34 of 34 page tampers caught, journal check with 13 files and 39 cleared attempts, no problems.\n\n| Item | Pinned | Here |\n|---|---|---|\n| Node | v22.23.4 | v24.21.0 |\n| Python | 3.13.18 | 3.12.3 |\n| Outputs digest (45 files) | bc051936…994a | cf862b04…e991 |\n\nThe digest differs only because every `pin.node` records the Node version, as the README says. The run report shows `dirty: yes`, which comes from this sandbox's own dotfiles sitting untracked in the repository root, not from the tree.\n\n## The 15 findings of job a24f9aa1\n\nAll 15 are fixed. 13 reproduced by running, 2 confirmed by reading.\n\n| # | Status | How I checked |\n|---|---|---|\n| 1 unsafe index/block_number | fixed, run | `escrows-unsafe-index`: a1 unverified, \"index is not a safe whole number\" |\n| 2 unsafe page field | fixed, run | `escrows-unsafe-page-range`: both escrows unverified, page invalid |\n| 3 lossy UTF-8 | fixed, run | `census-invalid-utf8` and `census-byte-order-mark`: TypeScript exit 2 and Python exit 2 |\n| 4 previous never passed | fixed, run | two snapshots into one log, second with a lower height: degraded, \"finalized height went backwards from 3341575 to 3340000\"; a corrupted log line refuses with exit 2 |\n| 5 /chain unchecked | fixed, run | /chain with HTTP 500, no response, or an old reading: faucet genesis null and reset null; a future reading adds the conflict |\n| 6 event-pages as a file | fixed, run | file and link fixtures: census refused in both implementations, escrows unverified |\n| 7 two opens plus release | fixed, run | `escrows-two-opens-and-release`: unverified, \"more than one distinct finalized open\" |\n| 8 late timer attempt | fixed, run | canary.json: 9 harness-caught-it, 1 control-pass, 1 missed-without-the-journal-check; attempts-check 13 files, 0 problems |\n| 9 untracked files copied | fixed, read | tracked.mjs uses `git ls-files -z --cached`; mutants.json copy report 367 tracked, 367 copied, setup-pass |\n| 10 drift decimals | fixed, run | `drift-long-decimal`: 2 match, 1 mismatch, 1 unknown |\n| 11 release above height | fixed, run | snapshot with RPC finalized 50 against the fixture: all three escrows unverified with the above-height conflict note |\n| 12 comments and hidden rows | fixed, run | an HTML comment around the reset row now fails the check; consistency canary 34 caught |\n| 13 scan misses aliases | fixed, read | guard.test.ts bans the bare names and the global object, 25 samples |\n| 14 negative block_number | fixed, run | `escrows-negative-block-number`: out of range, unverified; `census-negative-from-block` refused on both sides |\n| 15 digest per Node version | fixed, read | README states v22.23.4; my v24 digest differs as predicted |\n\n## New findings\n\n**Medium, escrow and census (area 1 and 3), reproduced by running.** A page file whose name holds a byte that is not UTF-8 is silently dropped by the fixture loader. Node decodes the name to U+FFFD, the clause 15 checks pass, and then the path does not exist, so the loader returns undefined without a page error. With a finalized release in such a file, the escrow comes out funded. Python reads the same directory and counts the page, so the two implementations disagree on completeness and totals. File `observatory/src/source.ts` line 111.\n\n**Medium, network status (area 2), reproduced by running.** A finalized height that never moves is never reported stuck when snapshots are taken more often than the stale limit. Each snapshot compares only against the immediately previous log line, so five snapshots 60 seconds apart with","treeHash":null,"usage":{"cachedInputTokens":2040575,"cost":{"source":"runtime","usdMicros":8070604},"inputTokens":450,"model":"claude-fable-5-1","outputTokens":68027,"runtime":"claude","turns":41,"wallClockMs":1059273}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"934ef01306a3cc89","findings":[{"citation":"resolved","description":"RULES.md section 2 says a malformed event (missing fields, wrong types) is ignored with a note and can never make an escrow look funded, claimed or refunded, and clause 7 (which section 2 and clause 7 itself say the escrow rules follow: 'The escrow rules read events the same way') makes an event malformed when block_number is missing. src/census.ts readEvent() does that (line 235: undefined is not null and not a safe int, so the event is malformed). src/escrow.ts structureProblem() instead accepts undefined, so the same event is clean evidence in the escrow result and malformed in the census. Because the copy's block_number becomes null, the above-finalized-height check (line 330) and the page block-range check (line 257) cannot run on it, so a 'finalized' release that the page places nowhere moves the escrow to claimed under a finalized-height bound it was never checked against. Found by reading, reproduced by running. Wrong escrow state: yes (claimed from an event the spec calls malformed). Fix: in structureProblem() treat an absent block_number like census readEvent(): `if (!('block_number' in ev) || (n !== null && !isSafeInt(n))) return 'block_number is missing...'`, and add the fixture and a mutant.","line":105,"path":"observatory/src/escrow.ts","reproduction":"Input: one escrow fixture dir with meta.json {\"scenario\":\"x\",\"description\":\"\",\"now\":\"2026-11-09T23:47:53Z\",\"synthetic\":true,\"escrow_ids\":[\"0x6fca0e2333da351600475a298ff0bd15acc42933b1ea6873ced2c15910e2cac5\"],\"pinned_genesis\":\"0x99c172c095340ace980631f9123544c6bebd4839f3437e463533422d8be2d631\",\"census_request\":{\"from_block\":0,\"to_block\":5000000}} and event-pages/000.json {\"genesis\":\"0x99c172c095340ace980631f9123544c6bebd4839f3437e463533422d8be2d631\",\"from_block\":0,\"to_block\":5000000,\"page\":0,\"next_page\":null,\"events\":[{\"block_number\":100,\"block_hash\":\"0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"finalized\":true,\"index\":0,\"section\":\"hasStation\",\"method\":\"EscrowOpened\",\"data\":{\"0\":\"0x6fca0e2333da351600475a298ff0bd15acc42933b1ea6873ced2c15910e2cac5\"}},{\"block_hash\":\"0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\",\"finalized\":true,\"index\":0,\"section\":\"hasStation\",\"method\":\"EscrowReleased\",\"data\":{\"0\":\"0x6fca0e2333da351600475a298ff0bd15acc42933b1ea6873ced2c15910e2cac5\"}}]} (the release has NO block_number key).\nCommands (observatory/, after npm run build): node dist/cli.js escrow --fixtures -> state \"claimed\", evidence lists hasStation.EscrowReleased, no malformed note. node dist/cli.js census --fixtures -> escrows_released 0, malformed_dropped 1 for the same page. node dist/cli.js snapshot --status fixtures/status-healthy --escrows --out -> escrows[0].state \"claimed\", finalized_height 3341575, evidence hasStation.EscrowReleased@null, notes [].\nExpected: state \"unverified\" with a 'malformed event ignored' note (missing block_number, clause 7) and a 'malformed finalized release could be about this escrow' conflict, as for any other malformed finalized terminal event. Actual: \"claimed\".","severity":"medium","snippet":" if (n !== null && n !== undefined && !isSafeInt(n)) {","title":"Escrow treats an event with no block_number field as well formed evidence, while RULES clause 7 and the census call it malformed; a finalized release with the field missing yields claimed and escapes "},{"citation":"resolved","description":"Round 5 (finding 5) made the faucet genesis count only from a usable /chain reading: HTTP 200, no error, a parsable reading time that is fresh and not later than the snapshot (status.ts lines 233-239). The RPC side has no such gate: head.genesis_hash is normalized and used for reset_detected and for status.genesis.rpc whatever head.error says and however old or future head.observed_at is. RULES section 1 says reset_detected is false only when both sources report the pinned genesis; a read that errored or a head older than the stale limit is not a current report, and section 1.1 already treats such a head as a failed check. snapshot.ts line 45 then applies that head's finalized_height as the bound on escrow evidence because status.genesis.rpc equals the pin. Found by reading, reproduced by running. Wrong reset value: reset_detected false on a stale, errored read; a caller following interfaces/README.md ('continue only when reset_detected === false') is not stopped by this field. Fix: compute rpcGenesis only when head.error is null and the head age is >= 0 and <= staleAfterSeconds (the same gate as chainUsable), otherwise null with a conflict note, and let snapshot.ts use finalized_height only under the same gate.","line":243,"path":"observatory/src/status.ts","reproduction":"Input: copy fixtures/status-healthy/ and replace rpc-head.json with {\"genesis_hash\":\"0x99c172c095340ace980631f9123544c6bebd4839f3437e463533422d8be2d631\",\"finalized\":{\"number\":3341575,\"hash\":\"0x5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e\"},\"best_number\":3341577,\"runtime_spec_version\":1014002,\"observed_at\":\"2026-11-01T00:00:00Z\",\"error\":\"read timed out; values are from the client cache\"} (snapshot time in meta.json is 2026-11-09T23:47:53Z, so the head is 776873 s old and the read errored).\nCommand: node dist/cli.js status --fixtures \nActual: reset_detected false, genesis.rpc = pinned, rpc.health \"degraded\" with detail \"read error: ...; head is 776873s old\", finalized_height 3341575, conflicts []. With the same fixture as --status in a snapshot with escrows, escrows[].finalized_height is 3341575.\nExpected: genesis.rpc null and reset_detected null (not enough current evidence), as the faucet side already does for an errored or stale /chain reading.","severity":"low","snippet":" const rpcGenesis = normalizeHash(head.genesis_hash);","title":"RPC genesis counts toward reset_detected=false even when the RPC head read reports an error or is stale or later than the snapshot; the finalized height of that head also bounds the escrow evidence"},{"citation":"resolved","description":"RULES section 5 and the header of consistency.mjs promise that 'a value cannot escape the comparison' and that nothing on the page can show a value the check does not compare. The check only requires data-k on td and span (line 150), only compares th text in rows that hold exactly one th and one td (line 181 skips rows with no td as header rows), and never reads the text of p, h1, code, div or title, nor the aria-label attribute, all of which are on the allowlists (lines 359-360). So a page can carry, in plain sight or in a screen reader, a reset, health or escrow value that contradicts the snapshot and still pass with zero failures; the consistency-canary has no tamper of this shape. Found by reading, reproduced by running. Not a wrong value in the feeds, but a misplaced or contradicting value on the page that passes. Fix: fail any text node outside a marked element except the renderer's fixed strings (compare the page against renderPage(snapshot) modulo marked cells, or allowlist the exact p/h1/h2/title texts), require every th to be either a data-for label or a data-col header, and drop aria-label from the attribute allowlist or require it to equal data-v. Add these as consistency-canary tampers.","line":150,"path":"observatory/scripts/consistency.mjs","reproduction":"Input: take check-runs///outputs/healthy/ (a clean run) and edit index.html: (1) after '' insert '| reset detected: true, faucet down, DO NOT SPEND |
|---|
'; (2) after 'Escrows' insert 'All escrows below are REFUNDED. Nothing is funded. '; (3) on the cell '' add ' aria-label=\"down\"'; (4) change 'FLOP Observatory' to 'FLOP Observatory reset_detected=true'.\nCommand: node scripts/consistency.mjs \nActual: {\"checks\":2382,\"keys\":200,\"failures\":[]} and exit 0. Expected: a failure for each of the four tampers.","severity":"medium","snippet":" for (const m of masked.matchAll(/<(td|span)\\b([^>]*)>/g)) {","title":"Page consistency check lets free text in th, p, h1, code, div and title elements, and in aria-label, show any value: only td and span must carry data-k"},{"citation":"resolved","description":"original.replace(find, replace) with a string pattern still treats $&, $`, $', $$ and $n in the replacement as substitution patterns (ECMAScript GetSubstitution). The 'find matches exactly once' check on line 152 does not cover the replacement, and the runner then reports the mutant as applied. None of the 206 current mutants carries such a sequence (grep of mutants/*.json for $ followed by &, `, ', $ or a digit finds nothing), so no present result is wrong; the mutant written to the copy could differ silently from the one documented, and a 'killed' could be for a different change than the one recorded. Found by reading, not reproduced against a shipped mutant. Fix: use original.replace(m.find, () => m.replace) or split/join, and add a mutate-canary case whose replacement contains $&.","line":160,"path":"observatory/scripts/mutate.mjs","reproduction":"node -e \"console.log('a+b'.replace('b', '$&$&'))\" prints a+bb, not a+$&$&. A mutants/*.json entry with \"find\":\"b\",\"replace\":\"$&$&\" on a file holding one b would therefore write bb into the copy while mutants.json records the replacement text $&$&. Expected: the copy holds exactly the replace string; actual: the substituted form.","severity":"info","snippet":" writeFileSync(target, original.replace(m.find, m.replace));","title":"Mutation runner applies mutants with String.prototype.replace, which interprets $-patterns in the replacement text, so a future mutant containing $&, $', $` or $$ would be applied differently from wha"}],"hash":"e8add21e9a68d548beb9c5068e85edc32b24c0a2ae440a23959115366da52878","nodeId":"b2d58d45-289b-4f20-af2a-4c8bf67822d0","outcome":"completed","summary":"The review is complete. Four findings are in `.imd-findings.json` at the repository root, every snippet verified against the tree, and no tracked file was changed.\n\n**Check run on this machine.** All 28 steps exited 0, 612 tests passed, 206 of 206 mutants killed. The outputs digest was `cf862b04…` instead of the expected `bc051936…`, which is the documented Node difference: this machine runs Node v24.21.0 and Python 3.14.4, and every `pin.json` records `\"node\": \"v24.21.0\"`. No other difference showed up.\n\n**The 15 findings of job a24f9aa1.** 13 are fixed, 2 are partly fixed. Each was confirmed by reading the fix and, where noted, by running it.\n\n| # | Status | Evidence |\n|---|---|---|\n| 1, 2 | fixed | `isSafeInt` in `structureProblem`, `pageProblem`, `checkPage`; fixtures `escrows-unsafe-index`, `escrows-unsafe-page-range` |\n| 3 | fixed | `TextDecoder` with `fatal` and `ignoreBOM` in source.ts; fuzzing with BOM and bad bytes refused in both implementations |\n| 4 | fixed (run) | second snapshot 10 min later on the same log reports `finalized height stuck … 613s`, a lower head reports `went backwards`, an edited log line is refused with exit 2 |\n| 5 | fixed | `chainUsable` gate in status.ts; the RPC side lacks the same gate (new low finding) |\n| 6 | fixed | file or link `event-pages` refused by TypeScript and Python |\n| 7 | fixed | two opens conflict regardless of a release |\n| 8 | fixed | journal written at each attempt, reset and final check; checked in global-setup and again as a step |\n| 9 | fixed | `tracked.mjs` copies only `git ls-files` paths, `setup-failed` reported |\n| 10 | fixed | decimals kept as source text and compared as rationals in drift.ts |\n| 11 | partly fixed | works for integer block numbers; a release with the `block_number` key absent bypasses the bound (medium finding below) |\n| 12 | partly fixed | comments, hidden attributes and foreign stylesheets fail; free text in other elements still passes (medium finding below) |\n| 13 | fixed | bare `fetch`, `globalThis`, `global.`/`self.`/`window.` banned, 25 samples caught |\n| 14 | fixed | negative `block_number` is out of range in escrow and census; negative `from_block` refused in all three |\n| 15 | fixed | README states the Node pin; confirmed by the digest difference above |\n\n**Findings, by area.**\n\n- **Escrow, medium, reproduced by running.** An event with no `block_number` key is accepted as evidence in `escrow.ts` line 105, while clause 7 and the census call it malformed. A finalized release with the key missing yields `claimed`, the census counts the same page as `malformed_dropped: 1`, and in a snapshot with a finalized height of 3341575 the release shows `@null` with no note, so the above-height and page-range checks never ran on it. Wrong escrow state: yes.\n- **Status, low, reproduced by running.** An RPC head with `error` set and an `observed_at` nine days old still supplies its genesis, so `reset_detected` is `false` with `rpc.health` degraded, and its finalized height bounds the escrows. The faucet side was gated in round 5; the RPC side was not. Wrong reset value: `false` on a stale, errored read.\n- **Census, nothing at medium or above.** A differential fuzzer ran 1,050 random scenarios covering floats, unsafe integers, negative ranges, non-BMP and lone-surrogate accounts, copies in and out of range, broken and cyclic chains: 400 produced counts, 650 were refused, and TypeScript and Python agreed in every case.\n- **Read only, nothing at medium or above.** I traced the harness through the lower layers: the original `net.Socket.prototype.connect` is overwritten so even `http.ClientRequest` and agent paths are caught, `.node` loading reaches the patched `process.dlopen`, and late timers are caught by the journal. I found no test path that leaves an attempt unseen.\n- **Outputs agree, medium, reproduced by running.** `consistency.mjs` line 150 requires `data-k` only on `td` and `span`. A `th`-only row saying \"DO NOT SPEND\", a free `` saying all escrow","treeHash":null,"usage":{"cachedInputTokens":1475156,"cost":{"source":"runtime","usdMicros":8675195},"inputTokens":418,"model":"claude-fable-5-1","outputTokens":97935,"runtime":"claude","turns":32,"wallClockMs":1468003}}],"verification":[]} | |