test_a_prober_that_flags_everything_is_refused (__main__.TestCheckEntryPoint.test_a_prober_that_flags_everything_is_refused)
The other direction — a prober that cannot clear a correct template is equally useless. ... ERROR: the prober failed its own canary — canary-clean: expected CLEAN, got BROKEN (papra: mount /app/data is NOT writable by the app's own uid=999 gid=999; papra: DATA in the writable layer at /app/app-data/db (db_signature=True, e.g. ['db.sqlite']); papra: declared volume /app/data)
  refusing to report a verdict: a broken detector reporting CLEAN is worse than no detector at all
ok
test_a_prober_that_never_flags_is_refused (__main__.TestCheckEntryPoint.test_a_prober_that_never_flags_is_refused)
The self-test is the gate's own red-proof. A prober that calls the R-156 canary CLEAN ... ERROR: the prober failed its own canary — canary-broken: expected BROKEN, got CLEAN ()
  refusing to report a verdict: a broken detector reporting CLEAN is worse than no detector at all
ok
test_all_clean_passes_with_rc0 (__main__.TestCheckEntryPoint.test_all_clean_passes_with_rc0) ... ok
test_broken_wins_over_undetermined (__main__.TestCheckEntryPoint.test_broken_wins_over_undetermined) ... ok
test_one_broken_app_refuses_with_rc1 (__main__.TestCheckEntryPoint.test_one_broken_app_refuses_with_rc1) ... ok
test_out_of_circulation_apps_are_skipped_and_named (__main__.TestCheckEntryPoint.test_out_of_circulation_apps_are_skipped_and_named) ... ok
test_undetermined_is_rc2_not_rc0 (__main__.TestCheckEntryPoint.test_undetermined_is_rc2_not_rc0)
UNDETERMINED must never read as a clean bill of health. ... ok
test_a_SIBLING_container_holding_the_state_silences_it (__main__.TestClassify.test_a_SIBLING_container_holding_the_state_silences_it)
The measured docmost / immich / claper shape, and the reason the question is asked per ... ok
test_a_mount_that_received_data_silences_the_structural_check (__main__.TestClassify.test_a_mount_that_received_data_silences_the_structural_check)
It must not fire on every app with one empty volume — crafty-controller has three ... ok
test_an_anonymous_volume_at_a_RUNTIME_path_is_not_a_defect (__main__.TestClassify.test_an_anonymous_volume_at_a_RUNTIME_path_is_not_a_defect)
The measured privatebin shape: its image declares `VOLUME /run`, so docker created an ... ok
test_an_anonymous_volume_holding_REAL_data_still_convicts (__main__.TestClassify.test_an_anonymous_volume_holding_REAL_data_still_convicts)
…and the runtime exemption must not become a blanket one. ... ok
test_anonymous_volume_with_data_is_broken (__main__.TestClassify.test_anonymous_volume_with_data_is_broken)
An anonymous volume survives a restart, which is what makes it deceptive: it is absent ... ok
test_container_not_running_is_undetermined (__main__.TestClassify.test_container_not_running_is_undetermined) ... ok
test_empty_declared_volume_alone_is_a_note_not_a_verdict (__main__.TestClassify.test_empty_declared_volume_alone_is_a_note_not_a_verdict)
An empty volume on an app that also wrote nothing is UNDETERMINED, not BROKEN — the ... ok
test_is_noise_dir_covers_the_runtime_directories (__main__.TestClassify.test_is_noise_dir_covers_the_runtime_directories) ... ok
test_known_good_is_clean (__main__.TestClassify.test_known_good_is_clean)
A detector with no proven negative is a detector that flags everything. ... ok
test_no_containers_is_undetermined (__main__.TestClassify.test_no_containers_is_undetermined) ... ok
test_nothing_landed_in_any_mount_is_caught_without_any_path_vocabulary (__main__.TestClassify.test_nothing_landed_in_any_mount_is_caught_without_any_path_vocabulary)
The measured gramps-web miss. Its family tree goes to ... ok
test_papra_signature_is_broken (__main__.TestClassify.test_papra_signature_is_broken)
The whole reason this gate exists: it must reproduce the known instance. ... ok
test_structural_check_stays_silent_when_the_app_wrote_nothing_at_all (__main__.TestClassify.test_structural_check_stays_silent_when_the_app_wrote_nothing_at_all)
An idle app is UNDETERMINED for the existing reason, not accused by this one. ... ok
test_the_structural_finding_SURVIVES_a_broken_verdict (__main__.TestClassify.test_the_structural_finding_SURVIVES_a_broken_verdict)
The measured gramps-web reporting bug. Its accounts DB (rule 2) convicted, and the ... ok
test_wrote_nothing_is_undetermined_not_clean (__main__.TestClassify.test_wrote_nothing_is_undetermined_not_clean)
The load-bearing distinction. An app that wrote nothing has not been shown to be ... ok
test_a_bytecode_cache_DIRECTORY_is_noise (__main__.TestDiffRollup.test_a_bytecode_cache_DIRECTORY_is_noise)
The measured crafty-controller shape. `docker diff` lists directories too, so the ... ok
test_a_chown_sweep_over_image_files_is_not_data (__main__.TestDiffRollup.test_a_chown_sweep_over_image_files_is_not_data)
The measured calibre-web shape: 92 `C` entries under ... ok
test_a_database_signature_still_convicts_on_its_own (__main__.TestDiffRollup.test_a_database_signature_still_convicts_on_its_own)
The demotion must not weaken rule 2 — papra and gramps-web are both caught by it. ... ok
test_a_genuinely_misplaced_PGDATA_is_still_caught (__main__.TestDiffRollup.test_a_genuinely_misplaced_PGDATA_is_still_caught)
…and removing it must not open a blind spot: PG_VERSION and pg_control are the real ... ok
test_a_path_token_alone_does_NOT_convict (__main__.TestDiffRollup.test_a_path_token_alone_does_NOT_convict)
The measured onlyoffice shape: the document server unpacks its OWN static assets into ... ok
test_a_postgres_CONFIG_file_is_not_a_database_signature (__main__.TestDiffRollup.test_a_postgres_CONFIG_file_is_not_a_database_signature)
The measured immich shape: the postgres entrypoint writes /etc/postgresql/postgresql.conf ... ok
test_a_token_dir_is_reported_and_counts_as_the_app_having_written (__main__.TestDiffRollup.test_a_token_dir_is_reported_and_counts_as_the_app_having_written)
Demoted is not discarded. The note must reach the operator, and an app that wrote only ... ok
test_but_one_real_file_among_noise_still_convicts (__main__.TestDiffRollup.test_but_one_real_file_among_noise_still_convicts)
…and the rule must not become a blanket amnesty for any directory with a cache in it. ... ok
test_cache_directories_are_filtered_at_ENTRY_level (__main__.TestDiffRollup.test_cache_directories_are_filtered_at_ENTRY_level)
Where the filtering happens matters, because it is the reason a second ... ok
test_changed_db_file_is_SUSPECT_not_a_verdict (__main__.TestDiffRollup.test_changed_db_file_is_SUSPECT_not_a_verdict)
`C` on a database file is genuinely ambiguous: a chown produces it, and so does an app ... ok
test_created_file_in_a_data_path_IS_data (__main__.TestDiffRollup.test_created_file_in_a_data_path_IS_data)
The other direction — the rule must not become blind. papra's verb is `A`. ... ok
test_db_signature_beats_everything (__main__.TestDiffRollup.test_db_signature_beats_everything) ... ok
test_deleted_entries_are_not_writes (__main__.TestDiffRollup.test_deleted_entries_are_not_writes) ... ok
test_logs_caches_and_pids_are_noise (__main__.TestDiffRollup.test_logs_caches_and_pids_are_noise) ... ok
test_unclassified_writes_are_reported_never_dropped (__main__.TestDiffRollup.test_unclassified_writes_are_reported_never_dropped) ... ok
test_base64key_carries_the_controller_s_base64_prefix (__main__.TestEnvBuilding.test_base64key_carries_the_controller_s_base64_prefix)
felhom-controller `deploy.go:904` returns "base64:"+b64. Without the prefix Laravel ... ok
test_deploy_field_default_and_generate_are_honoured (__main__.TestEnvBuilding.test_deploy_field_default_and_generate_are_honoured) ... ok
test_deploy_fields_block_ends_at_the_next_top_level_key (__main__.TestEnvBuilding.test_deploy_fields_block_ends_at_the_next_top_level_key) ... ok
test_every_compose_var_resolves (__main__.TestEnvBuilding.test_every_compose_var_resolves)
A var resolving to "" binds a bogus root-owned dir at the container root ... ok
test_password_special_carries_the_controllers_shape (__main__.TestEnvBuilding.test_password_special_carries_the_controllers_shape)
R-735: `password:N:special` must be what the controller's randomWithSpecial mints (deploy.go L1335): ... ok
test_benign_touch_stays_clean_and_is_still_reported (__main__.TestSuspectAdjudication.test_benign_touch_stays_clean_and_is_still_reported) ... ok
test_confirmed_write_into_an_image_file_is_broken (__main__.TestSuspectAdjudication.test_confirmed_write_into_an_image_file_is_broken) ... ok
test_unresolved_suspect_is_undetermined_never_clean (__main__.TestSuspectAdjudication.test_unresolved_suspect_is_undetermined_never_clean) ... ok

----------------------------------------------------------------------
Ran 45 tests in 0.017s

OK
