Remove lossy default-action writes that can replace china-proxy
with gfwlist. Preserve legacy preference reads and derive the
default action from the selected preset.
Update tests to use explicit presets and verify identity,
legacy compatibility, and no-op reselection.
Replace the custom encrypted container with AgeSwift 0.1.0 so standard
age tools can inspect sensitive configuration independently of the app.
Use independent Keychain X25519 identities for catalog.age and
proxy-listening.age. Preserve atomic commits and confirmed recovery;
reject historical NG2 formats without migration or cleanup.
Six sites re-asserted the predicate waitUntilRuntimeSettles already checks,
with no suspension point in between, so they could never fail; their intent
messages are folded into comments where one was not already stated.
Two commit-failure cases asserted the fake's bookkeeping (updateCalls stays
empty) which the fake guarantees by throwing before recording; the outcome
and committed-snapshot assertions already prove the real behavior.
Also drop a no-op loop that mutated a discarded struct copy, a duplicated
isWellFormed line, two WorkspaceRoute cases subsumed by the constructor and
the publish-count case, a duplicated presentation-message assertion, and the
round-trip halves of two payload-shape cases already covered case-by-case.
Co-Authored-By: DeepSeek Harness <noreply@deepseek.com>
Each removed assertion holds by construction and can never fail:
- jsonData() compared with itself cannot detect cross-run byte stability;
bindAddress and mode are literal-returning computed properties
- RuleAction/RuleSourceKind allCases assertions pin synthesized enum order
(neither allCases list is used in production); the persisted action tokens
stay pinned by the kept rawValue assertions and source-kind tokens by
fixture decoding through RuleSnapshotStore
- memberwise-constructor echo in RuleSourceIdentity, fixture-guaranteed
name == id rows, a share draft field pair built from one string, and a
local struct compared to its own assignment
- the synthesized-Codable round trip through literal JSONEncoder/JSONDecoder
The duplicate-import assertion becomes a real check: Set of node ids instead
of a count that restated roots.count, which is what its comment claims.
Co-Authored-By: DeepSeek Harness <noreply@deepseek.com>
Four listening-file failure cases inject InMemoryProxyListeningStore.saveError
and assert saved == nil, which the fixture guarantees because save throws
before assigning; the only production save call is updateListening and none of
these paths reaches it. Their behavioral content is covered by sibling tests,
so keep only the three assertions that were unique there (agent intent
persistence, runtime stopped after the off cascade, no commit in flight) and
move them into those siblings.
Same pattern in testProxyExceptionsIgnoreListeningPersistenceFailure: the
path calls only the non-throwing updateProxyExceptions, so its updateError
injection is inert and the rest duplicates the sibling case. The plugin
diagnostic test fed an unproducible fixture (user-sourced facts never carry a
version, since managedInfo exists only for managed sources); assert the
reachable property, the source label in the report row. FakeSettingsSaveError
and the now-unused saveError seam go with them.
Co-Authored-By: DeepSeek Harness <noreply@deepseek.com>
Wait for settings publications instead of a wall-clock polling budget. Separate DoH result aggregation from the real deadline check, and release gated probes after pass-through is enabled.
Drop workflow port and credential prechecks that duplicated the store
gate. Credential shape is a save constraint only while LAN
authentication is enabled; terminal commands treat password() as a
usable secret without reshaping it.
Qiu Yuzhou
