test: real-pair checks fall back to pinned fixtures — rotation stops eating the evidence

Wires the fixture-fallback into both real-pair tests
(test/insertion-suppression.test.mjs, test/mitigation-output-form.test.mjs):
live capture present -> unchanged path (readCapture); capture absent ->
fall back to the pinned fixture via readPinnedFixture if one exists; both
absent -> skip with a stated reason, as before. Both readers yield the same
[n, line] tuple shape, so the replay loop in each test is unchanged either
way. Both the capture path and the fixture path are overridable via
CACHE_FIX_TEST_CAPTURE_OVERRIDE / CACHE_FIX_TEST_FIXTURE_OVERRIDE so the
fallback's own red-green test never has to touch the real capture file,
which is read-only evidence shared with other concurrent work.

Commits the first real pin: test/fixtures/harvested/pinned-s-633915a8-26-28
.json, the n=26->28 pair both real-pair tests already reference in their
comments, produced with `node tools/harvest.mjs --pin
s-633915a8 26..28` (holds the full prefix 0..28
per the previous commit's replay-from-start finding) and verified against
the fixed scrubber from the prior commit: replaying it through the actual
pipeline reproduces the live capture's exact values (mitigated=true,
outputForm="append", suppressed=1 at index 31, 0 safety violations).

test/harvest-pin.test.mjs gains the fallback's red-green proof: both
real-pair test files are run as actual subprocesses (not re-derived) with
env overrides -- capture+fixture both absent skips (never a false pass),
capture absent + the real committed fixture present runs and PASSES
(never a false fail). Both real-pair suites are green in both modes.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
(cherry picked from commit 2dfe0f0)

Author: Gunther-Schulz

test/fixtures/harvested/pinned-s-4b6a435234bf-26-28.json

@@ -6,9 +6,18 @@
 // (s-633915a8, pair n=26->28) and SKIP once that capture rotates out of the
 // per-machine retention window (~3 days, docs/dev-loop.md "Corpus
 // hygiene"). `harvest --pin <key> <n..m>` freezes the sanitized range as a
-// committed, rotation-immune fixture that both real-pair tests can fall
-// back to (fallback wiring lands in a follow-up commit; this one covers the
-// pin mechanism itself — unit-level, on a tiny synthetic capture).
+// committed, rotation-immune fixture; both real-pair tests fall back to it
+// when the live capture is gone.
+//
+// Two things have to hold or the mechanism is worse than useless:
+//   - the pin mechanism itself: it writes a sanitized, well-formed fixture
+//     (unit-level, tiny synthetic capture);
+//   - the FALLBACK actually works on the real files: capture-absent +
+//     fixture-absent skips (never a false pass), capture-absent +
+//     fixture-present runs and PASSES using the real committed fixture
+//     (never a false fail) — checked by literally invoking the two
+//     real-pair test files as subprocesses with env overrides, never by
+//     re-deriving their assertions here.
 
 import { test } from "node:test";
 import assert from "node:assert/strict";
@@ -189,3 +198,66 @@ test("readPinnedFixture: yields [n, line] tuples whose parsed records match what
     "indices are 0-based and contiguous, same shape readCapture's own [n, line] yields",
   );
 });
+
+// =====================================================================
+// Fallback red-green — the actual real-pair tests, run as subprocesses
+// =====================================================================
+//
+// Not a re-derivation of what insertion-suppression.test.mjs and
+// mitigation-output-form.test.mjs assert: this literally invokes them with
+// env overrides (CACHE_FIX_TEST_CAPTURE_OVERRIDE /
+// CACHE_FIX_TEST_FIXTURE_OVERRIDE, both files) pointed at nonexistent paths
+// or at the real committed fixture, and reads their own TAP output — the
+// only way to know the fallback genuinely works end to end rather than
+// merely compiling. Never touches the real capture file
+// (~/.claude/cache-fix-captures/s-633915a8-...), which is read-only
+// evidence.
+
+const REAL_PAIR_TESTS = [
+  { file: "mitigation-output-form.test.mjs", namePattern: "mitigation output-form: real capture n=26" },
+  { file: "insertion-suppression.test.mjs", namePattern: "real capture n=26->28: pin-and-suppress" },
+];
+const COMMITTED_FIXTURE = join(__dirname, "fixtures", "harvested", "pinned-s-4b6a435234bf-26-28.json");
+
+// --test-reporter=tap: a stable, greppable "# pass N" / "# skipped N" / "#
+// fail N" summary — the default reporter's exact wording ("ℹ pass N", no
+// leading "#") is not a documented contract to grep against.
+//
+// NODE_TEST_CONTEXT / NODE_TEST_WORKER_ID must NOT reach the child: this
+// file itself runs under `node --test`, which sets both; inherited by a
+// NESTED `node --test` invocation, the child silently emits nothing to
+// stdout (observed directly — reporter output present unset, empty string
+// captured when inherited) rather than erroring, which would have looked
+// like a false "fallback broken" red instead of a harness artifact.
+function runRealPairTest({ file, namePattern }, env) {
+  const childEnv = { ...process.env, ...env };
+  delete childEnv.NODE_TEST_CONTEXT;
+  delete childEnv.NODE_TEST_WORKER_ID;
+  const result = execFileSync(
+    process.execPath,
+    ["--test", "--test-reporter=tap", `--test-name-pattern=${namePattern}`, join(__dirname, file)],
+    { encoding: "utf-8", cwd: REPO, env: childEnv, stdio: ["ignore", "pipe", "pipe"] },
+  );
+  return result;
+}
+
+for (const spec of REAL_PAIR_TESTS) {
+  test(`fallback RED: ${spec.file} skips (not fails) when capture and fixture are both absent`, () => {
+    const out = runRealPairTest(spec, {
+      CACHE_FIX_TEST_CAPTURE_OVERRIDE: "/nonexistent/no-such-capture.jsonl",
+      CACHE_FIX_TEST_FIXTURE_OVERRIDE: "/nonexistent/no-such-fixture.json",
+    });
+    assert.match(out, /# pass 0/);
+    assert.match(out, /# skipped 1/);
+    assert.match(out, /COULD NOT VERIFY/);
+  });
+
+  test(`fallback GREEN: ${spec.file} runs and passes from the committed pinned fixture when the capture is absent`, () => {
+    assert.ok(existsSync(COMMITTED_FIXTURE), "the committed n=26->28 fixture must exist for this check to mean anything");
+    const out = runRealPairTest(spec, {
+      CACHE_FIX_TEST_CAPTURE_OVERRIDE: "/nonexistent/no-such-capture.jsonl",
+    });
+    assert.match(out, /# pass 1/);
+    assert.match(out, /# fail 0/);
+  });
+}

test/harvest-pin.test.mjs

@@ -35,6 +35,7 @@ import {
   pinnedBlockHashes,
   findSuppressibleDuplicate,
 } from "../proxy/extensions/insertion-normalization.mjs";
+import { readPinnedFixture } from "../tools/harvest.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const REPO = join(__dirname, "..");
@@ -228,8 +229,20 @@ test("classifyPinned: an assistant-role standalone entry is never suppressed, ev
 // asserts the PRE-fix values (outputForm==="edit@31") and is NOT in this
 // change's write boundary; running it after this fix is expected to fail,
 // and that is surfaced in the closing report rather than fixed here.
+//
+// Fixture-fallback (BACKLOG.md "READY — harvest --pin freezes evidence
+// ranges as fixtures"): capture rotated away -> fall back to the pinned
+// fixture at test/fixtures/harvested/pinned-s-4b6a435234bf-26-28.json (`node
+// tools/harvest.mjs --pin <key> n..m`); both absent -> skip. Both paths are
+// overridable via env for the fallback's own red-green test
+// (test/harvest-pin.test.mjs) — never by editing the real capture, which is
+// read-only evidence shared with other work.
 const REAL_CAPTURE =
+  process.env.CACHE_FIX_TEST_CAPTURE_OVERRIDE ??
   process.env.CACHE_FIX_TEST_CAPTURE_OVERRIDE ?? "";
+const PINNED_FIXTURE =
+  process.env.CACHE_FIX_TEST_FIXTURE_OVERRIDE ??
+  join(__dirname, "fixtures", "harvested", "pinned-s-4b6a435234bf-26-28.json");
 const GATES = {
   CACHE_FIX_FORWARD_PROXY: "on",
   CACHE_FIX_SESSION_MIRROR: "on",
@@ -258,8 +271,19 @@ const entry = (n, inMsgs, outMsgs, extra = {}) => ({
 test(
   "real capture n=26->28: pin-and-suppress turns the input-mitigated/output-spliced pair into a clean append, safety gate 0 violations",
   async (t) => {
-    if (!existsSync(REAL_CAPTURE)) {
-      t.skip(`capture rotated away (not found at ${REAL_CAPTURE}) — COULD NOT VERIFY`);
+    // Fixture-fallback: capture present -> unchanged live-capture path;
+    // capture absent -> pinned fixture if present; else skip. Both readers
+    // yield the same [n, line] tuple shape, so the replay loop below is
+    // identical either way.
+    let source;
+    if (existsSync(REAL_CAPTURE)) {
+      source = null; // resolved below, once readCapture is loaded from tools/replay.mjs
+    } else if (existsSync(PINNED_FIXTURE)) {
+      source = readPinnedFixture(PINNED_FIXTURE);
+    } else {
+      t.skip(
+        `capture rotated away (not found at ${REAL_CAPTURE}) and no pinned fixture at ${PINNED_FIXTURE} — COULD NOT VERIFY`,
+      );
       return;
     }
 
@@ -273,6 +297,7 @@ test(
       return;
     }
     const { findMitigationGaps, findSafetyViolations, safetyViolation, readCapture } = replayTools;
+    if (source === null) source = readCapture(REAL_CAPTURE);
 
     const scratch = await mkdtemp(join(tmpdir(), "insertion-suppression-"));
     const saved = {};
@@ -292,7 +317,7 @@ test(
 
       const entries = [];
       let reqN = -1;
-      for await (const [, line] of readCapture(REAL_CAPTURE)) {
+      for await (const [, line] of source) {
         let rec;
         try {
           rec = JSON.parse(line);

test/insertion-suppression.test.mjs

@@ -36,6 +36,7 @@ import { join, dirname } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 import { findMitigationGaps, readCapture } from "../tools/replay.mjs";
+import { readPinnedFixture } from "../tools/harvest.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const REPO = join(__dirname, "..");
@@ -102,12 +103,24 @@ test("mitigation output-form: a genuine tail-append reconstruction reports appen
 //
 // The capture lives outside the repo, in the per-machine capture directory
 // that rotates on a quadratic clock (docs/dev-loop.md, "Corpus hygiene") —
-// it is not a committed fixture. If it has rotated away since this test was
-// written, the test SKIPS with a stated reason rather than reporting a
-// false pass or a false fail (docs/dev-loop.md, "A checker has THREE
-// answers"); see the closing report for the harvesting gap this leaves.
+// it is not a committed fixture. If it has rotated away, this test falls
+// back to a PINNED fixture (BACKLOG.md "READY — harvest --pin freezes
+// evidence ranges as fixtures"): `node tools/harvest.mjs --pin <key> n..m`
+// freezes the sanitized range as test/fixtures/harvested/pinned-<key>-n-m
+// .json, committed and therefore immune to capture rotation. Only if BOTH
+// the live capture and the pinned fixture are unavailable does the test
+// SKIP with a stated reason, rather than reporting a false pass or a false
+// fail (docs/dev-loop.md, "A checker has THREE answers").
+//
+// Both paths are overridable via env for the fallback's own red-green test
+// (test/harvest-pin.test.mjs) — never by editing the real capture, which is
+// read-only evidence shared with other work.
 const REAL_CAPTURE =
+  process.env.CACHE_FIX_TEST_CAPTURE_OVERRIDE ??
   process.env.CACHE_FIX_TEST_CAPTURE_OVERRIDE ?? "";
+const PINNED_FIXTURE =
+  process.env.CACHE_FIX_TEST_FIXTURE_OVERRIDE ??
+  join(__dirname, "fixtures", "harvested", "pinned-s-4b6a435234bf-26-28.json");
 const GATES = {
   CACHE_FIX_FORWARD_PROXY: "on",
   CACHE_FIX_SESSION_MIRROR: "on",
@@ -125,8 +138,19 @@ const TARGET_N = 28;
 test(
   "mitigation output-form: real capture n=26->28 reports append/preserved once suppression and the cache_control strip both apply",
   async (t) => {
-    if (!existsSync(REAL_CAPTURE)) {
-      t.skip(`capture rotated away (not found at ${REAL_CAPTURE}) — COULD NOT VERIFY`);
+    // Fixture-fallback: capture present -> unchanged live-capture path;
+    // capture absent -> pinned fixture if present; else skip. Both readers
+    // yield the same [n, line] tuple shape, so the replay loop below is
+    // identical either way.
+    let source;
+    if (existsSync(REAL_CAPTURE)) {
+      source = readCapture(REAL_CAPTURE);
+    } else if (existsSync(PINNED_FIXTURE)) {
+      source = readPinnedFixture(PINNED_FIXTURE);
+    } else {
+      t.skip(
+        `capture rotated away (not found at ${REAL_CAPTURE}) and no pinned fixture at ${PINNED_FIXTURE} — COULD NOT VERIFY`,
+      );
       return;
     }
 
@@ -148,7 +172,7 @@ test(
 
       const entries = [];
       let reqN = -1;
-      for await (const [, line] of readCapture(REAL_CAPTURE)) {
+      for await (const [, line] of source) {
         let rec;
         try {
           rec = JSON.parse(line);