fix(reconstruction): qualify claims against retained source coverage

src/captures/TsharkCaptureProvider.ts

@@ -369,10 +369,7 @@ export class TsharkCaptureProvider implements PacketCapturePort {
         resourcePath = "path" in input ? input.path : command;
         // TShark resolves `-e` aliases before emitting canonical field names;
         // the command arguments, not output names, own field selection.
-        const matchingPackets = parsePacketOutput(
-          output.stdout.text,
-          input.packet_limit,
-        );
+        const matchingPackets = parsePacketOutput(output.stdout.text);
         const start = Math.min(input.match_offset, matchingPackets.length);
         const end =
           input.match_limit === null

src/captures/parsePacketOutput.ts

@@ -6,7 +6,7 @@ import { packetFieldsSchema } from "../domain/captures/packetCapture.js";
 const producerSchema = z.array(
   z.object({ _source: z.object({ layers: packetFieldsSchema }) }),
 );
-export const parsePacketOutput = (text: string, packetLimit: number | null) => {
+export const parsePacketOutput = (text: string) => {
   const decoded: unknown = JSON.parse(text);
   const packets = producerSchema
     .parse(decoded)
@@ -19,11 +19,6 @@ export const parsePacketOutput = (text: string, packetLimit: number | null) => {
         "inspect_packet_capture",
         "TShark returned unordered frames.",
       );
-    if (packetLimit !== null && frame > BigInt(packetLimit))
-      throw new AnalysisOutputError(
-        "inspect_packet_capture",
-        "TShark returned a frame beyond the selected input packet limit.",
-      );
     previous = frame;
   }
   return packets;

src/domain/reconstructionVerification.test.ts

@@ -615,3 +615,108 @@ it("keeps a valid comparison selected for the wrong claim kind as caller input",
     });
   }
 });
+
+describe("retained reconstruction source coverage", () => {
+  const omittedTerminalCapture = {
+    ...EMPTY_PROCESS_CAPTURE_EXAMPLE,
+    truncated: true,
+    truncation_details: {
+      ...EMPTY_PROCESS_CAPTURE_EXAMPLE.truncation_details,
+      raw_terminal: {
+        ...EMPTY_PROCESS_CAPTURE_EXAMPLE.truncation_details.raw_terminal,
+        observed_frames: 1,
+        observed_bytes: 1,
+      },
+    },
+  };
+
+  it("keeps old unchanged terminal and overall claims unknown while retaining unrelated claims", () => {
+    const left = source("1", "controlled-replay");
+    const right = source("2", "controlled-replay", "observed", {
+      captureResult: omittedTerminalCapture,
+    });
+    const comparison = processComparison(left, right, processResult());
+    const bundle = createEvidenceBundle([left, right, comparison]);
+    const before = JSON.stringify(bundle);
+    const result = verifyReconstruction(
+      {
+        name: "Retained capture coverage",
+        claims: ["terminal", "overall", "exit", "interaction"].map(
+          (dimension) => ({
+            kind: "behavioral",
+            claim_id: dimension,
+            title: dimension,
+            dimension,
+            comparison_evidence_id: comparison.evidence_id,
+          }),
+        ),
+      },
+      bundle,
+    );
+    expect(
+      result.claims.items.map(({ claim_id, status }) => [claim_id, status]),
+    ).toEqual([
+      ["exit", "pass"],
+      ["interaction", "pass"],
+      ["overall", "unknown"],
+      ["terminal", "unknown"],
+    ]);
+    expect(
+      result.claims.items.find(({ claim_id }) => claim_id === "terminal")
+        ?.limitations,
+    ).toContain(
+      `Source ${right.evidence_id}: terminal observation coverage is incomplete.`,
+    );
+    expect(JSON.stringify(bundle)).toBe(before);
+  });
+
+  it("retains a decisive changed claim despite omitted terminal observations", () => {
+    const left = source("1", "controlled-replay");
+    const right = source("2", "controlled-replay", "observed", {
+      captureResult: omittedTerminalCapture,
+    });
+    const comparison = processComparison(left, right, processResult("changed"));
+    const claims = ["terminal", "overall"].map((dimension) => ({
+      kind: "behavioral",
+      claim_id: dimension,
+      title: dimension,
+      dimension,
+      comparison_evidence_id: comparison.evidence_id,
+    }));
+    expect(
+      verifyReconstruction(
+        { name: "Observed disagreement", claims },
+        createEvidenceBundle([left, right, comparison]),
+      ),
+    ).toMatchObject({
+      status: "fail",
+      summary: { failed: 2, unknown: 0 },
+    });
+  });
+
+  it.each(["status", "kind"] as const)(
+    "rejects a summary inconsistent with actual claim %s",
+    (field) => {
+      const left = source("1", "controlled-replay");
+      const right = source("2", "controlled-replay");
+      const comparison = processComparison(left, right, processResult());
+      const result = verifyReconstruction(
+        behavioralSpec(comparison),
+        createEvidenceBundle([left, right, comparison]),
+      );
+      const inconsistent = {
+        ...result,
+        claims: {
+          items: result.claims.items.map((claim) =>
+            field === "status"
+              ? { ...claim, status: "fail", observed_status: "changed" }
+              : { ...claim, kind: "structural-function" },
+          ),
+        },
+      };
+      expect(
+        reconstructionVerificationResultSchema.safeParse(inconsistent).success,
+      ).toBe(false);
+    },
+  );
+});

src/domain/reconstructionVerification.ts

@@ -15,7 +15,16 @@ import { analysisInputErrorFromIssues } from "./inputIssueProjection.js";
 import { readEvidencePayload } from "./evidenceValidation.js";
 import { functionDossierSchema } from "./native/functionDossier.js";
 import { assessFunctionCallCoverage } from "./functionCallCoverage.js";
-import { processCaptureSchema } from "./process/processCapture.js";
+import {
+  processCaptureSchema,
+  type UnverifiedProcessCapture,
+} from "./process/processCapture.js";
+import { processSourceTruncated } from "./process/processCaptureCoverage.js";
+import {
+  PROCESS_COMPARISON_DIMENSIONS,
+  type ProcessComparisonDimension,
+} from "./process/processComparison.js";
+import type { ProcessObservationSource } from "./process/processObservation.js";
 import { digestCanonicalValue } from "./canonicalDigest.js";
 import {
   reconstructionClaimResultSchema,
@@ -45,6 +54,14 @@ interface FunctionSourceFacts {
   readonly callCoverageDiagnostics: readonly string[];
 }
 
+interface ValidatedSourceFacts {
+  readonly functions: readonly FunctionSourceFacts[];
+  readonly processes: readonly {
+    readonly evidence_id: string;
+    readonly capture: UnverifiedProcessCapture;
+  }[];
+}
+
 /** Verify only explicitly declared claims; no global equivalence is inferred. */
 export const verifyReconstruction = (
   specificationInput: unknown,
@@ -144,17 +161,18 @@ const evaluateClaim = (
       );
     return source;
   });
-  const functionSourceFacts = readValidatedSourceFacts(claim, sources);
+  const sourceFacts = readValidatedSourceFacts(claim, sources);
   const observation = comparisonObservation(claim, comparison);
   const observed = observation.status;
   const callCoverage = sourceCallCoverage(
     claim,
-    functionSourceFacts,
+    sourceFacts.functions,
     observation.hasIndependentFunctionChange === true,
   );
   const blockers = [
     ...authorityLimitations(claim, sources, sides),
     ...callCoverage.blockers,
+    ...sourceProcessCoverage(claim, sourceFacts.processes, observed),
   ];
   const relevantUnknowns = reconstructionClaimUnknowns(
     heads,
@@ -189,7 +207,7 @@ const evaluateClaim = (
 const readValidatedSourceFacts = (
   claim: Claim,
   sources: readonly Evidence[],
-): readonly FunctionSourceFacts[] => {
+): ValidatedSourceFacts => {
   const isExpectedType = (source: Evidence): boolean => {
     if (claim.kind === "behavioral")
       return (
@@ -216,6 +234,7 @@ const readValidatedSourceFacts = (
       },
     );
   const functionSources: FunctionSourceFacts[] = [];
+  const processSources: ValidatedSourceFacts["processes"][number][] = [];
   for (const source of sources) {
     if (claim.kind === "behavioral") {
       const capture = readEvidencePayload(
@@ -223,6 +242,10 @@ const readValidatedSourceFacts = (
         source.normalized_result,
       );
       if (!capture.ok) throw capture.error;
+      processSources.push({
+        evidence_id: source.evidence_id,
+        capture: capture.value,
+      });
     } else if (claim.kind === "structural-function") {
       const parsedDossier = readEvidencePayload(
         functionDossierSchema,
@@ -256,7 +279,7 @@ const readValidatedSourceFacts = (
       }
     }
   }
-  return functionSources;
+  return { functions: functionSources, processes: processSources };
 };
 
 const validateComparisonIdentity = (
@@ -404,6 +427,44 @@ const authorityLimitations = (
   return limitations;
 };
 
+const processObservationSourceByDimension: Readonly<
+  Record<ProcessComparisonDimension, ProcessObservationSource>
+> = {
+  terminal: "terminal_rendered",
+  interaction: "interaction",
+  exit: "lifecycle",
+  filesystem: "filesystem",
+  process: "process",
+};
+
+const sourceProcessCoverage = (
+  claim: Claim,
+  sources: ValidatedSourceFacts["processes"],
+  observed: ObservedStatus,
+): string[] => {
+  if (
+    claim.kind !== "behavioral" ||
+    ["changed", "added", "removed", "contradiction"].includes(observed)
+  )
+    return [];
+  const dimensions =
+    claim.dimension === "overall"
+      ? PROCESS_COMPARISON_DIMENSIONS
+      : [claim.dimension];
+  return sources.flatMap(({ evidence_id, capture }) =>
+    dimensions.flatMap((dimension) =>
+      processSourceTruncated(
+        capture,
+        processObservationSourceByDimension[dimension],
+      )
+        ? [
+            `Source ${evidence_id}: ${dimension} observation coverage is incomplete.`,
+          ]
+        : [],
+    ),
+  );
+};
+
 const sourceCallCoverage = (
   claim: Claim,
   functionSources: readonly FunctionSourceFacts[],

src/domain/reconstructionVerificationSchemas.ts

@@ -118,9 +118,28 @@ export const reconstructionVerificationResultSchema = z
   })
   .superRefine((result, context) => {
     const { summary } = result;
+    const claims = result.claims.items;
     const expectedStatus =
       summary.failed > 0 ? "fail" : summary.unknown > 0 ? "unknown" : "pass";
     const issues = [
+      [
+        summary.passed !==
+          claims.filter(({ status }) => status === "pass").length ||
+          summary.failed !==
+            claims.filter(({ status }) => status === "fail").length ||
+          summary.unknown !==
+            claims.filter(({ status }) => status === "unknown").length,
+        "Claim status counts must summarize retained claims",
+        ["summary"],
+      ],
+      [
+        summary.behavioral !==
+          claims.filter(({ kind }) => kind === "behavioral").length ||
+          summary.structural !==
+            claims.filter(({ kind }) => kind !== "behavioral").length,
+        "Claim kind counts must summarize retained claims",
+        ["summary"],
+      ],
       [
         summary.total !== summary.passed + summary.failed + summary.unknown,
         "Claim status counts must equal the summary total",

tests/boundary/captures/captureProvider.test.ts

@@ -247,26 +247,6 @@ it("preserves TShark canonical output for a caller-selected field alias", async
   expect(report.tool.arguments).toContain("bootp.type");
 });
 
-it("refuses producer frames outside the selected input read scope before paging", async () => {
-  const f = await fixture("many");
-  const request = { path: f.path, fields: ["ip.addr"], match_limit: 1 };
-  expect(
-    await f.service.inspect({ ...request, packet_limit: 10 }),
-  ).toMatchObject({
-    ok: false,
-    error: { _tag: "AnalysisOutputError", operation: "inspect_packet_capture" },
-  });
-  const admitted = await f.service.inspect({ ...request, packet_limit: 90 });
-  if (!admitted.ok) throw admitted.error;
-  const report = packetCaptureSchema.parse(admitted.value.normalized_result);
-  expect(report.output_window).toEqual({
-    matching_packets: 90,
-    returned_packets: 1,
-    has_more: true,
-  });
-  expect(report.packets[0]?.["frame.number"]).toEqual(["1"]);
-});
-
 it("returns canonical alias output through the public packet-capture CLI", async () => {
   const f = await fixture("alias-canonical");
   const cli = Cli.create("capture-alias-test", { sync: false });

tests/boundary/captures/packetOutput.test.ts

@@ -17,7 +17,7 @@ it("preserves repeated field values and missing fields while discarding export i
     },
     { _source: { layers: { "frame.number": ["7"] } } },
   ]);
-  expect(parsePacketOutput(output, 7)).toEqual([
+  expect(parsePacketOutput(output)).toEqual([
     { "frame.number": ["2"], "ip.addr": ["192.0.2.1", "192.0.2.2"] },
     { "frame.number": ["7"] },
   ]);
@@ -49,7 +49,7 @@ it.each([
 ])("rejects malformed producer fields: $layers", ({ layers, issue }) => {
   let failure: unknown;
   try {
-    parsePacketOutput(JSON.stringify([{ _source: { layers } }]), null);
+    parsePacketOutput(JSON.stringify([{ _source: { layers } }]));
   } catch (error) {
     failure = error;
   }
@@ -72,7 +72,6 @@ it.each([
           _source: { layers: { "frame.number": frame } },
         })),
       ),
-      null,
     );
   } catch (error) {
     failure = error;
@@ -89,18 +88,7 @@ it("preserves canonical field names emitted for a selected alias", () => {
       },
     },
   ]);
-  expect(parsePacketOutput(output, null)).toEqual([
+  expect(parsePacketOutput(output)).toEqual([
     { "frame.number": ["1"], "dhcp.type": ["1"] },
   ]);
 });
-
-it("validates every frame against the input read limit while allowing filtered gaps", () => {
-  const output = JSON.stringify(
-    [2, 7].map((frame) => ({
-      _source: { layers: { "frame.number": [String(frame)] } },
-    })),
-  );
-  expect(parsePacketOutput(output, 7)).toHaveLength(2);
-  expect(() => parsePacketOutput(output, 6)).toThrow(AnalysisOutputError);
-  expect(parsePacketOutput(output, null)).toHaveLength(2);
-});