[zachyking]

Why

The nightly "formal: kit register, all mutants" run 40289921888 (2026-10-26) reported SURVIVED surface-segments-size-cap-not-enforced (claim month-segments-server). The mutant multiplies the records-only size check in buildBundleView by 1000.

Cause

After averin#47 an over-cap bundle is refused by two other checks: the whole-history BundleSizeParts pre-check (before load) and the serialized-size check at the end of buildBundleView. Both return the same errBundleTooBig / errMonthTooBig, so the records-only check became unobservable by outcome. The existing precedence test (TestOverTheCapIsRefusedBeforeTheBundleIsBuilt) covers only the whole-history path, which the new pre-check now answers before the mutated line is reached. The code is not dead: for a month it is the only check that refuses before the bundle is assembled and marshaled.

Fix (detector only)

New test TestOverTheCapMonthIsRefusedBeforeTheBundleIsMarshaled (selected by the existing TestOverTheCap detector pattern): with an invalid coverage manifest the bundle fails at marshal, so an over-cap month must surface errMonthTooBig first; with the cap lifted the same month does fail at marshal (premise). Claim and mutant are unchanged; no relock needed (no covered symbol changed).

Evidence

• check_mutants.py --only surface-segments-size-cap-not-enforced: 1 killed, 0 survived (baseline ok).
• check_claims.py --claims formal/kit-claims.json: 745 checks, 0 failures.
• go test ./internal/api -run 'TestMonth|TestOverTheCap' passes (Rust staticlib rebuilt first).
• First seen in nightly 39565807072 (2026-10-21, the first after averin#47 merged), and present in every nightly from 10-21 to 10-26 (39744009767, 39920962931, 40074705087, 40174142977, 40289921888). Run 40176686795 failed on supply chain only (its kit nightly job was skipped). (Corrected by the lead after review.)

🤖 Generated with Claude Code