From 1c9a7d343f4124d6b99e21703da141f64a41758e Mon Sep 17 00:00:00 2001
From: Michael Gilardi <11632652+mgilardi@users.noreply.github.com>
Date: Mon, 9 Nov 2026 22:15:26 -0700
Subject: [PATCH] Audit the tests again after 0.4.1, and check console commands
 stay console-only

The second test audit covers what 0.3.1 to 0.4.1 added: Latchkey invite
profiles, the Signalbox console and paged attempts. It found two gaps:
- An approver typing a console command in game had no test. The bot test
  now checks it's refused with the pointer to /approve, and nothing changes.
- A profile that turns unsafe between an invite and its use. That check
  lives in Latchkey's bot test, which runs with Usher.

Bot test: 123/123 on Paper 26.1.2. It wasn't rerun on 26.2 and 26.3,
since nothing here depends on the version.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/test-audit.md  | 20 ++++++++++++++++++++
 test/acceptance.mjs |  5 +++++
 2 files changed, 25 insertions(+)

diff --git a/docs/test-audit.md b/docs/test-audit.md
index 4421608..edbd26e 100644
--- a/docs/test-audit.md
+++ b/docs/test-audit.md
@@ -2,6 +2,26 @@
 
 Kept by this repo's owning session (Minecraft: Plugins Lead), per `~/Code/CLAUDE.md`, "Test self-audits". Newest first.
 
+## 2026-11-10: after 0.3.1, 0.4.0 and 0.4.1
+
+What changed since the first audit: profiles on Latchkey invites (0.3.1), the console on Signalbox format 1 with `describe` and the Stationmaster names removed (0.4.0), and attempts in pages (0.4.1). The first audit's table still holds, except its last row: the old names are gone, as 0.3.x said they would be.
+
+| Promise | Covered by |
+| --- | --- |
+| A Latchkey invite's profiles are checked when it's made: unknown and admin-granting profiles refused, a second circle asked as a question, only its own yes answers it | unit `LatchkeyHookTest` (8 tests); live in Latchkey's own bot test, which runs with Usher |
+| **A profile that turns unsafe between the invite and its use isn't applied, and the log says so** | **new**, live in Latchkey's bot test ("a profile made unsafe after the invite is not applied when it's used"). Usher re-checks through the same `ChangeService` as every other change |
+| Without LuckPerms, no invite profile is allowed | unit `withoutLuckPermsNothingIsAllowed` |
+| One answer line per console request, format 1, with stable codes (`unknown-command`, `bad-argument`, a bad id) | unit `ConsoleCommandsTest`; live "an unknown command still gets one answer", "bad arguments answer bad-argument", "a bad request id is answered in plain words" |
+| `describe` lists every command and marks only the optional arguments | unit `describeListsEveryCommand`, `describeMarksTheOptionalArgumentsAndOnlyThose`; live |
+| Attempts come in pages; a cursor Usher didn't hand out is refused | unit `cursorsAreOnlyOnesUsherHandedOut`; live "the list pages the spec's way" |
+| "none" can't be a profile name, since it means "no profiles" | unit `SettingsTest`, `ConsoleCommandsTest` |
+| **Console commands stay console-only, even for an approver** | **new** live "an approver typing a console command in game is refused, and told what to use", "and P_build is unchanged" |
+| The old `stationmaster.*` nodes no longer let anyone approve | live "the old node stationmaster.approve no longer lets anyone approve" |
+
+**Gaps added this audit:** the two in bold. The bot test passed 123/123 on Paper 26.1.2. The changes don't depend on the version, so it wasn't rerun on 26.2 and 26.3, where 0.4.1 passed 121/121.
+
+**Skipped, with reasons:** the same as the first audit.
+
 ## 2026-11-09: first full audit (at 0.3.0)
 
 Usher adds people to kids' groups, so the promises in `docs/kids-first.md` come first. "Live" is `test/acceptance.mjs` on throwaway Paper servers with bots and LuckPerms; "unit" is `src/test`.
diff --git a/test/acceptance.mjs b/test/acceptance.mjs
index 126bc4b..996fa3d 100644
--- a/test/acceptance.mjs
+++ b/test/acceptance.mjs
@@ -213,6 +213,11 @@ try {
   adminA.chat_log.length = 0
   adminA.chat('/profile AdminA'); await sleep(1500)
   check('viewing your own profiles is fine', adminA.chat_log.some(m => /AdminA is approved/.test(m)), adminA.chat_log.join(' | '))
+  // Console commands stay console-only, even for an approver: in game, changes go through the menu and its warnings.
+  adminA.chat_log.length = 0
+  adminA.chat('/usher apply ' + offlineUuid('P_build') + ' P_build builders,young'); await sleep(1500)
+  check('an approver typing a console command in game is refused, and told what to use', adminA.chat_log.some(m => /console commands/.test(m)), adminA.chat_log.join(' | '))
+  check('and P_build is unchanged', same(await profilesOf('P_build'), ['builders']))
 
   // ---------- The menu ----------
   console.log('\n# The menu')