spec(pagination): observe the eighth-probe stopping boundary

[dmitrii-f-t27]

Closes #5831. Supersedes PR #5838 after review of the actual source and pinned original script.

The Queen port's original nine tests all pass even after changing MAX_PROBES from8to9: the ninth fixture truncates too, so the cap test cannot observe whether it was consumed. The port now carries twelve executable tests that distinguish a ninth success/error, a success on exactly the eighth probe, the optional starting limit, and an empty owner.

All four original runtime bodies and signatures are unchanged; original bee/publisher commits and author metadata remain in the branch. One corrected NOW receipt records proof and limits. No original script, compiler, generated file, seal or failure ledger changed.

Verification:12Zig tests pass,4/4functions covered, no discarded tokens or type errors/warnings. Four source mutants are rejected (nine probes:2failures, seven:1, ignored start:1, ignored empty owner:1). Current generated Rust compiles and matches the original shell in30controlled scenarios using a fake gh, including exact-limit populations and query/auth/usage failures. No real GitHub request or credential change occurs. No new duplicate group.

This is the bounded decision port allowed by the issue; network/process execution and informational API/output formatting stay in the caller. Generated Rust does not lower the source tests, so its decision parity and Zig tests are reported separately. The --fast corpus run completed with96primary failures versus95ledger, only existing packets.parse unexpected; no new primary failure. Long phases were skipped. No full-repository all-green claim.

Generated C was also checked with default hosted C flags: original and repaired output both reject this model main signature, with existing namespace guard warnings. This PR claims Rust decision-library and Zig-test behavior; it does not claim a complete C CLI.

{
  "version": 1,
  "head_sha": "43630668ee75aef6051e9cac05a7b690e0af7c8c",
  "summary": "Complete the pagination decision port with tests that actually distinguish the eighth-query stopping boundary.",
  "changes": [
    "Keep all four original runtime bodies/signatures and preserve original bee/publisher commit metadata.",
    "Make the ninth successful reply observable if consumed; cover eighth success, ignored ninth error, custom start and empty owner.",
    "Correct one NOW receipt and document generated-Rust versus original-shell decision parity; no compiler, original script, generated file or ledger edits."
  ],
  "tests": [
    {
      "command": "t27c test-report / parse-complete / typecheck / coverage specs/port/scripts/check-pagination-truncation.t27",
      "status": "passed",
      "result": "12 tests pass, 4/4 functions covered, zero discard and type errors/warnings.",
      "evidence": "Source and NOW receipt."
    },
    {
      "command": "Change MAX_PROBES to9/7, ignore custom start, ignore empty owner; t27c test-report scratch copies",
      "status": "passed",
      "result": "Original9tests let ninth-probe mutant survive; strengthened tests reject all four with2/1/1/1 failures.",
      "evidence": "NOW receipt and local pagination-verification.json."
    },
    {
      "command": "rustc current generated code; run original shell with stubbed gh against generated-Rust decision driver",
      "status": "passed",
      "result": "30 matched decision scenarios; trace proves at most8queries. No live network/credential changes.",
      "evidence": "Local pagination-shell-crosscheck.py/json; pinned original SHA and scenario coverage in NOW receipt."
    },
    {
      "command": "python3 tools/dupe_scan.py; NOW shape; body/signature comparison; git diff --check",
      "status": "passed",
      "result": "No duplicate group grows; one valid NOW receipt; all four runtime bodies/signatures preserved, clean whitespace.",
      "evidence": "590of4751bodies169groups; source and PR diff."
    },
    {
      "command": "t27c suite --repo-root . --fast --ratchet --corpus-only",
      "status": "failed",
      "result": "Fast corpus run96primary failures vs95ledger; only packets.parse unexpected. No new discard/unexpectedpass/gatedrift orledgergrowth. Long phases explicitlyskipped.",
      "evidence": "Local pagination-suite-fast.json/log at this exactsourcehead."
    },
    {
      "command": "cc -std=c11 -fsyntax-only original and current t27c gen-c output",
      "status": "failed",
      "result": "Both reject the nonstandard main signature of this pure decision function; namespace include-guard warnings also pre-exist. No standalone C-program success claimed.",
      "evidence": "Local pagination-original/repaired-c-compile.log; runtime helper bodies unchanged."
    }
  ],
  "limitations": [
    "The scope is the bounded decision logic; network/process plumbing and informational GitHub output remain in the caller.",
    "Generated Rust does not lower .t27 tests; behavior is separately checked against original shell under a fakeCLI, and Zig tests execute.",
    "No all-green full repository claim; independent packets/type conflicts/ringdrift remain visible without ledger expansion.",
    "The generated C does not compile as a normal hosted C program: its decision main has a model signature rather than C argv ABI, reproduced before and after. Target Rust decision library and Zig tests were verified."
  ],
  "tags": [
    "Engineering",
    "Verification"
  ],
  "blog": {
    "title": "A test for eight requests must fail when a ninth is allowed",
    "summary": "Twelve meaningful tests and thirty original-versus-generated decision scenarios verify the pagination port boundary.",
    "outline": [
      "A ninth truncated count left the old cap test unchanged even with MAX_PROBES=9.",
      "Make the ninth reply succeed and check both neighboring stopping boundaries, optional start and empty owner.",
      "Compare actual generated Rust with the original shell under controlled gh replies; leave real network plumbing outside the port."
    ]
  }
}