CI: remove suite asserts codes, not sentences (#1089) (#1535)

* Start #1089 child 1: remove suite asserts codes

Assisted-by: Claude Code:claude-opus-5-5

* Remove suite asserts codes, not sentences

The remove failure-path tests pinned whole English sentences in
--json mode and kept private copies of the envelope readers, so a
copy edit to a remove message broke them even when the exit code,
error code, events and bytes on disk were unchanged.

The --json tests now read the envelope through common::envelope and
check error codes, events, summary counts and on-disk state. Where a
message must name something, they check that token (a purl, a flag, a
path). Human-mode tests stay as the render checks, minus lines whose
disk state is asserted already. common::envelope gains event_purls,
and the file moves into the remove suite as remove_failure_paths.rs.

Refs #1089.

Assisted-by: Claude Code:claude-opus-5-5

* Share has_event; keep remedy and promise checks

Review follow-ups on the remove suite rewrite:
- has_event moves into common::envelope next to event_purls, with
  self-tests (including a non-string purl) and a ratchet entry.
- The hosted refusal again checks the `git checkout --` remedy, and
  the vendor flavor refusal the "manifest was not modified" promise.
- The mixed drift-keep human test checks the manifest on disk, since
  it no longer reads the "Removed 1 patch" line.
- The --json preserve-state leg checks for no `Note:` line on stderr
  instead of the note's wording.
- The module doc says which message parts the --json tests still read.

Assisted-by: Claude Code:claude-opus-5-5

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: mikolalysenko

crates/socket-patch-cli/tests/cli/envelope_helper_copies.rs

@@ -10,7 +10,8 @@ use std::path::Path;
 use serde_json::{json, Value};
 
 use crate::common::envelope::{
-    all_codes, codes_in, event_codes, event_triples, events, find_event, parse_json_envelope,
+    all_codes, codes_in, event_codes, event_purls, event_triples, events, find_event, has_event,
+    parse_json_envelope,
 };
 
 /// Files that still define a private envelope reader. Each is changed by an
@@ -40,7 +41,6 @@ const PENDING_PRIVATE_READERS: &[&str] = &[
     "vendor_jvm_cli.rs",
     "e2e_vex_lockfile/cargo.rs",
     "in_process_vendor_bun_takeover/vlt.rs",
-    "remove/covgap_commands_remove.rs",
     "scan/scan_paths_e2e.rs",
     "vlt_hosted_common/mod.rs",
     "vlt_vendor_common/mod.rs",
@@ -54,6 +54,8 @@ const READER_NAMES: &[&str] = &[
     "parse_json_envelope",
     "event_codes",
     "event_triples",
+    "event_purls",
+    "has_event",
     "warning_codes",
     "codes",
     "all_codes",
@@ -138,6 +140,7 @@ fn the_detector_sees_every_former_copy_shape() {
         "pub fn codes(env: &Value) -> Vec<String> {",
         "fn warning_codes(doc: &Value) -> Vec<&str> {",
         "fn event_codes(v: &Value) -> Vec<String> {",
+        "fn event_purls(v: &serde_json::Value, action: &str) -> Vec<String> {",
     ] {
         assert!(defines_private_reader(copy), "missed: {copy}");
     }
@@ -234,6 +237,46 @@ fn event_triples_fill_absent_fields_with_empty_strings() {
     );
 }
 
+#[test]
+fn event_purls_lists_the_string_purls_of_one_action() {
+    let env = sample();
+    assert_eq!(event_purls(&env, "vendored"), ["pkg:npm/a@1.0.0"]);
+    // The `skipped` event has no purl, so it lists nothing.
+    assert!(event_purls(&env, "skipped").is_empty());
+    assert!(event_purls(&env, "removed").is_empty());
+    // A null or numeric purl is not listed as text.
+    let odd = json!({"events": [
+        {"action": "removed", "purl": null},
+        {"action": "removed", "purl": 7},
+        {"action": "removed", "purl": "pkg:npm/c@1.0.0"},
+    ]});
+    assert_eq!(event_purls(&odd, "removed"), ["pkg:npm/c@1.0.0"]);
+}
+
+#[test]
+fn has_event_needs_action_code_and_purl_to_match() {
+    let env = sample();
+    assert!(has_event(
+        &env,
+        "failed",
+        "vendor_lock_drift",
+        "pkg:npm/b@1.0.0"
+    ));
+    assert!(!has_event(
+        &env,
+        "failed",
+        "vendor_lock_drift",
+        "pkg:npm/a@1.0.0"
+    ));
+    assert!(!has_event(
+        &env,
+        "skipped",
+        "vendor_lock_drift",
+        "pkg:npm/b@1.0.0"
+    ));
+    assert!(!has_event(&env, "vendored", "", "pkg:npm/a@1.0.0"));
+}
+
 #[test]
 fn codes_in_reads_any_warnings_array_and_skips_non_strings() {
     let env = sample();

crates/socket-patch-cli/tests/common/envelope.rs

@@ -64,6 +64,22 @@ pub fn event_triples(envelope: &Value) -> Vec<(String, String, String)> {
         .collect()
 }
 
+/// Whether some `action` event for `purl` has `errorCode == code`.
+pub fn has_event(envelope: &Value, action: &str, code: &str, purl: &str) -> bool {
+    events(envelope)
+        .iter()
+        .any(|e| e["action"] == action && e["errorCode"] == code && e["purl"] == purl)
+}
+
+/// The string `purl` of every `action` event, in order.
+pub fn event_purls(envelope: &Value, action: &str) -> Vec<String> {
+    events(envelope)
+        .iter()
+        .filter(|e| e["action"] == action)
+        .filter_map(|e| e["purl"].as_str().map(str::to_string))
+        .collect()
+}
+
 /// The `errorCode` of every event that has one; empty when `events` is
 /// missing.
 pub fn event_codes(envelope: &Value) -> Vec<String> {

crates/socket-patch-cli/tests/remove/main.rs

@@ -13,8 +13,8 @@ mod vlt_hosted_common;
 #[path = "../vlt_hosted_common/vendored.rs"]
 mod vlt_vendored;
 
-mod covgap_commands_remove;
 mod pypi_name_spellings;
 mod remove_duality_invariants;
+mod remove_failure_paths;
 mod remove_invariants;
 mod remove_network;