emergent_testing: an unreadable returned tree fails its leaf, not the run - #1758

Implements the catch operation that todo/hostile-proof-values.md designed, and uses it where the shared traversal reads user values.

The defect

The walk enumerates whatever a proof returned, and enumerating runs user code — an enumerable getter or a proxy trap throws inside collectTests. Unguarded, that throw unwinds the entire traversal: one hostile value costs the results of every module that had already passed, including any failures worth seeing. returnedTreeThrows pins the fix — a leaf beside the hostile one still runs, is still reported, and the summary still counts both. returnedTreeIsStillWalked pins the other half: a readable returned tree is still recursed into, so the guard did not quietly replace recursion with a refusal to recurse.

Why not sandbox

The obvious guard is the operation that already exists, and it cannot hold this — for a reason that is not the obvious one either. Timing isn't the problem: the sub-tree read happens after the leaf has settled, over a value already in hand. The problem is the virtual runner: its sandbox is a deliberate pass-through, f => state => [state, ok(f())], with the fixture returning the SandboxResult it wants reported, because effects/node/virtual is .f.mjs and FunctionalScript has no try/catch to implement a real one with. Routing a tree walk through it would hand that handler a thunk answering _TestAndPath[], and every fixture in proof.f.mjs would break.

So catch is a second, honest operation beside it — "run this pure thunk; a throw is the error branch" — carrying no clock and no fixture convention, so each runner implements it truthfully:

• real Node runner: tryCatch(f).
• virtual runner: ok(ok(f())) — a pure runner still cannot catch, so a hostile fixture still panics there. That is the same bargain sandbox already makes, and virtual proofs use benign fixtures.
• a browser interpreter gets one when it exists, which is the next step.

Ordering, and what stayed asymmetric

The read happens before the leaf is reported, so its failure is part of what gets reported rather than a correction issued afterwards. The leaf keeps its own duration — that is what running it took — while the result handed to the reporter carries the reading failure, so a host that describes a thrown value describes this one.

The module's exported tree is still read unguarded, and that is deliberate: there is no leaf to attribute it to, so an unreadable proof export belongs to whatever loaded the module. fjs t still panics on one; the browser page still catches it and reports one failed module. Closing that is a report-shape question rather than a missing operation, and it is what remains open in hostile-proof-values.md.

The proof lives in a .mjs, and that is the point

catch.proof.mjs, not proof.f.mjs. A runner that reports a throw instead of propagating it needs try/catch to write, and FunctionalScript has neither — which is the same fact that makes the virtual runner unable to demonstrate this at all. Review caught the first draft writing that runner inside a .f.mjs, which was precisely the defect the operation exists to work around. Its mock accumulates written output in the runner's own state rather than a captured array, so nothing reaches outside the runner to collect its results.

Why this landed on its own

It is the prerequisite for step 7 of share-browser-console-runner.md. The browser catches this case today and the shared walk did not, so sharing the traversal without it would have lost a behaviour — and a regression isn't something to record and defer. Landing it separately also means fjs t gains the behaviour now, with its own proofs, rather than inside a port where the two arguments would be tangled.

Verification

npx tsc clean, fjs t 3523/3523 (two new proofs), npm run cov exit 0 (100% line/branch/function thresholds), plus the workflow's own lint steps — the file-scope @typedef grep and ci-update's no-diff check — which a CI failure on this branch taught me to run locally.

Changelog:

• BREAKING CHANGES: effects: the new catch operation joins NodeOp, so
  an exhaustive NodeOperationMap must supply a handler for it
• emergent_testing: a proof whose return value cannot be enumerated fails that
  proof instead of the whole run

🤖 Generated with Claude Code

https://claude.ai/code/session_016PyLwDNkPQM1uD1Tg5ApBg