The MORPH_CLIENT_ONLY binary-skew test is still unwritten, and now has to assert two different mechanisms

[Yaraslaut]

What is true

examples/lims/README.md asks for a binary-skew test as the executable form of
the journal's data-at-rest contract, and #174 restates it as "the other half":

build an old client with MORPH_CLIENT_ONLY and run it against a new server —
an additive field must work, a renamed field must fail loudly, not decode
a lab result to a default.

It is still unwritten. Searching tests/ for any skew/version-mismatch
harness finds none. The three MORPH_CLIENT_ONLY gates that do exist
(tests/CMakeLists.txt:283-425, over compile_checks/client_only_no_model_link.cpp,
client_only_runtime_throw.cpp, client_only_facade_no_model_header.cpp)
prove unrelated things — that the macro suppresses model-owning link
dependencies, and that Bridge::executeVia's localOp throws when misused
against LocalBackend. None builds a client against a differently-shaped
server.

Scope: journal-path skew test (buildable now)

The journal-path mechanism is real and shipped:
morph::model::payloadFingerprint<A>() (include/morph/core/payload_schema.hpp)
is wired into ActionDispatcher's runner and Bridge::executeVia's localOp,
and journal::replay()'s mismatch gate throws SchemaMismatchError on a
fingerprint mismatch, with a migration seam (PayloadMigrationRegistry) and an
UnstampedPayloadPolicy. tests/test_journal_payload_evolution.cpp already
documents simulating an older build inside one process, via a PESetStateV1
struct that is never registered — that proves the gate fires, but it is not a
two-binary skew test.

This issue's scope is a genuine two-binary journal-path skew test: compile
"old" and "new" binaries from two struct-renamed versions of the same action,
following the try_compile/try_run pattern already used for the other
MORPH_CLIENT_ONLY gates in tests/CMakeLists.txt:283-425. Have the old
binary journal an entry, replay it under the new binary's registry, and
assert, as separate cases:

• an additive-only field round-trips;
• a renamed field throws SchemaMismatchError rather than silently
  reconstructing a default.

Invariant-7 guidance for the implementer: the renamed-field case must
actually verify SchemaMismatchError is thrown, not just that the test
compiles/runs alongside the additive-field case — a harness that only
exercises the additive path would pass identically whether or not the
fingerprint gate exists at all. Confirm both that the additive case does
not throw and that the renamed case does, in the same harness.

Out of scope: wire-path mechanism — tracked by #207

The wire path (deployment scope) is still lenient by design, defended by the
published "Action-evolution policy" in docs/spec/core/wire.md and the
kProtocolVersion handshake. That leniency (error_on_unknown_keys = false
in both BRIDGE_REGISTER_ACTION-generated codecs and wire::decode) is a
deliberate, published contract, not an oversight — additive fields must keep
working, and a rename is defined as "a break, not a rename," requiring a
kProtocolVersion bump. But nothing mechanically enforces that policy today:
searching for SignatureMismatch / actionFingerprint / any per-action
hello check across include/ and docs/spec/ finds nothing. #207 proposes
the fix — a per-action fingerprint exchanged at hello — and remains open
and unimplemented.

A wire-path skew test (a MORPH_CLIENT_ONLY client hitting a
differently-shaped server over the loopback backend) cannot be written until
#207's mechanism exists to assert against. That half tracks #207, not this
issue.

Close condition

Close once a CI job builds and runs the two-binary journal-path skew test
described above, asserting both the additive-round-trips case and the
renamed-field-throws-SchemaMismatchError case. The wire-path half is
tracked separately by #207.

[Yaraslaut]

Re-triage: re-verified against current HEAD — graduates to triage: valid

This is the second triage cycle on this issue. The first cycle rescoped the
body from an ambiguous "binary-skew test" that conflated two mechanisms into
the current framing: a concrete, buildable journal-path test (case 1) with the
wire-path half cleanly deferred to #207 (case 2). This cycle re-verifies that
framing against current HEAD rather than re-deriving it.

What was re-checked

The journal-path mechanism, exactly as described:

• morph::model::payloadFingerprint<A>() in include/morph/core/payload_schema.hpp
  renders a compiler-independent structural shape string ((key:shape,…),
  sorted by key) and hashes it with FNV-1a. Confirmed present, unchanged in
  substance from the prior cycle's description.
• It is wired into BRIDGE_REGISTER_ACTION's generated payloadSchema()
  (registry.hpp:747-748 and :823-824), which stamps LogEntry::schema at
  record time.
• journal::replay() (include/morph/journal/journal.hpp:257-303) compares
  the entry's stamped schema against dispatcher.schemaFor(...) — the current
  build's fingerprint for that action — and throws SchemaMismatchError
  (defined at journal.hpp:41-51) when they differ and no
  PayloadMigrationRegistry migration covers the pair. Confirmed: this is a
  real, shipped gate, not aspirational.
• tests/test_journal_payload_evolution.cpp still only simulates an older
  build within one process via an unregistered PESetStateV1 struct
  (confirmed at lines 44-111, 241, 311-347) — it proves the gate fires on a
  fingerprint mismatch, but it is not, and does not claim to be, a two-binary
  test. No two-binary skew harness exists anywhere in tests/ or
  compile_checks/ today.
• tests/CMakeLists.txt:283-425 still holds the three unrelated
  MORPH_CLIENT_ONLY gates (client_only_no_model_link.cpp,
  client_only_runtime_throw.cpp, client_only_facade_no_model_header.cpp),
  confirmed at that exact line range, giving a directly reusable
  try_compile/try_run + CMAKE_FLAGS "-DINCLUDE_DIRECTORIES=..." pattern
  for compiling two differently-shaped standalone probes against the shared
  morph/glaze headers.

#207's status: still OPEN, labeled triage: valid + area: core, one
comment (its own triage correction), and the fingerprint-at-hello mechanism
it proposes is still unimplemented — greping include/ and docs/spec/ for
SignatureMismatch/actionFingerprint finds nothing. The wire-path half of
the original ask genuinely has no mechanism to test against yet, confirming
the "out of scope, tracked by #207" framing is still correct today rather than
a stale cross-reference.

Valid-vs-rescope test, applied to the current body

• Commits to one buildable test design? Yes — a two-binary journal-path
  skew test via try_compile/try_run, explicitly anchored to the existing
  pattern at tests/CMakeLists.txt:283-425 rather than inventing a new
  mechanism.
• Specific assertions? Yes, and stated as separate cases: an additive-only
  field round-trips; a renamed field throws SchemaMismatchError. The body's
  own "Invariant-7 guidance" section pre-empts the control-that-measures-nothing
  failure mode (invariant 7) by requiring both the non-throwing and the
  throwing case be asserted in the same harness — a harness exercising only
  the additive path would pass identically whether or not the fingerprint gate
  existed at all, and the body says so explicitly.
• Wire-path half cleanly deferred, not left ambiguous? Yes — an explicit
  "Out of scope" section names Lenient wire decode means a client/server field-name skew is accepted silently, and nothing enforces the published evolution policy #207 by number, explains why case 2 can't be
  written yet (no mechanism to assert against), and doesn't attempt to
  half-specify it inside this issue.
• Close condition? Concrete: a CI job builds and runs the two-binary test
  asserting both cases, wire-path explicitly excluded.

All four hold under re-verification. Nothing about this cycle's re-check
overturned the prior cycle's rescoped framing — the code it describes matches
current HEAD line-for-line, and #207 remains exactly the open, unimplemented
prerequisite the body says it is.

Verdict

triage: valid — implement as written: a two-binary try_compile/try_run
journal-path skew test asserting additive-round-trips and
renamed-throws-SchemaMismatchError in one harness, reusing the established
MORPH_CLIENT_ONLY guard-check pattern. Wire-path half stays out of scope,
tracked by #207.