fw: a regression test for the things that have broken

Every check is a bug that once shipped, which is the only reason to have
any of them.  Two would have caught real ones early: a rule set
containing ip= edited through ctl (the %M bug, where both paths were
tested but never together), and a rule set written in two writes (each
Twrite replaced the whole set).

Runs against two IP stacks it makes for itself, so it needs no network
and does not disturb the machine's.  Card mode is deliberately not
covered: it takes the card away, and a test that can leave you with no
network is a test nobody runs.

The harness had two bugs of its own worth recording.  Counters kept in
variables reported one pass out of seventeen, because every check runs
inside an @{} that needs its own namespace and an assignment there never
reaches the parent; results go to a file now.  And a failed redirect is
reported by the outer shell rather than the block, so the message cannot
be captured from inside - the checks test whether a write was refused,
not what it said.

One check is timing-sensitive and marked as such: it passes standalone
and fails here intermittently.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

0 files changed, 0 insertions, 0 deletions