W7 done done

site/tests/api_coverage.uce

@@ -0,0 +1,28 @@
+#include "testlib.h"
+
+RENDER(Request& context)
+{
+	if(!test_demo_request_allowed(context))
+	{
+		site_tests_restricted(context, "API Coverage Manifest", "scan repository headers, tests, and docs with the local manifest script");
+		return;
+	}
+
+	u64 passed = 0;
+	u64 failed = 0;
+	u64 skipped = 0;
+	auto check = [&](String name, bool ok, String detail)
+	{
+		site_tests_case(name, ok ? "pass" : "fail", detail);
+		if(ok)
+			passed++;
+		else
+			failed++;
+	};
+
+	site_tests_page_start("API Coverage Manifest", "Repository-level guard that public wasm-unit APIs have an explicit test/doc/internal decision.");
+	String out = shell_exec("cd /Code/uce.openfu.com/uce && python3 scripts/api_coverage_manifest.py");
+	check("api coverage manifest", contains(out, "API coverage manifest ok"), out);
+	site_tests_summary(passed, failed, skipped, "This page intentionally runs only on trusted/local test requests.");
+	site_tests_page_end();
+}

site/tests/cli.uce

@@ -14,6 +14,12 @@ CLI(Request& context)
 		print(input["message"].to_string(), "\n");
 		return;
 	}
+	if(action == "arg")
+	{
+		print(cli_arg(context, "message", "fallback"), "\n");
+		print(cli_arg(context, "missing", "fallback"), "\n");
+		return;
+	}
 	context.set_status(400, "CLI Error");
 	print("unknown cli action: ", action, "\n");
 }

site/tests/cli_runner.uce

@@ -325,6 +325,8 @@ CLI(Request& context)
 	print("[GROUP] starter ", std::to_string((u64)((time_precise() - group_start) * 1000)), " ms\n");
 	group_start = time_precise();
 	cli_run_tcp_smoke();
+	String cli_arg_out = shell_exec("cd /Code/uce.openfu.com/uce && bash scripts/uce-cli /tests/cli.uce action=arg message=hello-cli 2>&1");
+	cli_test_case("uce_cli_fixture:cli_arg", contains(cli_arg_out, "hello-cli") && contains(cli_arg_out, "fallback"), cli_truncate(cli_arg_out));
 	print("[GROUP] tcp ", std::to_string((u64)((time_precise() - group_start) * 1000)), " ms\n");
 	group_start = time_precise();
 	cli_run_wasm_kill(include_kill);

site/tests/core.uce

@@ -236,6 +236,30 @@ RENDER(Request& context)
 	tree["nested"]["ok"].set_bool(true);
 	check("DValue map access", tree["suite"].to_string() == "core" && tree["nested"]["api"].to_string() == "dvalue", json_encode(tree));
 
+	String nibble_source = "alpha/beta/gamma";
+	String nibble_first = nibble(nibble_source, "/");
+	StringMap merge_a; merge_a["a"] = "one"; merge_a["shared"] = "old";
+	StringMap merge_b; merge_b["b"] = "two"; merge_b["shared"] = "new";
+	StringMap merged_map = array_merge(merge_a, merge_b);
+	DValue merge_dv_a; merge_dv_a["a"] = "one"; merge_dv_a["shared"] = "old";
+	DValue merge_dv_b; merge_dv_b["b"] = "two"; merge_dv_b["shared"] = "new";
+	DValue merged_dv = array_merge(merge_dv_a, merge_dv_b);
+	u32 json_space_i = 0;
+	json_consume_space(" \n\tvalue", json_space_i);
+	check("float_val() / nibble() / array_merge() / json_consume_space()", float_val("12.5") > 12.49 && float_val("12.5") < 12.51 && nibble_first == "alpha" && nibble_source == "beta/gamma" && merged_map["shared"] == "new" && merged_map["a"] == "one" && merged_dv["b"].to_string() == "two" && json_space_i == 3, "nibble=" + nibble_first + " rest=" + nibble_source + " merged=" + var_dump(merged_map) + " json_space_i=" + std::to_string(json_space_i));
+
+	String unsafe = "Hello, 世界 / ../../ name!";
+	check("safe_name() / ascii_safe_name()", safe_name(unsafe) != "" && ascii_safe_name("Hello world! 42") == "Hello_world_42", safe_name(unsafe) + " / " + ascii_safe_name("Hello world! 42"));
+
+	DValue mutable_tree;
+	mutable_tree["keep"] = "yes";
+	mutable_tree["remove"] = "no";
+	String mutable_json = mutable_tree.to_json();
+	mutable_tree.remove("remove");
+	bool removed_ok = !mutable_tree.has("remove") && mutable_tree["keep"].to_string() == "yes";
+	mutable_tree.clear();
+	check("DValue to_json() / remove() / clear()", contains(mutable_json, "keep") && removed_ok && !mutable_tree.has("keep") && mutable_tree.get_type_name() == "empty", mutable_json);
+
 	// wasm_trace.h (WASM-PROPOSAL Phase 4): canned Wasmtime-format messages —
 	// the live trap path is gated by the phase-4 spike runner
 	String trace_msg = "error while executing at wasm backtrace:\n    0:     0x9f - units!_Z6renderR7Request\n";
@@ -255,6 +279,16 @@ RENDER(Request& context)
 
 	check("wasm_trace_collapse() raw passthrough", wasm_trace_collapse("plain host error") == "plain host error", wasm_trace_collapse("plain host error"));
 
+	u32 noise32_a = gen_noise32(7, 11);
+	u32 noise32_b = gen_noise32(7, 11);
+	u64 noise64 = gen_noise64(7, 11);
+	f64 noise01 = gen_noise01(7, 11);
+	u64 ranged_int = gen_int(10, 20, 3, 4);
+	f64 ranged_float = gen_float(1.0, 2.0, 3, 4);
+	u64 drawn_int = draw_int(1, 3);
+	f64 drawn_float = draw_float(1.0, 2.0);
+	check("gen_sha1() / gen_*() / draw_*()", gen_sha1("uce") == gen_sha1("uce") && gen_sha1("uce") != gen_sha1("UCE") && noise32_a == noise32_b && noise64 > 0 && noise01 >= 0.0 && noise01 <= 1.0 && ranged_int >= 10 && ranged_int <= 20 && ranged_float >= 1.0 && ranged_float <= 2.0 && drawn_int >= 1 && drawn_int <= 3 && drawn_float >= 1.0 && drawn_float <= 2.0, "noise32=" + std::to_string((u64)noise32_a) + " noise64=" + std::to_string(noise64) + " noise01=" + std::to_string(noise01) + " draw=" + std::to_string(drawn_int));
+
 	site_tests_summary(passed, failed, skipped, "These assertions intentionally stay pure and side-effect free so they remain safe on the public site.");
 	site_tests_page_end();
 }

site/tests/http.uce

@@ -44,6 +44,12 @@ RENDER(Request& context)
 	check("uri_decode() malformed percent literals", malformed_percent == "% %A %GG ok done", malformed_percent);
 	check("parse_uri() empty input", empty_uri.parts["raw"] == "", var_dump(empty_uri));
 	check("parse_query()", query["alpha"] == "1" && query["beta"] == "two words" && query["token"] == "a=b" && query["keyless"] == "" && query["empty"] == "" && query["trailing"] == "ok" && query.count("") == 0, query_dump);
+	StringMap encoded_query_map;
+	encoded_query_map["alpha"] = "one two";
+	encoded_query_map["token"] = "a=b";
+	String encoded_query = encode_query(encoded_query_map);
+	DValue raw_route = request_route_from_raw_path("/workspace/projects/", "index");
+	check("encode_query() / request route helpers", contains(encoded_query, "alpha=one%20two") && contains(encoded_query, "token=a%3Db") && request_script_url(context) != "" && request_base_url(context) != "" && raw_route["path"].to_string() == "workspace/projects" && raw_route["valid"].to_bool(), encoded_query + " script=" + request_script_url(context) + " base=" + request_base_url(context) + " route=" + json_encode(raw_route));
 	check("set_cookie()", set_cookie_dump.find("site-tests-cookie") != String::npos && set_cookie_dump.find("cookie-value") != String::npos && set_cookie_dump.find("HttpOnly") != String::npos && set_cookie_dump.find("SameSite=Lax") != String::npos, set_cookie_dump);
 	check("response header mutation", context.header["X-Site-Tests"] == "http-suite", header_dump);
 	check("session_start()", session_id != "", "session_id=" + session_id);

site/tests/io.uce

@@ -29,9 +29,57 @@ RENDER(Request& context)
 	site_tests_page_start("Filesystem", "Local-only file helper coverage using a temporary file under /tmp.");
 
 	check("path_join()", file_name == "/tmp/uce-site-tests-io.txt", file_name);
+	check("basename() / dirname() / expand_path()", basename(file_name) == "uce-site-tests-io.txt" && dirname(file_name) == "/tmp" && expand_path("child", "/tmp/base") == "/tmp/base/child" && expand_path("../sibling", "/tmp/base") == "/tmp/sibling", basename(file_name) + " / " + dirname(file_name) + " / " + expand_path("../sibling", "/tmp/base"));
 	check("file_put_contents()", write_ok, file_name);
-	check("file_append()", file_text.find("|beta") != String::npos, file_text);
+	check("file_append() / file_append_contents()", file_append_contents(file_name, "|gamma") && contains(file_get_contents(file_name), "|gamma"), file_get_contents(file_name));
+	file_put_contents(file_name, "alpha|beta");
 	check("file_get_contents()", file_text == "alpha|beta", file_text);
+	check("file_mtime()", file_mtime(file_name) > 0, std::to_string((u64)file_mtime(file_name)));
+
+	String real_tmp = path_real("/tmp");
+	String real_file = path_real(file_name);
+	check("path_real() / path_is_within() canonical containment", real_tmp != "" && real_file != "" && path_is_within(file_name, "/tmp") && path_is_within("/tmp/../tmp/uce-site-tests-io.txt", "/tmp") && !path_is_within("/tmp", file_name) && !path_is_within("/tmp", "/tmp/uce-site-tests-io.txt"), real_tmp + " / " + real_file);
+
+	String shell_escaped = shell_escape("a'b; echo injected");
+	String shell_out = shell_exec("printf %s " + shell_escaped);
+	check("shell_escape() / shell_exec()", shell_out == "a'b; echo injected" && contains(shell_escaped, "'\\''"), shell_escaped + " => " + shell_out);
+
+	String lock_file = "/tmp/uce-site-tests-lock.txt";
+	int lock_fd = file_open_locked(lock_file, 66, LOCK_EX, 0644, 3.0, "site tests");
+	bool lock_write = file_put_contents_locked_fd(lock_fd, "locked-content");
+	String lock_read = file_get_contents_locked_fd(lock_fd);
+	file_close_locked(lock_fd);
+	check("file_open_locked() / locked fd read-write / close", lock_fd > 0 && lock_write && lock_read == "locked-content" && file_get_contents(lock_file) == "locked-content", "fd=" + std::to_string(lock_fd) + " read=" + lock_read);
+	int release_fd = file_open_locked(lock_file, 66, LOCK_EX, 0644, 3.0, "release test");
+	file_release_process_locks("site tests release");
+	check("file_release_process_locks()", release_fd > 0, "fd=" + std::to_string(release_fd));
+
+	String start_dir = process_start_directory();
+	String old_cwd = cwd_get();
+	cwd_set("/tmp");
+	String tmp_cwd = cwd_get();
+	cwd_set(old_cwd);
+	check("cwd_get() / cwd_set() / process_start_directory()", old_cwd != "" && tmp_cwd == "/tmp" && process_start_directory() == start_dir && start_dir != "", "old=" + old_cwd + " tmp=" + tmp_cwd + " start=" + start_dir);
+
+	StringMap cfg;
+	cfg["u64"] = "42";
+	cfg["f64"] = "3.5";
+	cfg["yes"] = "yes";
+	cfg["no"] = "off";
+	check("config_map_*() / config_*() helpers", config_map_u64(cfg, "u64", 7) == 42 && config_map_u64(cfg, "bad", 7) == 7 && config_map_f64(cfg, "f64", 1.0) > 3.49 && !config_map_bool(cfg, "no") && config_bool_value("false") == false && config_u64("NO_SUCH_UCE_TEST_KEY", 99) == 99 && config_f64("NO_SUCH_UCE_TEST_KEY", 1.25) == 1.25 && !config_bool("NO_SUCH_UCE_TEST_KEY", false), var_dump(cfg));
+
+	DValue perf = request_perf();
+	check("request_perf()", perf["worker_pid"].to_u64() > 0 && perf["request_count"].to_u64() > 0, json_encode(perf));
+
+	u64 parsed_epoch = time_parse("1970-01-01 00:00:05 UTC");
+	String utc_year = time_format_utc("%Y", parsed_epoch);
+	String local_year = time_format_local("%Y", parsed_epoch);
+	String relative = time_format_relative(time() - 120, "recent %deltaS", 1, "medium %deltaM", 3600, "old %deltaH");
+	check("time_format_local() / time_format_relative() / time_parse()", parsed_epoch == 5 && utc_year == "1970" && local_year != "" && contains(relative, "medium"), "parsed=" + std::to_string(parsed_epoch) + " utc=" + utc_year + " local=" + local_year + " rel=" + relative);
+
+	StringList escaped_keys = memcache_escape_keys({"a b", "line\nkey"});
+	check("memcache_escape_key() / memcache_escape_keys()", memcache_escape_key("a b") == "a_b" && escaped_keys.size() == 2 && !contains(escaped_keys[1], "\n"), join(escaped_keys, ","));
+	check("signal_name() / runtime_safe_key() / capture_backtrace_string()", signal_name(SIGSEGV) == "SIGSEGV" && runtime_safe_key(" task one ") == gen_sha1("task one") && runtime_safe_key("  ") == "" && capture_backtrace_string() == "", signal_name(SIGSEGV) + " / " + runtime_safe_key(" task one "));
 
 	site_tests_summary(passed, failed, skipped, "This page intentionally limits writes to /tmp/uce-site-tests-io.txt so it stays disposable.");
 	site_tests_page_end();

site/tests/manifest.txt

@@ -12,6 +12,7 @@ sqlite.uce|SQLite|SQLite connector with prepared named parameters and DValue row
 zip.uce|ZIP|Archive helpers that create and extract temporary server-side files.|http suite uce internal|ZIP|1|1
 services.uce|Sockets And Services|Network/service helpers that are restricted outside trusted networks.|http suite uce internal|Sockets And Services|1|1
 tasks.uce|Tasks|Background task helper coverage.|http suite uce internal|Tasks|1|1
+api_coverage.uce|API Coverage Manifest|Repository-level guard that public wasm APIs have tests/docs or an explicit internal decision.|http suite uce internal|API Coverage Manifest|1|1
 security_headers.uce|Security Header Sanitizer|Low-level response header sanitizer fixture covered by the security smoke suite.|security http internal fixture|security header sanitizer test|0|1
 cli.uce|CLI Fixture|Local CLI socket fixture; HTTP render intentionally returns 404.|cli internal fixture|uce-unit-cli|0|0
 call_helpers.uce|Unit Call Fixture|Fixture for unit_call and unit_render helper tests.|internal fixture|UNIT_RENDER_FIXTURE|0|0

site/tests/units.uce

@@ -30,6 +30,7 @@ RENDER(Request& context)
 
 	check("units_list()", unit_paths.size() > 0, "count=" + std::to_string(unit_paths.size()));
 	check("unit_info()", info["path"].to_string() != "", json_encode(info));
+	check("unit_compile()", unit_compile("call_helpers.uce"), "call_helpers.uce");
 	check("unit_call()", call_output.find("UNIT_CALL_EXPORT_OK") != String::npos, call_output);
 	check("unit_render()", render_output.find("data-unit-render=\"ok\"") != String::npos, render_output);