fix(miner): open doctor's laptop-state check read-only (camelCase readOnly)

[jeffrey701]

Closes #6765

Problem

checkLaptopStateSqlite (packages/loopover-miner/lib/laptop-init.js:66) opened its connection with { readonly: true }. node:sqlite's DatabaseSync only recognizes the camelCase readOnly option — the lowercase key is silently ignored as unrecognized, so the connection opened read-write. This check is wired into doctor (status.js), whose own header states the contract it violates: "no writes, no network."

The same footgun is already documented in this package by claim-ledger.js's openClaimLedgerReadOnly ("node:sqlite silently IGNORES readonly (lowercase) … and opens read-write anyway") and purge-cli.js.

Fix

Use the camelCase { readOnly: true }, with a comment pointing at the sibling precedent.

Deliverable — grep confirmation: laptop-init.js:66 was the only remaining lowercase instance in packages/loopover-miner/lib/**. Every other DatabaseSync read-only open already uses the camelCase form:

file	option
claim-ledger.js:270	{ readOnly: true } ✅
migrate-cli.js:37	{ readOnly: true } ✅
purge-cli.js:94	{ readOnly: true } ✅
store-maintenance.js:74	{ readOnly: true } ✅
laptop-init.js:66	{ readonly: true } ❌ → fixed here

Tests

test/unit/miner-laptop-init.test.ts adds a regression test that:

1. records the options checkLaptopStateSqlite actually opens with (the function never exposes its own handle) and asserts they are { readOnly: true } — this fails before the fix with expected [ { readonly: true } ] to deeply equal [ { readOnly: true } ];
2. proves why the casing matters, mirroring claim-ledger.js's read-only tests: a write through a { readOnly: true } connection throws, while the silently-ignored lowercase spelling happily writes.

The recording subclass forwards constructor rest-args (an explicit undefined options arg is not the same as omitting it), so every existing test's behavior is unchanged.

Validation

• npx vitest run test/unit/miner-laptop-init.test.ts → 10 passed, 12 total; the 2 failures are pre-existing on Windows only and identical to the baseline before this change (POSIX path-separator + chmod permission semantics) — zero net-new failures.
• npm run typecheck → clean (0 errors)
• Scope: 1 source file + 1 test file

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.64%. Comparing base (4b786b1) to head (f3dd293).
⚠️ Report is 9 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6866   +/-   ##
=======================================
  Coverage   93.64%   93.64%           
=======================================
  Files         685      685           
  Lines       68243    68243           
  Branches    18707    18707           
=======================================
  Hits        63908    63908           
  Misses       3350     3350           
  Partials      985      985           

Flag	Coverage Δ
shard-1	43.23% <0.00%> (-0.46%)	⬇️
shard-2	36.93% <100.00%> (+0.25%)	⬆️
shard-3	32.59% <0.00%> (-0.12%)	⬇️
shard-4	34.36% <0.00%> (-0.40%)	⬇️
shard-5	31.48% <100.00%> (+0.32%)	⬆️
shard-6	45.97% <100.00%> (+0.28%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
packages/loopover-miner/lib/laptop-init.js	98.26% <100.00%> (ø)

[loopover-orb]

Tip

✅ LoopOver review result - approve/merge recommended

_{Review updated: 2026-07-17 09:31:50 UTC}

2 files · 1 AI reviewer · no blockers · readiness 88/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This is a one-line typo fix: `readonly` -> `readOnly` in `checkLaptopStateSqlite`'s `DatabaseSync` open, matching the camelCase convention already used consistently elsewhere in this package (claim-ledger.js, migrate-cli.js, purge-cli.js, store-maintenance.js). The regression test correctly proves the bug by asserting the exact options object passed to the constructor via a recording subclass, and independently demonstrates that the lowercase spelling permits writes while the camelCase spelling throws on write — this is a real, non-fabricated test of the actual node:sqlite behavior. The fix is narrowly scoped, correctly targets the source of the bug (not a symptom), and closes the linked issue #6765.

Nits — 4 non-blocking

• The inline comment in laptop-init.js:66-68 is fairly long for a one-line fix; could be trimmed to a single line referencing the sibling precedent without losing the key point.
• The test mocks `node:sqlite` globally for the whole file via `vi.mock`, which is a broader blast radius than needed just to capture one call's options — a lighter-weight `vi.spyOn` on the exported check via dependency injection would avoid mocking the entire module for all tests in the file, though this doesn't appear to break other tests here.
• Consider whether the same recording-mock pattern is duplicated elsewhere (e.g., claim-ledger tests) and could be extracted to a shared test helper to avoid drift, per DRY.
• The PR could mention whether a lint rule (e.g., a custom ESLint rule banning lowercase `readonly` in `DatabaseSync` calls) would prevent this class of typo from recurring, given it's now happened at least once.

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#6765
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	❌ 8/20	High review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 121 registered-repo PR(s), 59 merged, 30 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	jeffrey701; Gittensor profile; 121 PR(s), 30 issue(s).
Improvement	✅ Minor	risk: clean · value: minor · LLM: moderate

Linked issue satisfaction

Addressed
The diff corrects the typo to `{ readOnly: true }` in laptop-init.js:66, adds a regression test that both records the options used and verifies driver-enforced read-only behavior (write throws) versus the lowercase footgun (write succeeds), and the PR description provides a grep-based table confirming no other lowercase instances remain in the package.

Review context

• Author: jeffrey701
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: TypeScript, Clojure, JavaScript, Rust
• Official Gittensor activity: 121 PR(s), 30 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Start here: Add a concise scope and risk note.
• Then work through the remaining 1 step in the Signals table above.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

LoopOver approves — the gate is satisfied and CI is green.