Property lens expectations in camelCase are neither authorised nor stripped, so the node dies (third shape of #285) #293

Third live occurrence of the same underlying defect, under a third identifier shape. Found in Aave v4 run R45 at 2026-08-06T18:28:20Z.

The failure

property-specification-runtime-verification failed with:

Property lens expectation "testConvertToAssetsSharesDesirable" is not present in a supplied pinned-reference catalog;
Property lens expectation "testConvertToSharesAssetsDesirable" is not present in a supplied pinned-reference catalog;
Property lens expectation "testPreviewDepositZeroAmountReturnsZero" is not present in a supplied pinned-reference catalog;
Property lens expectation "testPreviewRedeemZeroAmountReturnsZero" is not present in a supplied pinned-reference catalog;
Property lens expectation "testPreviewWithdrawPositiveAmountReturnsGtZero" is not present in a supplied pinned-reference catalog

These are test-function names from that lens's own pinned reference — the ERC4626 property suite. The lens prompt tells the model to carry identifiers unchanged from the pinned-reference documents, and it did.

Mechanism, verified mechanically

sanitizeLensReferenceExpectationAuthority strips unauthorised expectations only when every unauthorised identifier looks like a catalogue label (artifact-gates.ts:1725):

if (unauthorized.some((expectationId) => !isUnsupportedExternalReferenceLabel(expectationId))) return property;

and the shape test (artifact-gates.ts:1792) is:

/^[A-Z][A-Z0-9]*(?:[-_][A-Z0-9]+)*[-_]\d+$/u

So a camelCase identifier is neither authorised nor strippable, and the node fails.

History — this is whack-a-mole, and it should stop being played that way

1. LEND-01, hyphenated: stripped correctly.
2. LEND_ACC_01, underscored: killed R44 → Lens reference-expectation sanitizer only recognizes hyphenated labels, so underscore catalog IDs fail the node #283, fixed by fix(runtime): sanitize underscore-separated reference labels #284 widening the shape to accept _.
3. testConvertToAssetsSharesDesirable, camelCase: kills R45's runtime-verification lens now.

A fourth widening would accept almost any token and would defeat the gate's purpose, so the shape test is the wrong axis. The real issue is the one #285 already states: the gate only honours identifiers from a structured ultrafuzz/reference-expectations@1 catalogue, and these runs never supply one, so every citation is technically unauthorised and survival depends on cosmetic identifier shape.

Suggested direction, not a patch

Distinguish two situations the gate currently conflates:

• No catalogue supplied at all. No identifier could ever be authorised, so failing the node punishes the model for following its prompt. Strip and warn.
• A catalogue is supplied and the identifier is absent from it. That is the forgery case, and it must keep failing closed.

This split looks compatible with the seven existing tests that pin byte-unchanged preservation of a forged benchmark mapping — worth verifying, because two earlier review suggestions (per-identifier stripping, and flipping the "unverifiable" policy) were rejected precisely for breaking them. Whoever picks this up should check whether those fixtures supply a catalogue; if they do, the split is safe and #285 can be closed with it.

Severity

Not run-fatal. R45's fan-in aggregated the seven surviving lenses and the pipeline continued to stateful-invariant-setup. The cost is the silent loss of one reference lens's entire contribution, which is a coverage regression that no report would show as missing.